What’s New
Configuration Manager boot image properties now include an option to use a Windows Boot Loader signed with the Windows UEFI CA 2023 certificate. When the option is selected, the boot image is updated to pick up the newer signed boot loader instead of relying on an older signature.
For admins, this matters because Secure Boot validation depends on the certificate that signed the boot loader. Keeping boot images aligned with the current signing authority helps ensure that task sequences and PXE or media-based deployments continue to boot on devices whose Secure Boot configuration trusts the newer certificate.
Where to Find the Setting
The new checkbox lives on the Data Source tab of a boot image’s properties, alongside the other boot image behaviour options. It is set per boot image, so review both the x64 and any additional custom boot images you use in your environment.
How to Enable It
Enable the option on each boot image you want to update:
- In the Configuration Manager console, open the properties of the boot image.
- Switch to the Data Source tab.
- Select “Use Windows Boot Loader signed with Windows UEFI CA 2023”.
- Apply the change and let the boot image update and redistribute to your distribution points.
Things to Check Before Rolling Out
Treat this like any other boot image change: update and redistribute the image, then validate before you touch production deployments. Test a PXE boot and a bootable media boot on representative hardware, and confirm that devices with Secure Boot enabled start the task sequence as expected. If you maintain standalone or prestaged media, regenerate it after the boot image is updated so the media carries the new boot loader.
Source: Microsoft Learn. Summarised independently — check the source for the latest detail.