The Secure Boot certificate rollover (the KB5025885 / CVE-2023-24932 saga) has been a slow-moving headache for anyone doing bare-metal OSD. Your boot images are signed with a boot loader that’s on the way to being revoked, and doing the mitigation by hand is exactly the kind of fiddly, easy-to-get-wrong task that sits at the bottom of everyone’s list. Configuration Manager 2509 automates it.
The new checkbox
Boot image properties, Data Source tab, a new option: “Use Windows Boot Loader signed with Windows UEFI CA 2023.” Tick it, and ConfigMgr updates the boot image to use the boot loader signed with the newer UEFI CA 2023 certificate — automating the mitigation steps from KB5025885 rather than leaving you to script them.
The catch worth reading twice
This only works on WDS-less, PXE-enabled distribution points. If your PXE still runs on the classic WDS-backed setup, the checkbox doesn’t do the job for you. That’s not a footnote — it’s the deciding factor for whether this feature applies to your environment at all. Plenty of estates are still on WDS-based PXE, and for them this is a nudge toward the WDS-less model as much as a convenience.
Why bother
Secure Boot mitigation isn’t optional forever — the old boot loader’s revocation is coming, and a boot image signed with the wrong loader is a future OSD outage waiting for a date. Automating it on modern PXE means one less manual, error-prone step in your imaging pipeline, and one less thing to remember before the revocation actually lands.
Source: Microsoft Learn. Summarised independently — check the source for the latest detail.