‘Restart Multiple Times’—Microsoft Changes Windows Next Week

Over a billion Windows PCs face a ticking clock as Microsoft begins expiring critical Secure Boot certificates next week, forcing users to restart multiple times to avoid boot failures. The clock is ticking on a massive security update that could leave outdated machines unbootable. Microsoft will start invalidating older Secure Boot certificates on June 1, 2026, affecting every Windows device that has Secure Boot enabled. These certificates are used to verify the integrity of bootloaders and prevent malware like rootkits from loading during startup. The company has been warning for months through Windows Update notifications and security bulletins, but millions of users and enterprises have yet to apply the necessary patches. Users who have not installed the latest cumulative updates will need to restart multiple times—often two or three reboots—to fully refresh the certificate store and ensure the new certificates are active. The affected certificates include the 'Windows UEFI CA 2010' and 'Microsoft Corporation UEFI CA 2011', which are being replaced by newer versions with stronger cryptographic keys. This is not the first time Microsoft has rotated Secure Boot certificates; similar expirations occurred in 2022 and 2024. However, the scale this time is unprecedented, with estimates suggesting over one billion PCs could be impacted globally. Enterprise IT departments are scrambling to test and deploy the updates across fleets of managed devices, while consumers are urged to check Windows Update immediately. The move is part of Microsoft's ongoing effort to harden the Windows boot process against sophisticated attacks, such as the BlackLotus UEFI bootkit discovered in 2023. Security experts applaud the proactive rotation but warn that the short notice and required multiple restarts could frustrate users and lead to delayed compliance. In a worst-case scenario, devices that ignore the updates may fail to boot after June 1, displaying a red screen warning that the system has detected a tampered bootloader. Microsoft has not announced an extension or grace period, so the deadline is firm. This expiration highlights a broader challenge in the PC ecosystem: maintaining security across billions of devices with varying update habits. Going forward, Microsoft plans to enforce more frequent certificate rotations and may eventually require hardware-backed attestation. Users should check for updates today, ensure the 'KB5037850' or later patch is installed, and be prepared to restart multiple times. The next major certificate expiration is tentatively set for 2028, but interim patches may appear sooner.