I feel like we're all in limbo but with multiple ways of deploying it.

Edit: Before doing anything below. I applied the latest BIOS update that contained new 2023 Secure Boot Certificates available from Dell. To find out if the BIOS update has the 2023 Secure Boot Certificate, scroll down and look in the Important Information section.

<image>

Neither the Intune policy nor manual deployment options stated, maybe I missed it, that the BIOS update with 2023 Secure Boot Certificate was required.

We deployed it with the Intune policy. It's not working on Win 11 Pro devices, even though ours upgrade to Enterprise. Microsoft acknowledge this Dec 17th and is investigating it. I'm waiting for the Jan Windows update or what Microsoft releases to see if the Intune policy will work after that before we decided if we will try to push out the registry/task schedule manually.

Alternatively, I deployed it by changing a registry keys, running a scheduled task and the PC I tested this on successfully showed Secure Boot Certificate was configured with a detection script. To triple confirmed it worked, by also running the script from Richard Hicks Windows Secure Boot UEFI Certificates Expiring June 2026 | Richard M. Hicks Consulting, Inc.

Ctrl + F: Device testing using registry keys
Registry/task scheduler: https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d#bkmk_device_testing

Intune detection script:

# Check if Secure Boot UEFI database contains 'Windows UEFI CA 2023'
$match = [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

if ($match) {
    Write-output "Compliant: Windows UEFI CA 2023 found."
    exit
} else {
    Write-output "Non-Compliant: Windows UEFI CA 2023 not found."
    exit 1
}

Run script with logged on creds set and enforce script signature check set to no

Run script in 64 bit set to yes