How to Fix Secure Boot Certificate Expiry Error 65000 in Microsoft Intune

Before troubleshooting Error 65000, confirm the actual Secure Boot status on affected devices. Despite Intune reporting failures, Secure Boot is often functioning correctly.

Open PowerShell as Administrator on the affected device and run:

Confirm-SecureBootUEFI

This should return True if Secure Boot is enabled. Next, check the Windows licensing status:

slmgr /dli

Look for the edition information. Common problematic scenarios include:

• Windows Pro OEM edition with E3/E5 subscription activation
• Enterprise licenses that reverted to Pro after subscription changes
• Devices showing "Windows 10/11 Pro" despite Enterprise licensing

Error 65000 often occurs when devices lack the required servicing baseline. Microsoft requires specific cumulative updates from January 2026 onwards for Secure Boot certificate management.

Check the installed updates on the device:

Get-HotFix | Where-Object {$_.InstalledOn -gt (Get-Date "2026-01-01")} | Sort-Object InstalledOn -Descending

Alternatively, use Windows Update history:

Get-WmiObject -Class Win32_QuickFixEngineering | Where-Object {$_.InstalledOn -gt "1/1/2026"} | Select-Object HotFixID, Description, InstalledOn

In Microsoft Intune admin center, navigate to Reports > Windows quality updates to verify update compliance across your device fleet.

If devices are missing recent cumulative updates, deploy them immediately through Intune or Windows Update for Business before proceeding with Secure Boot policies.

Configure the proper Intune policy to enable Secure Boot certificate updates using the Settings Catalog approach, which provides more granular control than traditional device configuration profiles.

In the Microsoft Intune admin center:

1. Navigate to Devices > Configuration profiles
2. Click Create profile
3. Select Windows 10 and later as the platform
4. Choose Settings catalog as the profile type
5. Click Create and provide a descriptive name like "Secure Boot Certificate Update - Pilot"

In the settings configuration:

1. Click Add settings
2. Search for "SecureBoot" in the settings browser
3. Expand the SecureBoot category
4. Select Enable Secureboot Certificate Updates
5. Set the value to 1 (Enabled)

Configure the assignment scope to target a pilot group initially. Create a device filter based on specific models or OS versions that have confirmed update baseline compliance.

After deploying the Intune policy, manually trigger the Secure Boot certificate update process to accelerate testing and validation.

On the target device, open PowerShell as Administrator and run:

schtasks /Run /TN "\Microsoft\Windows\SecureBoot\CertificateUpdate"

Check if the scheduled task exists and its last run status:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\SecureBoot\" -TaskName "CertificateUpdate" | Get-ScheduledTaskInfo

If the scheduled task approach fails, implement the registry-based fallback method:

# Enable the Secure Boot certificate update registry key
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "ConfigureMicrosoftUpdateManagedOptIn" -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\ConfigureMicrosoftUpdateManagedOptIn" -Name "1" -Value 1 -Type DWord

# Restart the Windows Update service to process the change
Restart-Service -Name "wuauserv" -Force

Monitor the Windows Event Logs for Secure Boot certificate update activity:

Get-WinEvent -FilterHashtable @{LogName='System'; ID=1074,1076} -MaxEvents 10

Track the Secure Boot policy deployment status and collect detailed diagnostic information to identify the root cause of Error 65000 occurrences.

In Microsoft Intune admin center, navigate to Reports > Windows quality updates > Secure Boot status to view deployment metrics across your device fleet.

On individual devices experiencing Error 65000, collect detailed policy information:

# Check Intune policy processing logs
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'} -MaxEvents 20 | Where-Object {$_.Message -like "*65000*" -or $_.Message -like "*SecureBoot*"}

Examine the specific error details in the registry:

# Check for policy rejection details
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SecureBoot" -ErrorAction SilentlyContinue

Look for the specific error code pattern indicating licensing issues:

# Search for the licensing policy rejection error
Get-WinEvent -FilterHashtable @{LogName='Application'} | Where-Object {$_.Message -like "*POLICYMANAGER_E_AREAPOLICY_NOTAPPLICABLEINEDITION*"}

Document devices showing Error 65000 but with functional Secure Boot (confirmed in Step 1) versus devices with actual certificate update failures.

For devices still experiencing Error 65000 after Microsoft's service-side fixes (deployed January-February 2026), implement targeted workarounds while waiting for complete licensing propagation.

First, verify if your tenant has received the licensing service updates:

# Check tenant licensing service version (run from any domain-joined device)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" -Name "LastLoggedOnProvider" -ErrorAction SilentlyContinue

For devices with subscription-activated Enterprise licenses showing as Pro, force license refresh:

# Force Windows license refresh
slmgr /ato
slmgr /dli

# Clear licensing cache and re-evaluate
slmgr /cpky
slmgr /upk
slmgr /ipk [Your-Enterprise-Product-Key]
slmgr /ato

Create a remediation script for bulk deployment through Intune Remediations:

# Detection script
$secureBootEnabled = Confirm-SecureBootUEFI
$policyError = Get-WinEvent -FilterHashtable @{LogName='Application'} -MaxEvents 50 | Where-Object {$_.Id -eq 65000}

if ($secureBootEnabled -and $policyError) {
    Write-Output "Remediation needed: Secure Boot enabled but policy error present"
    exit 1
} else {
    Write-Output "Secure Boot status acceptable"
    exit 0
}

Deploy this as an Intune Remediation with a corresponding remediation script that forces the certificate update process.

Establish comprehensive validation procedures to confirm Secure Boot certificate updates completed successfully and implement ongoing monitoring for future certificate renewals.

Verify the certificate update timestamp on devices:

# Check Secure Boot certificate information
Get-SecureBootPolicy | Select-Object -Property *

# Verify certificate update completion
Get-WinEvent -FilterHashtable @{LogName='System'; ID=1074} | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7) -and $_.Message -like "*SecureBoot*"}

Create a comprehensive validation report combining Intune data with device-level verification:

# Comprehensive Secure Boot status check
$results = @{
    'SecureBootEnabled' = Confirm-SecureBootUEFI
    'LastCertificateUpdate' = (Get-WinEvent -FilterHashtable @{LogName='System'; ID=1074} | Where-Object {$_.Message -like "*SecureBoot*"} | Select-Object -First 1).TimeCreated
    'PolicyError65000' = (Get-WinEvent -FilterHashtable @{LogName='Application'} | Where-Object {$_.Id -eq 65000} | Measure-Object).Count
    'WindowsEdition' = (Get-ComputerInfo).WindowsEdition
    'LastUpdateInstall' = (Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1).InstalledOn
}

$results | ConvertTo-Json

Set up proactive monitoring using Intune Remediations to detect future certificate expiry issues:

1. Create a detection script that checks certificate validity periods
2. Schedule monthly execution to identify devices approaching certificate expiry
3. Configure automated alerts when certificate updates fail

Document the resolution process and create a playbook for future certificate renewal cycles, as Microsoft Secure Boot certificates will continue to expire periodically.