How to Fix Secure Boot Certificate Expiry Error 65000 in Microsoft Intune
Resolve the Secure Boot certificate expiry error 65000 in Microsoft Intune by deploying the updated UEFI CA 2023 certificates and confirming devices report compliant again.
- Difficulty
- Intermediate
- Steps
- 5
- Platform
- Microsoft Intune
Table of contents
Quick Answer
Go to the stepsError 65000 on Secure Boot compliance in Intune is often caused by the expiring UEFI CA 2011 certificates. Fix it by backing up your current policy, confirming devices have the required Windows servicing updates, enabling the supported opt-in that triggers the managed UEFI CA 2023 certificate rollout, assigning it to the affected devices, and then rechecking compliance in Intune.
- Confirm error 65000 maps to the expiring UEFI CA 2011 certificates, not another Secure Boot issue.
- Export the affected configuration/compliance policy as a backup and confirm required Windows servicing updates are installed.
- Enable the supported opt-in to trigger the managed UEFI CA 2023 certificate and boot manager update.
- Assign the updated profile to the affected device group and sync the devices.
- Recheck compliance and configuration status and confirm error 65000 is gone.
Microsoft Intune admin center > Devices > ConfigurationExpected result: Targeted devices trust the UEFI CA 2023 certificate, the updated boot manager is applied, and error 65000 no longer appears — devices report compliant in the Intune admin center.
Key takeaways
- You will learn how to identify the root cause of Secure Boot certificate expiry error 65000 in Microsoft Intune, back up your existing configuration, deploy the updated UEFI CA 2023 certificate through a supported opt-in, and confirm that affected devices return to a compliant state.
- The UEFI CA 2011 certificates that underpin Secure Boot are expiring, and until the newer certificates are trusted, affected Windows devices can surface error 65000 as a Secure Boot compliance failure in Intune. Left unaddressed, this blocks accurate compliance reporting and can affect Conditional Access outcomes tied to device health.
- Error 65000 is resolved by enabling the managed Secure Boot certificate update so devices receive the UEFI CA 2023 certificate and return to a compliant state.
Introduction
Error 65000 shows up in the Microsoft Intune admin center as a Secure Boot compliance or configuration failure, and one common trigger is the pending expiry of the UEFI CA 2011 certificates that Windows uses to validate boot components. The fix is to allow the managed rollout of the UEFI CA 2023 certificate and an updated boot manager so devices continue to trust their Secure Boot chain and stop reporting the failure. This walkthrough starts by confirming that error 65000 actually maps to the certificate expiry rather than another Secure Boot problem, since the same error code can be raised by unrelated issues. You will then export your current device configuration or compliance policy as a backup, verify that devices have the required Windows servicing updates installed, enable the Microsoft-provided opt-in, and assign the change to the affected device group. Finally, you will recheck compliance and configuration status in Intune to validate that the new certificate is present and that error 65000 no longer appears. Because this changes Secure Boot trust on managed endpoints, treat it as a medium-risk change and back up your settings before you begin.
Who this is for: This guide is for sysadmins, MSP technicians, and IT pros who manage Windows endpoints through the Microsoft Intune admin center and are seeing error 65000 on Secure Boot compliance or configuration status.
Before you start
- Access
- Sign in to the Microsoft Intune admin center with an account that can create, edit, and assign device configuration and compliance policies. You also need permission to export policy settings for the affected device group before making changes.
- Required roles
- Intune Administrator
- Policy and Profile Manager (for creating and assigning configuration/compliance policies)
- Required licenses
- Microsoft Intune Plan 1
- Vendor
- Microsoft
- Administrator permissions required
- Backup required
Steps reference the Microsoft Intune admin center under Devices > Configuration. Verify exact behavior against current Microsoft guidance for the Secure Boot certificate update before deploying broadly.
Configuration takes about 15-30 minutes; certificate deployment and reboot cycles can take longer to fully propagate across all devices.
Warning: Back up affected policies before you change them
Before editing anything, export the affected device configuration profile and compliance policy (the JSON/settings for the policy targeting devices reporting error 65000). If a change causes wider Secure Boot compliance failures, you can compare against or restore from this export rather than reconstructing settings from memory.
Warning: Secure Boot changes affect the device boot path
Deploying the UEFI CA 2023 certificate and updating the boot manager modifies Secure Boot trust and boot components. Stage the rollout to a small pilot device group first, confirm those devices reboot and report compliant, and only then expand to all affected devices. A misapplied or interrupted certificate update can leave devices in an inconsistent Secure Boot state.
Note: Confirm servicing updates are present first
The managed certificate rollout depends on devices having the required Windows servicing updates installed. Deploying the opt-in to devices that are behind on updates may result in no change or continued error 65000 until they are patched.
1Confirm the error 65000 root cause
Understand why targeted devices report error 65000 before changing anything.
Microsoft Intune admin center > Devices > Configuration > (select profile) > Device statusSign in to the Microsoft Intune admin center and open the affected policy's status view. Go to Devices > Configuration (or Devices > Compliance if the failure surfaces there), select the profile flagging the issue, then open Device status or Per-setting status.
Look for devices showing an error state with code 65000. In Intune, 65000 is a generic "not applicable / setting could not be applied" code, so you must confirm it maps to the Secure Boot / UEFI CA certificate rollout rather than an unrelated setting. Correlate the failing setting name with a Secure Boot or firmware-related setting, and cross-check the device against Microsoft's guidance on the expiring Microsoft UEFI CA 2011 and KEK CA 2011 certificates.
Where possible, confirm the current Secure Boot state directly on a representative device using the PowerShell command below to establish that Secure Boot is enabled and to capture the baseline before you make changes.
Confirm-SecureBootUEFIExpected result: You can identify the specific devices reporting error 65000 and confirm the failing setting relates to Secure Boot; Confirm-SecureBootUEFI returns True on an affected device.
Note
Error 65000 is not unique to Secure Boot — the same code appears for many settings that report as not applicable. Do not assume the cause without correlating the failing setting name. Run PowerShell as Administrator. If Confirm-SecureBootUEFI returns an error such as "Cmdlet not supported on this platform", the device is in legacy BIOS/CSM mode and this certificate rollout does not apply to it.
2Back up current configuration and check prerequisites
Protect existing settings and confirm devices are patched before deploying the certificate update.
Microsoft Intune admin center > Devices > Configuration > (select profile) > PropertiesBefore making changes, export the affected profile so you can roll back. In Devices > Configuration, open the profile, and if you use Intune's export/import tooling (for example the Microsoft Graph API or a supported PowerShell export), capture the current JSON definition. At minimum, document the profile name, assignments, and each configured setting value.
Confirm the prerequisites Microsoft requires for the Secure Boot certificate rollout:
- Devices are running a supported, currently serviced version of Windows with the latest cumulative/servicing updates installed.
- Devices boot in UEFI mode with Secure Boot enabled (verified in the previous step).
- Diagnostic data is allowed at the level Microsoft's managed rollout requires.
Use the command below to retrieve the current profile JSON via Microsoft Graph as your backup artifact. Save the output to a file and store it securely.
Get-MgDeviceManagementDeviceConfiguration -DeviceConfigurationId "<PROFILE_ID>" | ConvertTo-Json -Depth 20 | Out-File .\intune-secureboot-backup.jsonExpected result: You have a saved JSON export of the current profile and confirm affected devices are fully patched with Secure Boot enabled.
Note
Replace <PROFILE_ID> with the configuration profile ID from the admin center URL or from Get-MgDeviceManagementDeviceConfiguration. This requires the Microsoft.Graph PowerShell module and delegated permissions such as DeviceManagementConfiguration.Read.All. Applying the certificate update without current servicing updates is the most common reason the rollout does not proceed — patch first.
3Enable the Secure Boot certificate update
Configure the opt-in so devices receive the UEFI CA 2023 certificate and updated boot manager.
Microsoft Intune admin center > Devices > Configuration > Create > New Policy > Windows 10 and laterMicrosoft delivers the new Windows UEFI CA 2023 certificate (and, where applicable, the updated boot manager and KEK) through a servicing-managed rollout that you opt into with a registry value. In Intune, deploy this opt-in using a Settings catalog or a Configuration profile > Templates > Custom (OMA-URI) profile that sets the Microsoft-documented registry key controlling the Secure Boot certificate update.
Create a new profile in Devices > Configuration > Create > New Policy, choose Windows 10 and later as the platform, select the profile type, and configure the opt-in registry value exactly as documented by Microsoft for the Secure Boot certificate rollout. Do not invent a key name — use the value from Microsoft's current Secure Boot certificate expiration guidance.
The registry opt-in below reflects the documented AvailableUpdates opt-in pattern; confirm the exact value against Microsoft's guidance for your Windows build before deploying.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Secureboot" /v AvailableUpdates /t REG_DWORD /d 0x40 /fExpected result: The opt-in profile saves successfully in Intune and, on a test device, the registry value is present and the servicing-managed update begins over subsequent reboots.
Note
The AvailableUpdates value and the specific data (for example 0x40) are staged and can change per Microsoft's rollout phase and Windows build — verify the current value against Microsoft's official Secure Boot certificate expiration documentation before deploying to production. The update is applied by Windows servicing across multiple reboots, not instantly. Test on a pilot ring first because this modifies firmware trust anchors.
4Assign and deploy the policy to affected devices
Push the fix to the device group hitting error 65000 and trigger a sync.
Microsoft Intune admin center > Devices > Configuration > (select profile) > AssignmentsOpen the opt-in profile you created and go to Assignments. Under Included groups, add the device group containing the machines reporting error 65000 (ideally a pilot ring first, then broaden). Avoid assigning to "All devices" until the pilot is validated. Save the assignment.
To speed up delivery, trigger a sync on the targeted devices. From Devices > All devices, select a device and choose Sync, or have users sync from the Company Portal app. Because the certificate update is delivered by Windows servicing and applied across reboot cycles, ensure devices are restarted after policy delivery.
Expected result: The profile shows the targeted group under Assignments and devices report the policy as received after syncing.
Note
Policy delivery and the actual certificate application are separate events. Intune may report the setting as delivered quickly, but the firmware certificate is only committed after Windows servicing processes it across one or more reboots. Plan for multiple restart cycles over several days before expecting all devices to complete.
5Verify devices report compliant
Confirm the new certificate is present and that error 65000 no longer appears.
Microsoft Intune admin center > Devices > Configuration > (select profile) > Device statusGive devices time to reboot and complete the servicing-managed update, then return to Devices > Configuration (and Devices > Compliance if relevant), open the profile, and review Device status. Confirm the previously failing devices no longer show error 65000 and now report Succeeded or Compliant.
Validate on a representative device that the new Windows UEFI CA 2023 certificate is present in the Secure Boot database. Use the PowerShell command below to read the Secure Boot signature database (db) and confirm the 2023 certificate appears alongside or in place of the 2011 CA. Cross-check against Microsoft's guidance for the expected certificate names.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'Expected result: Targeted devices show Succeeded/Compliant in Intune, error 65000 is gone, and the db query confirms the Windows UEFI CA 2023 certificate is present.
Note
Run the PowerShell command as Administrator. Reading the db variable returns raw binary; the string match is a quick presence check, not a full certificate parse. If the 2023 certificate is not yet present, the device likely has not completed all required reboot cycles — allow more time before troubleshooting further. Compliance state in Intune can lag device reality by up to a reporting cycle.
Verify the fix: devices no longer report Secure Boot error 65000
Verify fix
After the UEFI CA 2023 certificate has been deployed and the targeted devices have completed the required reboot cycles, return to the Microsoft Intune admin center to confirm the fix took effect. The goal is not just to see the policy "Applied" — you are confirming that the underlying Secure Boot compliance state has recovered and that error 65000 has cleared for the devices that were previously failing.
Check the fix at two levels. First, review the device configuration/compliance status for the targeted group and confirm the previously failing devices now show a succeeded or compliant state instead of error 65000. Second, spot-check individual devices to confirm the new certificate is actually present and Secure Boot remains enabled, rather than assuming a policy report alone reflects the device's true boot state.
Allow time for devices to sync and reboot before treating a result as final — a device that has not yet completed its reboot cycle may still report the old error even though the policy assignment is correct. If some devices remain in error after they have synced and rebooted, treat those as outliers to investigate (servicing update level, sync status, or a different Secure Boot problem) rather than as a failure of the overall fix.
Normal result: Previously affected devices report a succeeded/compliant Secure Boot state, error 65000 no longer appears for those devices, and spot-checked devices show the updated certificate present with Secure Boot still enabled after reboot.
Abnormal result: Devices continue to report error 65000 after syncing and completing reboot cycles, still show the old certificate, or show a new configuration error. This indicates missing servicing updates, an unsynced/not-yet-rebooted device, or a Secure Boot issue unrelated to the certificate expiry that needs separate investigation.
Compliant device after fix
Configuration status: Succeeded — Secure Boot compliant
The expected state for a device that has synced, rebooted, and received the UEFI CA 2023 certificate. Error 65000 is no longer listed for the device.
Still-failing device
Configuration status: Error 65000 (Secure Boot)
Investigate this device individually: confirm it has synced, completed a reboot cycle, and has the required Windows servicing updates installed before concluding the fix failed.
Rollout progress across the group
Assigned devices: succeeded rising over successive reboot cycles
Because the certificate update applies on reboot, expect the compliant count to climb over multiple sync/reboot cycles rather than flip to 100% immediately.
Troubleshooting
Devices still report error 65000 after the policy is assigned
Warning
Cause: The certificate update relies on diagnostic data being enabled and one or more reboot cycles to complete; the device may not have synced, rebooted, or sent the required telemetry yet.
Confirm the device has checked in (Intune admin center > Devices > select device > Sync), verify diagnostic data is enabled, and allow the device to complete at least one full reboot cycle. Re-run the compliance evaluation and re-check status after the device reports back.
The configuration profile shows as applied but the UEFI CA 2023 certificate is not present in the Secure Boot database
Warning
Cause: Required Windows servicing updates that carry the updated boot manager and certificate payload are missing, so the managed rollout cannot stage the new certificate.
Verify the device has the latest cumulative Windows update installed, then re-sync the device. Without the current servicing update the opt-in cannot deliver the UEFI CA 2023 certificate and the update will keep deferring.
Compliance failure is Secure Boot related but does not map to the expiring UEFI CA 2011 certificates
Critical
Cause: Error 65000 can surface for other Secure Boot problems such as Secure Boot being disabled in firmware or an unsupported boot configuration, not only certificate expiry.
Review the specific Secure Boot compliance detail in Intune before deploying the certificate opt-in. If Secure Boot is disabled or the device is not in UEFI mode, resolve the firmware/boot configuration first, since the certificate update will not fix an unrelated Secure Boot state.
The opt-in registry value or profile deploys but appears to have no effect
Note
Cause: Diagnostic data is not permitted on the device, which the managed certificate rollout requires to trigger.
Confirm diagnostic data collection is allowed via policy, then redeploy the opt-in. The managed rollout depends on diagnostic data being enabled to schedule and apply the UEFI CA 2023 certificate.
Frequently asked questions
What causes Secure Boot error 65000 in Intune?
Error 65000 typically appears when a device fails the Secure Boot compliance check because the trusted UEFI CA 2011 certificates are expiring and have not yet been replaced by the newer UEFI CA 2023 certificate. It can also surface for other Secure Boot issues, so confirm the specific compliance detail before treating it as certificate expiry.
When do the Secure Boot UEFI CA 2011 certificates expire?
The original UEFI CA 2011 certificates reach expiry and must be superseded by the UEFI CA 2023 certificate. Check the current expiry dates in Microsoft's official Secure Boot certificate guidance for your device population, as exact dates depend on the certificate in use.
Is it safe to enable the Secure Boot certificate update on managed devices?
Yes, the certificate update is a Microsoft-provided managed rollout, but treat it as a medium-risk change: back up the affected configuration and compliance policies first and confirm devices have the required Windows servicing updates. Pilot the update on a small device group before broad deployment.
How long does it take for the UEFI CA 2023 certificate to deploy?
Deployment is not instant because it depends on the device syncing with Intune, sending diagnostic data, and completing one or more reboot cycles. Allow several check-in and reboot cycles before expecting affected devices to report compliant.
What should I do if devices still report error 65000 after applying the fix?
Confirm the device has synced, has diagnostic data enabled, has the latest Windows servicing update, and has rebooted at least once. Then re-run compliance evaluation and verify the UEFI CA 2023 certificate is present before escalating.
Conclusion
You confirmed that Secure Boot error 65000 maps to the expiring UEFI CA 2011 certificates, backed up the affected configuration and compliance policies, and deployed the Microsoft-provided opt-in to roll out the UEFI CA 2023 certificate and updated boot manager. After assigning the profile to affected devices and syncing them, you verified the new certificate is present and that error 65000 no longer appears.
Error 65000 is resolved by enabling the managed Secure Boot certificate update so devices receive the UEFI CA 2023 certificate and return to a compliant state.
Microsoft Intune admin center > Devices > Configuration
