All change for Windows.

AFP via Getty Images

Updated on Apr. 18 with another Windows update starting this month.

Microsoft’s new Patch Tuesday is a bumper update — 8 critical flaws topped off by an actively exploited zero-day vulnerability. All PC owners should update as soon as possible. If you’re running Windows 11, that’s simple. But if you’re among the hundreds of millions still on Windows 10, you need Microsoft’s extended support.

None of that is surprising or different to the monthly norm for PC owners. What is different, Microsoft says, is that “starting in April 2026, the Windows Security app displays additional information about the status of Secure Boot certificate updates on your device. You can find this under Device security > Secure Boot.”

This has never happened before. After 15 years, Microsoft is expiring Secure Boot certificates for the first time. These are based on an issue in 2011. Unless your PC is under two-years old, you’re still reliant on them now. They expire in June, by which time you need to have installed the 2023 Secure Boot certificates to stay safe.

ForbesWhy You Should Stop Google’s Hidden Tracking On Your iPhoneBy Zak Doffman

Microsoft says “refreshing new certificates represents one of the largest coordinated security maintenance efforts across the Windows ecosystem, spanning Windows servicing, firmware updates and millions of unique device configurations delivered by hardware manufacturers, or original equipment manufacturers (OEMs), worldwide. Because Secure Boot operates at the firmware level and affects how a PC starts, these changes have required careful preparation to help minimize disruptions while maintaining security and device reliability at scale.”

This is timely now, because the update status check and the new certificates are integrated into this latest security update. If you are not eligible for this update, you don’t get the alert or the new certificates either. Enrol in the ESU now.

Microsoft has just updated its advice for Windows users to confirm all this: “Updated 2023 certificates are being delivered automatically through Windows Update,” and that “the Windows Security app now shows whether devices have received these updates, their current status, and whether any action is needed.”

So, what are you looking for? Essentially, “a green, yellow, or red badge attached to the Secure Boot icon indicates your current Secure Boot status. Text guidance is presented along with these badges to provide more detail.”

Be warned though “a green checkmark alone does not confirm your certificates are updated. Look also for the text: ‘Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed.’"

That’s the April update. And then from next month, Microsoft says, you’ll see more warnings if your certificates are approaching that June deadline. “Beginning in May 2026, additional improvements will become available, including notifications outside the app (such as system alerts) and additional in‑app guidance and controls to help you respond to Secure Boot warnings.” Put simply — no excuses.

Meanwhile, this change to Windows after 15 years is garnering plenty of attention, as users globally are alerted to the new checks now baked into their Windows OS. Much of this highlights the importance in ensuring that update lands.

As Dark Reading explains, "Secure Boot checks that only properly signed and approved firmware, such as OS loaders, device drivers, and boot servers, is loaded at startup. Because it acts as the hardware-based root of trust for the computer, Microsoft refers to it as the Windows OS’s 'foundational trust anchor.’"

There’s no data on the numbers of new versus old certificates, but PCs “originally shipped with the 2011 Microsoft Secure Boot certificates, while newer ones manufactured in the last two years have the updated 2023 certificates. Older systems configured for automatic patching — typically those personally owned or used by small businesses — are likely using the updated 2023 certificates.”

And per ZDNet, “Secure Boot is an important security feature as it thwarts bootkit malware as soon as you turn on your PC, something that Windows-based security software can't handle. That's why you should make sure you're using the latest Secure Boot certificates. Come June, the older ones will expire, which means Secure Boot will no longer be able to properly protect you.”

The other Windows update change “starting in April” is more controversial than Secure Boot certificate upgrades and status checks. Per Windows Latest, “the April Patch Tuesday update for Windows 11 automatically launches Microsoft Edge on some PCs after the first restart following installation.”

As I reported earlier in the month, this change had been seen in beta and was already raising concerns. Now it seems to be here — at least for some. “The worst part, apart from Edge auto-opening after the update, is that there is no close button. Of course, you can close Edge or open a new tab. But that’s not the point here. The average person would think to click the blue button.”

ForbesDo Not Lose Your Phone—WhatsApp Warning For iPhone And Android UsersBy Zak Doffman

While this was still in beta, Microsoft told me "we’re currently running a limited experiment with a small set of Microsoft Edge Beta users that launches Edge automatically when a PC starts. This test is designed to help us better understand how people want to access the web, informed by research showing that many users open Edge shortly after starting their device. We always provide the option to opt out, and will take all feedback to iterate on the experience.”

Let’s see what happens next. This is just the latest in a long line of Microsoft campaigns to promote Edge at the expense of Chrome. Some specifically target Google’s browser, others just push Edge to the front of the queue. Regardless, Microsoft’s browser has not yet captured any meaningful market share.

“Usually, if an OS gets a bunch of new features after an update,” Windows Latest says, “or if it wants to confirm to the user that an update has successfully installed, it will show them in a banner, not in the browser. Here, Microsoft just coded the functionality to open this URL in Edge after a PC restarts.”