Automatic Certificate Deployment via Updates
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Registry
HKLM
SYSTEM\CurrentControlSet\Control\SecureBoot Value name: HighConfidenceOptOut
Enabled: HighConfidenceOptOut = 1
Disabled: HighConfidenceOptOut = 0
Description
For devices where test results are available that indicate that the device can process the certificate updates successfully, the updates will be initiated automatically as part of the servicing updates. This policy is enabled by default. For enterprises that desire managing automatic update, use this policy to explicitly enable or disable the feature. For more information, see: https://aka.ms/GetSecureBoot