en-US

Automatic Certificate Deployment via Updates

Supported on: At least Windows Server 2012, Windows 8 or Windows RT

Registry

HKLM SYSTEM\CurrentControlSet\Control\SecureBoot

Value name: HighConfidenceOptOut

Enabled: HighConfidenceOptOut = 1

Disabled: HighConfidenceOptOut = 0

Description

For devices where test results are available that indicate that the device can process the certificate updates successfully, the updates will be initiated automatically as part of the servicing updates. This policy is enabled by default. For enterprises that desire managing automatic update, use this policy to explicitly enable or disable the feature. For more information, see: https://aka.ms/GetSecureBoot