Known issues and resolutions for Secure Boot certificates updates

Secure Boot certificate updates might log Event ID 1795 on Azure Trusted Launch virtual machines

Symptoms

On some Azure Trusted Launch (Gen2) virtual machines, Secure Boot certificate updates might not complete when attempting to update the Key Exchange Key (KEK).

In these cases, the following may be observed:

• Event ID 1795 is logged in the System event log.

• Error messages indicating that the system firmware returned an error while attempting to update a Secure Boot variable.

• The KEK update remains in progress or does not complete.

Cause
This issue affects certain long‑running Azure virtual machines where Secure Boot variables are maintained by the platform firmware.

In these environments, updates to Secure Boot variables such as KEK depend on coordination between the guest operating system and the Azure host platform. Under specific conditions, this coordination can prevent the KEK update from completing successfully.

Status
At this time, there is no required customer action. A resolution that addresses this issue will be delivered through future updates.

Microsoft Intune Error Code 65000 on Pro editions of Windows 

Symptoms

Secure Boot configuration settings deployed through Microsoft Intune Mobile Device Management (MDM) are currently blocked on Pro editions of Windows 10 and Windows 11.

• Attempts to apply these policies result in Microsoft Intune Error Code 65000.

• Event logs might record POLICYMANAGER_E_AREAPOLICY_NOTAPPLICABLEINEDITION, indicating the feature is unavailable on this edition.

Resolution

The Microsoft Intune licensing service was updated on January 27, 2026, to allow Secure Boot configuration settings deployment on Pro editions of Windows 10 and Windows 11.

Devices that received their Microsoft Intune license before this date will need to renew their license to resolve this issue.  Licenses are automatically renewed every month, so this issue will be resolved for devices by February 27, 2026 (excluding some Windows 11, version 23H2 devices, as noted above). To renew the license on your device manually, run the following commands on the user's behalf (under the user's context):

• ClipDLS.exe removesubscription

• ClipRenew.exe

back to top 

Secure Boot certificate updates might fail with Event ID 1795 on Hyper‑V virtual machines

Symptom

On some Hyper‑V virtual machines, Secure Boot certificate updates might fail when updating the Key Exchange Key (KEK). In these cases, the update does not complete and an error such as “The system firmware returned an error: The media is write protected” might be logged (Event ID 1795). 

Resolution

This issue is addressed in Windows updates released on and after March 10, 2026, except for Windows Server 2025, which is addressed in Windows updates released on and after April 14, 2026.

back to top  

Change Log

back to top