Secure Boot Rollout Scripts added in May 2026 Security Update

If you've patched a Windows 11 device with KB5089549 (the May 12, 2026 cumulative update) and looked in the root of C:\Windows lately, you've probably noticed something new: a SecureBoot folder containing an ExampleRolloutScripts subfolder with seven PowerShell scripts inside.

You might even recognize these scripts because they were previously available as individual articles, where you had to manually copy and paste them yourself…

So, what are these scripts for? Well, I’m happy that you asked 🙂

The Scripts

The seven Secure Boot scripts are part of Microsoft’s Sample Secure Boot E2E Automation Guide, which provides an example framework for automating Secure Boot certificate updates across domain-joined Windows devices using PowerShell, Group Policy, and staged deployment waves. The guide includes example scripts, rollout orchestration, monitoring and logging guidance, plus reporting samples.

Note: Some of the PowerShell examples in the automation guide need some love to run correctly, and the overall solution feels like a quite early release (pre-alpha).

The Solution

The solution works in two halves: Phase 1 pushes a detection script via GPO so each device drops a JSON status file onto a central share, which an aggregation script rolls up into a fleet-wide report. Phase 2 takes that report and feeds it into an orchestrator that progressively deploys the certificate-update GPO in doubling waves (1, 2, 4, 8 devices and onwards), so a firmware failure on the first ring stops the rollout before it spreads.

The scripts fall into three groups:

Phase 1: Detection and reporting

• Detect-SecureBootCertUpdateStatus.ps1. Runs on each endpoint. Collects Secure Boot enablement state, the registry values that track certificate update progress, OEM details, and event log entries about certificate update errors. Outputs a JSON blob that can be saved to a network share or returned to a remediation engine like Intune.

• Aggregate-SecureBootData.ps1. Runs on a management server or workstation. Walks a folder full of JSON blobs from the detection script and produces aggregated reports containing certificate status, devices needing remediation, OEM/firmware breakdowns, and an HTML dashboard.

• Get-SecureBootRolloutStatus.ps1. The interactive companion to Aggregate. Runs on any workstation against an existing report folder and shows you a current snapshot with total devices, wave progress, completion percentage, errors. Simply pass the -OpenDashboard parameter to launch the HTML report in a browser.
• Deploy-GPO-SecureBootCollection.ps1. Automates the GPO plumbing for Phase 1. Run it from a domain controller, and it creates the Group Policy Object, the scheduled task that runs the detection script on a cadence, and the OU linkage.

Phase 2: Certificate update orchestration

• Start-SecureBootRolloutOrchestrator.ps1. Handles the Phase 2 rollout. Determines which devices are ready, creates the required GPOs and AD groups, and deploys the certificate update in controlled rollout waves.
• Deploy-OrchestratorTask.ps1. Installs the orchestrator as a Windows scheduled task so you don't have to leave a PowerShell window open on a jump box for three weeks. Sets up logging, retry behavior, and the run-as account.

Phase 3: Remediation

• Enable-SecureBootUpdateTask.ps1. Enables the native Secure Boot Update scheduled task (or fix it if modified/deleted).

Other Secure Boot Files

And while you're at it, you might want to take a look at the Secure Boot files in the C:\Windows\System32\SecureBootUpdates folder too. Thanks, Ariën de Groot for pointing that out!