In June 2026, the Microsoft UEFI CA 2011 certificate expired. This may cause Secure Boot configured devices to fail during the PXE boot process. This document contains steps to update supported PXE environments to support the new Windows UEFI CA 2023 certificate.


WARNING: Following these procedures may prevent older UEFI CA 2011 only Secure Boot devices from PXE booting.


Requirements

Microsoft Endpoint Configuration Manager (MECM/SCCM)

Follow these steps if you're using Microsoft Endpoint Configuration Manager with Imaging Toolkit.

  1. Check the required supported version of Windows ADK/WinPE is installed (uninstall and re-install if required)
  2. Upgrade to Imaging Toolkit 14.0.4
  3. Run the Integration Wizard to update the ENGL WinPE boot media
  4. In the MECM Console, navigate to Software Library > Operating Systems > Boot Images
  5. Right-click the target ENGL WinPE boot image and select Properties
  6. In the Data Source tab, locate the select the Use Windows Boot Loader signed with Windows UEFI CA 2023 checkbox, then click Apply and distribute the updated boot image to your Distribution Points
  7. Test PXE booting a Secure Boot device 

Windows Deployment Services (WDS)

Follow these steps if you're using ENGL Deployment or Liquit Workspace integration with Imaging Toolkit.

  1. Check the required supported version of Windows ADK/WinPE is installed (uninstall and re-install if required)
  2. Upgrade to Imaging Toolkit 14.0.4
  3. Run the Integration Wizard to update the ENGL WinPE boot media
  4. In the WDS Management Console, replace the WinPE boot media with the winpe.wim generated by Integration Wizard (we recommend using the description of the Imaging Toolkit version, i.e. ENGL WinPE 14.0.4)
  5. On the WDS server, open a command prompt and run "net share" to locate the REMINST share and it's file location, i.e. C:\RemoteInstalldir 
  6. Navigate to <REMINST>\Boot\x64\ then rename the following file:
    bootmgfw.efi > bootmgfw.efi.2011
    wdsmgfw.efi > wdsmgfw.efi.2011
  7. Navigate to %SystemRoot%\System32\RemInst\Boot_EX\ then copy the following files to <REMINST>\boot\x64
    bootmgfw_EX.efi
    wdsmgfw_EX.efi
  8. Rename the <REMINST>\boot\x64\*_EX.efi files as follows:
    bootmgfw_EX.efi > bootmgfw.efi
    wdsmgfw_EX.efi > wdsmgfw.efi
  9. Test PXE booting a Secure Boot device

ZENworks Configuration Management (ZCM)

Follow these steps if you're using ZENworks Configuration Management integration with Imaging Toolkit.

  1. Check the required supported version of Windows ADK/WinPE is installed (uninstall and re-install if required)
  2. Upgrade to Imaging Toolkit 14.0.4
  3. For ZCM 24.4 and 25.4, apply the ZENworks imaging secure boot update April 2026 FTF patches
    Note: ZCM 26.2 does not require additional patches for this procedure.
  4. Run the Integration Wizard to update the ENGL WinPE boot media
  5. Upload the Integration Wizard output to the ZCM TFTP folder
  6. Test PXE booting a Secure Boot device