This is for anyone with a Windows laptop or desktop who has seen the Secure Boot news and simply wants to know what to do this week. You do not need to understand certificates. Set aside about twenty minutes, work through five short steps, and your machine will be ready for the 19 October date with your files safe. No tools to download and nothing to open inside the laptop.
What should I do this week before 19 October?
Short answer: Do five things. Run Windows Update and restart. Plug the charger in for every update. Save your BitLocker recovery key somewhere other than the laptop. Copy your important files to a second place. Then leave Secure Boot and the BIOS settings exactly as they are. Nothing else is normally needed.
Why is there a date at all?
Secure Boot (a start-up safety check that lets only trusted software load before Windows) uses digital certificates, which are like ID cards with an expiry date. Microsoft is replacing its original 2011 certificates with newer 2023 ones. Two of the old ones expired on 24 June and 27 June 2026. A third, Windows Production PCA 2011, expires on 19 October 2026. Microsoft explains the rollout on its Secure Boot certificate support page.
What happens on a PC that has not received the new certificates by then depends on the PC, so please read Microsoft's page or ask your laptop maker instead of guessing. This checklist keeps you in the best position either way.
The five-step week-before checklist
Step 1: Run Windows Update
Open Settings, then Windows Update, and choose Check for updates. Install whatever is offered and restart when asked. The new certificates are delivered through this route on PCs with Microsoft-managed updates, so an up-to-date machine is the simplest preparation.
Step 2: Keep the charger connected
Keep the charger plugged in from the start of an update until the laptop has fully restarted. For a desktop, a small UPS (a battery backup that keeps the PC running through a power cut) is a sensible habit.
Step 3: Note down your BitLocker recovery key
BitLocker (Windows' built-in drive lock) asks for a 48-digit recovery key if it senses a change at start-up. Microsoft lists this prompt as a known case on some PCs after the replacement certificates arrive. Save the key away from the laptop before the update reaches you.
- If you sign in with a Microsoft account, sign in on your phone and look for the key in your account.
- You can also look under Settings, Privacy and security, Device encryption. The wording can differ slightly between versions.
- Write the key on paper and keep it in a drawer, not in the laptop bag.
Not sure whether your laptop uses BitLocker at all? Not every laptop uses it. If the Device encryption page is missing, there may be nothing to save, and that is fine.
Step 4: Copy your important files
Copy documents, photos and accounts files to an external drive or a cloud folder. Our guide on cloud versus external drive backup helps you choose. Then open one copied file to confirm it works.
Step 5: Leave the settings alone
Do not switch Secure Boot off to make a warning go away. It removes a protection, and changing it can itself bring up the BitLocker recovery screen. Do not download tools from messages or videos that promise a certificate fix.
What can I skip?
- You do not need to buy anything or replace a working laptop because of this date.
- You do not need to open the laptop or reset the BIOS (the small program that starts the laptop before Windows loads).
- You do not need to check every setting. If you want to see your Secure Boot status, press the Windows key and R, type msinfo32 and read the Secure Boot State line. It only reads information.
Power cuts and start-up updates
Voltage dips and sudden power cuts are the practical danger during start-up-level updates. A cut halfway through can leave a laptop that will not start, so choose a time when the power is steady, not the middle of a storm or a known load-shedding hour. Large updates also fail on patchy broadband, so avoid weak mobile hotspots. If you travel with a laptop, do the checklist at home on your own connection before you leave. Laptops can reach us by courier from anywhere in India.
When to get help
Stop and ask a technician if you see any of these.
- A BitLocker recovery screen appears and you do not have the key.
- The laptop keeps restarting after an update and never reaches Windows.
- An update was interrupted by a power cut.
- Windows Update shows the same error again and again.
Please do not try random fixes first. Our BIOS repair and update service covers these cases, and in Hyderabad our doorstep service can come to you. The visit fee is ₹149 doorstep visit fee, waived when you approve laptop repair with us. If you would like someone to keep an eye on updates and backups all year, our annual care plan is an option, never a requirement.
A note from the LRW Engineer Team
Treat this week like locking the house before a trip. Do the small, boring steps, then walk away. Changing settings at the last minute adds risk without adding protection. A saved key and a copied folder turn a scary screen into a ten-minute inconvenience.