Secure Boot Updates not completing on Parallels VMs

[PaulWoodward]

I'm an IT Pro. We are pushing out the 2023 Secure Boot updates to all our physical devices, a process that must complete in June 2026, and I need to do the same for my Parallels VMs. While some of the updates are being delivered, the KEK update is failing to land.

PS C:\WINDOWS\system32> Get-UEFICertificate | select subject
Subject
-------
CN=Parallels UEFI Platform Key 2016, O=Parallels Holdings Ltd, C=US
CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US

We're missing CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US
When this works properly the last reported Event ID is 1808
Here is the output from the Microsoft "Detect-SecureBootCertUpdateStatus" script:

{"UEFICA2023Status":"InProgress","UEFICA2023Error":2147942402,"UEFICA2023ErrorEvent":1803,"AvailableUpdates":"0x4004","AvailableUpdatesPolicy":null,"Hostname":"W11-PVM9ADMARM1","CollectionTime":"2026-03-18T15:52:07.8520153+00:00","SecureBootEnabled":true,"HighConfidenceOptOut":null,"MicrosoftUpdateManagedOptIn":null,"OEMManufacturerName":"Parallels International GmbH.","OEMModelSystemFamily":"Parallels VM","OEMModelNumber":"Parallels ARM Virtual Machine","FirmwareVersion":"26.2.2 (57373)","FirmwareReleaseDate":"Fri, 30 Jan 2026 16:40:30","OSArchitecture":"ARM64","CanAttemptUpdateAfter":"2026-03-03T07:38:56.9440000Z","LatestEventId":1803,"BucketId":"4cbfbb8b5b825969859374b1f5dc1d6245853d7fe592cac4325034967f3cc6fe","Confidence":"Under Observation - More Data Needed.","SkipReasonKnownIssue":null,"Event1801Count":19,"Event1808Count":0,"Event1795Count":0,"Event1795ErrorCode":null,"Event1796Count":0,"Event1796ErrorCode":null,"Event1800Count":0,"RebootPending":false,"Event1802Count":0,"KnownIssueId":null,"Event1803Count":11,"MissingKEK":true,"OSVersion":"10.0.26200","LastBootTime":"2026-03-18T15:38:05.4589810+00:00","BaseBoardManufacturer":"Parallels ARM Virtual Machine","BaseBoardProduct":"Parallels ARM Virtual Platform","SecureBootTaskEnabled":true,"SecureBootTaskStatus":"Ready","WinCSKeyApplied":true,"WinCSKeyStatus":"Applied"}
​

The 1803 event says the following:

A PK-signed Key Exchange Key (KEK) cannot be found for this device. Check with the device manufacturer for proper key provisioning.
This device signature information is included here.

DeviceAttributes: BaseBoardManufacturerarallels ARM Virtual Machine;FirmwareManufacturerarallels International GmbH.;FirmwareVersion:26.2.2 (57373);OEMModelNumberarallels ARM Virtual Machine;OEMModelBaseBoardarallels ARM Virtual Platform;OEMModelSystemFamilyarallels VM;OEMManufacturerNamearallels International GmbH.;OEMModelSKUarallels_ARM_VM;OSArchitecture:arm64;

BucketId: 4cbfbb8b5b825969859374b1f5dc1d6245853d7fe592cac4325034967f3cc6fe
BucketConfidenceLevel: Under Observation - More Data Needed.
For more information, please see https://go.microsoft.com/fwlink/?linkid=2339472​

 

[RonaldK3]

After running this PowerShell command: ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023') I received a TRUE result as a certificate update confirmation.

 

[RonaldK3]

I assumed I would get a new Secure Boot status message stating "all required certificates have been applied" (or seeing a green badge) means your certificates are fully updated" although the status message is still "Secure boot is on but your device is using an older boot trust configuration that should be updated. There is not enough data to classify your device for automatic update"

 

[PaulWoodward]

The latest Windows update creates some diagnostic scripts in this folder. Use them to see the details.
C:\WINDOWS\SecureBoot\ExampleRolloutScripts
Detect-SecureBootCertUpdateStatus.ps1 will show a summary. You need the KEK to be updated, which in turn requires a PK from Parallels. This was the main issue up until now. If that is fixed, everything else can proceed. It sounds like your machine got the Windows UEFI CA 2023, but it will not trust it until the PK and 2023 KEK also land. Once that is sorted, it should be able to proceed to using the 2023 signed bootloader - it will not do that step until the trust is established. It may need to run a scheduled task and be restarted again to complete all the steps and give you a green tick.

 

[RonaldK3]

PaulWoodward,
Your explanation helped me understand the complete update process. Thank You for taking the time to explain.

 

[PaulWoodward]

you're welcome, that's what the community is all about!

 

[jsblau]

I am running Parallels version 26.3.3 (57507) and Windows 11 Pro 25H2. I got the same message in the Device Security panel: "Secure boot is on but your device is using an older boot trust configuration that should be updated." Today I applied the latest Windows update, KB5094126, which updated my OS build to 26200.8655. After the reboot the message in Device Security didn't change immediately. But I waited a while, and now the message has changed to "Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed." It appears that Windows has finally applied whatever updates are required to the boot manager, and combined with the updated certificates the issue appears to be resolved, at least for me.