Microsoft is rolling out new status indicators in the Windows Security app this month to help businesses track whether their devices have received updated Secure Boot certificates before the originals expire in June 2026. The 2011-era certificates that underpin Secure Boot on most Windows machines start expiring from late June, and devices that haven’t received the replacement 2023 certificates will lose the ability to receive future boot-level security updates, as reported by Help Net Security. Status indicators land on Windows 11 from April 8 and Windows 10 from April 14.

Hospitality businesses should pay particular attention here. Hotels, pubs, restaurants, and venues typically run dozens of Windows devices — POS terminals, back-office PCs, self-service kiosks, and booking system workstations — that often don’t get the same update attention as staff laptops. A POS terminal stuck on old Secure Boot certificates won’t stop working overnight, but it enters what Microsoft calls a “degraded security state” where it can’t receive new boot-level protections. For venues handling payment card data and guest personal information, that’s a compliance risk that compounds over time. The new Privacy Act obligations hitting small businesses from July 1 make this doubly relevant — running devices in a known degraded security state is hard to defend if something goes wrong.

The good news: if your devices are receiving regular Windows Updates, the new certificates should install automatically. The risk sits with machines that have fallen behind on updates, are running older BIOS firmware, or are managed outside your normal patching cycle. Now is a good time to audit every Windows device in your venue — including the ones tucked behind the bar or in the back office — and confirm they’re current on updates.

If you’re not sure where your devices stand, All IT’s hospitality IT team can run a fleet-wide check and make sure nothing gets missed before the June deadline.