Windows Configuration System (WinCS) APIs for Secure Boot

Secure Boot CLI using Windows Configuration System (WinCS)

Goal: Domain administrators can alternatively use the Windows Configuration System (WinCS) released with Windows OS updates to deploy the Secure Boot updates across domain-joined Windows clients and servers. It consists of a command-line interface (CLI) utility to query and apply Secure Boot configurations locally to a machine.  

WinCS works off a configuration key that can be used with the command-line utility to modify the Secure Boot configuration state on the machine. Once applied, the next scheduled Secure Boot will perform actions according to the key. 

WinCS supported platforms

The WinCS command-line utility is supported in Windows 11, version 23H2, Windows 11, version 24H2, Windows 11, version 25H2. This utility is available in the Windows updates released on and after October 28, 2025, for Windows 11, version 24H2 and Windows 11, version 23H2.

Note: We are working on bringing this WinCS support to Windows 10 platforms. We will update this article as soon as the support is enabled. 

Here’s the Secure Boot configuration feature key that domain admins will query and apply to devices through WinCS. 

WinCS key value: 

• F33E0C8E002 – Secure Boot configuration state = Enabled

How to query Secure Boot configuration 

Secure Boot configuration can be queried with the following command line:

This will return the following information (on a clean machine): 

Notice the current configuration on a device is F33E0C8E001, which means the Secure Boot key is in Disabled state.  

How to apply Secure Boot configuration  

The specific configuration to enable Secure Boot certificates can be configured in the following fashion: 

A successful application of the key should return the following information: 

How to audit Secure Boot configuration  

To determine the state of the Secure Boot configuration later, you can re-use the initial query command: 

The information returned will be similar to the following, depending on the state of the flag: 

Notice that the state of the key is now Enabled, and the current configuration is F33E0C8E002. 

You can also manually trigger the Secure Boot servicing task by following below steps: 

1. Open a PowerShell prompt as an administrator and then run the following command:

   Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"​

2. Restart the device two times after running the command to confirm that the device is starting with the updated database of trusted signatures (DB).

3. To verify that the Secure Boot DB update was successful, open a PowerShell prompt as an administrator and then run the following command: 

   [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

   

   If the command returns True, the update was successful.
   
   ​​​​​​​In the case of errors while applying the DB update, see the article KB5016061: Addressing vulnerable and revoked Boot Managers.