Glossary
Secure Boot
A UEFI feature that only lets firmware load boot components signed by trusted keys, protecting the Windows boot path from bootkits.
Secure Boot is part of the UEFI specification. The firmware holds signature databases: db lists the certificates and hashes allowed to run, dbx lists revoked ones, and the Key Exchange Key (KEK) and Platform Key (PK) control who may update those databases. At startup, the firmware verifies each boot component, such as the Windows Boot Manager, against db and dbx and refuses to run anything unsigned or revoked. Windows then continues the chain of trust with its own code integrity checks, and Measured Boot records each step in the TPM so health attestation can verify it later.
Secure Boot blocks bootkits that would otherwise run before the operating system and its security tools. It is a prerequisite for Credential Guard and a foundation for HVCI, and BitLocker uses it for integrity validation of the boot chain. Its protection depends on dbx being current: the BlackLotus bootkit (CVE-2023-24932) abused a vulnerable but still trusted boot manager, and fixing it required revocation updates. Confirm it with Confirm-SecureBootUEFI and plan for the 2011 certificate expiry and replacement with the 2023 certificates.