Windows 10 KB5094127 Rotates Secure Boot Certificates for ESU

Windows 10 KB5094127, the June 9, 2026 ESU cumulative, moved enrolled PCs to build 19045.7417 and widened automatic Secure Boot certificate targeting. It also improved File Explorer search for Chinese text and UTF-8 files that lack a byte order mark.

Two of the 2011 certificate authorities then expired later that month. A third still expires on October 19, 2026.

KB5094127 Is an ESU-Only June Patch

The June 9 cumulative security update applies to Windows 10 ESU, Windows 10 Enterprise LTSC 2021, and Windows 10 IoT Enterprise LTSC 2021, and it will not appear on PCs that never enrolled in ESU. 22H2 machines land on 19045.7417. LTSC 2021 machines land on 19044.7417.

Microsoft ended free Windows 10 22H2 support on October 14, 2025. Version 21H2 already ended on June 13, 2023. Enterprise LTSC 2021 keeps going until January 12, 2027, and IoT Enterprise LTSC 2021 until January 13, 2032. For personal 22H2 PCs, Microsoft’s end-of-support page says the consumer ESU program can protect a device through October 12, 2027, and one ESU license can cover up to 10 devices tied to the same Microsoft account.

Microsoft’s consumer ESU page still says the program does not include feature improvements or extra product work. The June notes nevertheless list File Explorer search changes, a Secure Boot status view, a new Group Policy, and a desktop.ini hardening pass. That mix is what the package actually is: a security rollup that also ships a few quality items on an OS Microsoft already retired.

The servicing stack that travels with this rollup is KB5094145, version 19041.7402. PCs already on a recent cumulative only pull the new bits. Devices that somehow missed the May 11, 2021 LCU (KB5003173) still need the special August 10, 2021 SSU (KB5005260) before this package if they install from WSUS or a standalone file. 22H2 enablement, if you still need it, is KB5015684.

JUNE 2026 ESU SNAPSHOT

• Release date: June 9, 2026, as the monthly security cumulative for enrolled Windows 10 PCs.
• Builds: 19045.7417 on 22H2 ESU, 19044.7417 on Enterprise LTSC 2021 and IoT Enterprise LTSC 2021.
• Prior package inside: May 12, 2026 KB5087544 (builds 19045.7291 and 19044.7291).
• Security scope: Microsoft’s Security Update Guide lists 220 Microsoft CVEs in June across the company’s products, and this Windows 10 package is the ESU vehicle for the Windows fixes.

Windows Update remains the clean path: Settings, Update and Security, Windows Update. If that stall, Microsoft posted standalone packages in the Update Catalog as.msu files for x64 and ARM64.

June 24 and the Certificates That Already Expired

Secure Boot is the UEFI check that only trusted boot software runs before Windows starts. Microsoft is replacing the certificates originally issued in 2011 with a 2023 set stored in the Key Enrollment Key (KEK) and the Allowed Signature Database (DB).

KB5094127 is not the first monthly package to touch this work. What the June notes add is extra high-confidence device targeting data, so more PCs become eligible to take the new certificates automatically, and only after those PCs show enough successful update signals. That is a phased rollout, not a single flip.

The March claim that Windows 10 would be locked out of the 2023 certificates did not hold on the ESU channel. This package is one of the vehicles that widened automatic targeting, and Microsoft’s IT playbook also lets LTSC admins apply the same CAs by hand.

THE 2011 CERTIFICATES AND THEIR 2023 REPLACEMENTS

June 9 sat 15 days before the KEK CA expired and 18 days before the UEFI CA expired. Those two dates have already passed. The Production PCA that signs the Windows boot loader still has its October 19, 2026 date ahead.

Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.

Microsoft, Windows Secure Boot certificate expiration support article

Everyday apps, networking, and browsing keep working. What drops off is the ability to take new boot-manager signatures, DBX revocations, and boot-chain fixes. BitLocker hardening that depends on an updated trust list can stall with them.

What the Green, Yellow, and Red Badges Mean

Open Windows Security, go to Device security, and scroll to Secure Boot. Microsoft started that extra status view for Windows 10 with the April 14, 2026 cumulative. The June notes still list dynamic status reporting, and they add the wider targeting data on top of it.

A green check by itself is not enough. Microsoft says you also need the sentence that the required certificate updates have been applied and that no further certificate changes are needed.

WINDOWS SECURITY BADGE STATES

• Fully updated: The device has the required certificate updates and the updated Boot Manager, the badge is a green check, and no action is needed.
• Not yet updated: The device is still on an older certificate; Windows Update is supposed to finish the job, and from May 2026 a yellow caution can appear when hardware or firmware is blocking it.
• Requires action: A boot-security update exists that this boot setup cannot take, the badge turns into a red stop icon, and Microsoft said this state could appear as early as June 2026 once some 2011 certificates began to expire.

Other messages can show up that are not about certificates at all, including Secure Boot turned off. On managed PCs, Event ID 1801 or 1795 in the System log, or a UEFICA2023Status registry value that is not set to Updated, is the inventory signal Microsoft tells admins to watch.

Microsoft’s own guidance on how to update to 2023 Secure Boot certificates still tells admins to patch OEM firmware first, then pilot across brands, firmware versions, and BitLocker PCs before a broad push. Intune, registry keys, Group Policy, and Windows Configuration Service Provider are the supported admin paths.

Chinese Text, UTF-8 Files, and a Harder desktop.ini

Microsoft’s File Explorer line is specific. Search gains support for Chinese text and for UTF-8 files that have no byte order mark. Text now displays more clearly and consistently across search results, Content view, and tooltips. That is the whole published description. There is no millisecond figure and no claim about English-only machines.

The same File Explorer search and Secure Boot notes still cover the first install path through Windows Update if the package is sitting uninstalled. This rollup is also where Microsoft documented a security hardening change in how Windows reads desktop.ini files. Custom folder icons or localized folder names for content from downloaded or remote locations can go missing. Access to those folders is not affected.

Admins who want less Secure Boot telemetry get a new policy, LimitSecureBootRequiredServiceData, under Computer Configuration, Administrative Templates, Windows Components, Secure Boot. When it is on, Windows suppresses the event it normally sends to Microsoft. The same setting ships in the Windows Restricted Traffic Limited Functionality Baseline.

Why Some PCs Ask for a BitLocker Key Once

Microsoft’s long-running BitLocker recovery issue is still on the June page, and it is not a home-PC lottery. The recovery screen on first reboot after the update shows up only when every one of five conditions is true, a mix Microsoft says is unlikely on personal devices that no IT department manages.

FIVE CONDITIONS FOR THE BITLOCKER PROMPT

• BitLocker on: BitLocker is enabled on the OS drive.
• PCR7 in policy: The Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” is set, and PCR7 is in that profile, or the matching registry key was set by hand.
• PCR7 binding: System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as Not Possible.
• 2023 CA present: The Windows UEFI CA 2023 certificate is already in the device’s Secure Boot DB, so the PC is eligible to make the 2023-signed Windows Boot Manager the default.
• Old boot manager: The device is not already running that 2023-signed Windows Boot Manager.

If those five line up, the recovery key is needed once. Later restarts stay quiet if the Group Policy is left alone. Microsoft told enterprises to audit PCR7 inclusion and check msinfo32 before they push the update.

On September 8, 2026 Microsoft updated this known-issue write-up. The current notes say the issue is addressed in KB5122878. After that patch, PCs with the incompatible policy are blocked from installing the 2023-signed Boot Manager. Event ID 1032 then appears: “The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.” Microsoft’s recommended fix is to set that BitLocker policy back to Not Configured, run gpupdate /force, then suspend and resume BitLocker protectors on C: so bindings return to the Windows default PCR profile.

Firmware Gaps Still Block the New Certificates

Microsoft’s June 29, 2026 “prevented from updating” article is the other half of the yellow badge. Most PCs take the full certificate set through Windows Update. Some need a firmware update from the PC maker before the new CAs will stick. Microsoft says many OEMs are shipping those firmware updates through their usual channels, and that some models will never get them if the maker has left that hardware behind.

Two messages matter. One says devices in a group are on a known issue, so certificate updates are paused while Microsoft and partners work on a supported fix, and you should contact the device maker. The other says Secure Boot is on but the PC cannot take the automated certificate update because of hardware or firmware limits. That second text is the out-of-support hardware case.

Learn’s higher-risk list for estates that skip firmware work is blunt: Secure Boot validation errors, BitLocker recovery prompts including loops, startup hangs, and devices that fail to boot. The June targeting data does not override a firmware block. It only enlarges the set of PCs Microsoft is willing to try automatically once the box looks healthy.

PCs that never joined ESU are in a different bucket. They do not see KB5094127 at all, so they also miss this wave of targeting data. They can still boot. They will not pick up new boot-chain protections through Windows Update.

October 19 Is the Next Boot-Loader Deadline

The June notes did not stay frozen. Microsoft kept editing the known-issue list through the summer, and three of the early bugs were later closed in the July 14, 2026 cumulative.

HOW THE JUNE NOTES CHANGED AFTER SHIP

1. June 16, 2026: Adds a known issue in which some third-party apps that use OLE automation cannot open Word, Excel, PowerPoint, Access, or other Office apps, with reports naming CCH Engagement, Workpaper Manager, Dentrix, Softdent, and Zotero.
2. June 18, 2026: Adds a Recycle Bin bug where the permanent-delete confirm dialog shows an internal name such as $Rxxxxx.ext, while the bin itself still shows the original name.
3. June 23, 2026: Adds a OneDrive shortcut failure in File Explorer when Explorer is running as Administrator, with a dead shortcut, blank properties, and missing sync icons.
4. July 14, 2026: KB5099539 (builds 19045.7548 and 19044.7548) resolves the Office, Recycle Bin, and OneDrive issues.
5. August 17, 2026: Retracts a July 14 claim that the BitLocker recovery issue was already resolved and says a fix will come in a later update.
6. September 8, 2026: Updates the BitLocker write-up again and points at KB5122878 as the change that blocks the 2023 Boot Manager on the incompatible policy.

The Windows Production PCA 2011 certificate still expires on October 19, 2026. PCs that already show a Fully updated state have the 2023 boot-loader CA in the DB. PCs that still show yellow need an OEM firmware fix, or they will keep getting ordinary Windows patches while the boot chain stays on the old trust list.