Help Desk Blogger

Windows Security shows a green tick beside Secure Boot, yet every headline says a certificate ran out. Both can be true, and that gap is the whole problem. Microsoft's Windows Production PCA 2011 expired on 19 October 2026, and the secure boot certificate that replaces it may or may not be on your PC. You can find out in about a minute, in three places, checked in order.

How do I check if my PC has the Secure Boot certificate update?

Run three checks in order and stop at the first clear answer: the exact wording in Windows Security, Event 1808 or 1801 in Event Viewer, then one registry value read in PowerShell.

1. Windows Security. Open Device security, then Secure Boot, and read the sentence under the badge. On Microsoft's status page, "all required certificate updates have been applied" means no action, while "older boot trust configuration" means install updates and restart.
2. Event Viewer. In the System log, filter for source TPM-WMI. Event 1808, "This device has updated Secure Boot CA/keys," is the all-clear. Event 1801 means certificates updated but not yet applied to firmware, per Microsoft's events list.
3. PowerShell. In an administrator window, run Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object UEFICA2023Status, UEFICA2023Error. Microsoft's registry page treats Updated with an error of 0 as finished; NotStarted or InProgress means not yet.

That is the one-minute check to run on your own PC tonight, and step one alone is not enough. Malwarebytes wrote on 28 May 2026 that a green checkmark alone does not confirm the new certificates were applied. An asker on Microsoft's Q&A site wanted to know how to confirm the fix had worked, which says plenty about the signal, or maybe just how many people share the question.

Will my PC still boot now the 2011 certificates have expired?

Yes: Microsoft says devices without the 2023 certificates continue to start and operate normally, and ordinary Windows updates still install, so an expired date alone does not lock you out.

What stops is the early-boot side. Microsoft states that such a PC can no longer receive new Boot Manager updates, Secure Boot database and revocation-list updates, or fixes for newly found boot-level flaws. Our reading: maintenance, not emergency, but with no natural reminder, so it gets skipped. The fix arrives through Windows Update, so confirm your build with the Windows 11 24H2 winver check, and if updates keep failing, start with the September Windows 11 update problems.

Worked example: a Windows 11 PC with Secure Boot on has never logged Event 1808, and still holds its factory 2011 certificates. Today is 25 October 2026. The key-exchange certificate expired on 24 June 2026, so 24 June to 24 October is 30 + 31 + 31 + 30 = 122 days, plus one to reach today: 123 days. That PC has booted through 123 days of an expired certificate without failing, so expiry alone is not the risk; the missing 2023 certificates are.

Four numbers frame the urgency, and the retry schedule comes from Microsoft's troubleshooting guide.

The retry cadence makes patience a fair first move: a PC showing Event 1801 may simply be mid-way.

What does each result mean, and what should I do?

Find your row and read across: 1808 means finished, 1801 means restart and recheck, errors 1795 and 1796 point at the firmware, and 1032 means pause BitLocker first.

Only the error rows need a human: Microsoft says to contact the device maker for 1795, and 1032 sits with your BitLocker setup.

Does the Secure Boot update trigger BitLocker recovery?

It can: Microsoft logs Event 1032 when your BitLocker setup would trigger recovery mode if the update were applied, and its fix is to suspend BitLocker for two restarts, then turn it back on.

Microsoft also notes a device may ask for the recovery key once after the update; enter it and check for firmware updates. Windows Latest reported on 26 May 2026 that HP had acknowledged a BIOS update leaving some commercial PCs in a BitLocker recovery loop, with the 2023 certificates failing to install meanwhile. Our call: treat every firmware update on a BitLocker PC as a recovery-key moment, and store the key somewhere that is not that PC.

One poster on Microsoft's Q&A forum described a status stuck at InProgress with events 1796 and 1801 repeating, an update that keeps retrying and never lands.

• Secure Boot off. A PC in legacy BIOS or CSM mode, Malwarebytes reports, sits outside this update.
• Reset to defaults. Microsoft says avoid it unless the maker's defaults include the 2023 certificates.
• Dismissed warnings. Dismiss installs nothing, and Microsoft calls it not recommended.
• Windows 10. Microsoft's expiry page lists Windows 10 22H2, so run the same three checks; patch timing is in the Windows 10 ESU extension to October 2027.

The decision is whether to wait for Windows or step in yourself, and for most PCs it is wait. Tonight, run the three checks. At Event 1808, close the laptop. Otherwise install updates, restart, recheck tomorrow, and touch firmware only once your recovery key is saved off the PC.

The Wemo app spins, then tells you the plug is offline. Alexa says the device is not responding. You reboot the router and nothing changes. If your Wemo stopped working this year, stop troubleshooting the Wi-Fi and leave the reset button alone: the fault is almost certainly Belkin's, and one wrong press can make it permanent.

Why did my Wemo plug stop working?

Your Wemo plug stopped responding because Belkin ended Wemo cloud services and app support on 31 January 2026, which also cut remote access and the Alexa and Google Assistant integrations, so your router is not the problem.

That check saves an evening. A dead app or a "device not responding" reply from Alexa is the shutdown working as designed, and no router setting brings either back. The useful question is which Wemo you own: Belkin's end-of-support table sorts its listed models into three fates, and the label's model number tells you yours.

Does Wemo still work with Apple HomeKit?

Yes, if it was already set up: Belkin says HomeKit-configured devices "may continue to function locally via HomeKit", but after 31 January 2026 you can no longer set up a Wemo device with Apple HomeKit at all.

That second half is the trap. A factory reset wipes the pairing, and with setup gone, the plug can never rejoin your Home app. Generic smart-plug advice says reset first. For a Wemo in Apple Home it is the single worst thing you can do. My read, and it is opinion: "may continue" is not a promise. If a future iOS update breaks these plugs, nobody at Belkin will fix them. Treat a surviving HomeKit Wemo as borrowed time, not a reason to buy more.

Belkin is harsher than most. Microsoft at least sold a lifeline when Windows 10 ended, and you can still check whether your PC is covered by Windows 10's extended security updates; Wemo owners get none. The closer parallel is Britain's landline switch-off, which will leave some burglar alarms and telecare devices dead: hardware that works perfectly until the service behind it disappears.

Four numbers decide your next move. The model count is Belkin's; the applet figure comes from GearBrain's January 2026 report that existing Wemo applets stopped running; the other two are our own arithmetic, counted to publication day.

The cost of keeping a paired plug is the figure that should change behaviour. A Wemo in Apple Home needs no Belkin server or subscription to switch, so replacing it early gains nothing. The only thing that can turn it into e-waste is you, holding the reset button down for a few seconds.

Wemo stopped working: what to do with yours

What you do depends on one check, the model number on the plug's label and whether it already shows in the Apple Home app, and the table below turns that check into a single action per situation.

Read the label, then the Home app, and stop at the first row that fits.

The middle rows stack on top of the others: nothing in Belkin's refund wording mentions HomeKit status, so a paired plug still inside its warranty is worth a claim.

Can I get a refund for my Wemo device?

Yes, if the product was still under Belkin's warranty on or after 31 January 2026 and you have proof of purchase, you may qualify for a refund through the Wemo end-of-support form on Belkin's website.

Belkin's Wemo support page, read on 21 October 2026, says its warranties run 1, 2 or 3 years depending on the model. That gives you a one-minute check, and it is the one to remember: take the order date from your receipt or confirmation email, add your model's warranty term, and see whether the result lands on or after 31 January 2026. Worked backwards (our arithmetic, not Belkin's), that means a 3-year model bought from about 31 January 2023, a 2-year model from 31 January 2024, or a 1-year model from 31 January 2025.

Keep expectations modest. 9to5Google reported in July 2025 that the refund is partial, and that affected products were still on sale as recently as 2023, so a late buyer on a 3-year term is very likely covered. The open question is timing. Belkin states no claim deadline, which is not an invitation to wait; well, technically it is, but nobody wants to be last in a queue a company is winding down. End-of-support notices tend to bury the useful part, much like the Office 2021 end of support pay-or-stay choice did for software.

• Resetting a HomeKit plug to "fix" it removes it from Apple Home for good.
• Works at home but not from work? That is the shutdown, not a fault.
• Delete dead Alexa and Google Assistant routines that name a Wemo.
• GearBrain recommends Matter plugs as replacements, so look for the Matter logo on the box, not a "works with Alexa" sticker.

So the decision is simple: keep what still switches, claim what you're owed, replace the rest. This week, turn every Wemo over, write down the model number from its label, open the Home app, and match each plug to its row before anyone touches a reset button.

Your USB headset or DAC went silent after an update, and Device Manager says “This device cannot start (Code 10)”. That is USB audio Code 10, and October's patch did not remove it. Start with what costs nothing: unplug the device and use a different USB port. Then, in Device Manager, right-click it, choose Disable device, and enable it again. If sound returns, you are done. If not, the order below stops you wasting an evening on the wrong fix.

Does KB5127648 fix USB audio Code 10?

No, KB5127648 does not fix it: Microsoft still lists the USB Audio Class 1.0 fault as mitigated, not fixed, and the October notes repair other things, such as Dolby Digital crashes in older games.

Microsoft's support page says KB5127648 arrived on 13 October 2026 for 24H2, 25H2 and 26H2, with builds ending in 9711. Press Windows+R, type winver and read your build: if it ends in 9711 or later, you already have the patch, so “install the latest update” is not step one.

On 24H2 Home or Pro, October was the version's last update, so nothing later is coming. Our guide to the 24H2 end of support and the one-restart move covers the way out.

According to Techdows, reading Microsoft's known-issues list on 14 October, some USB Audio Class 1.0 devices fail to start or play no sound, and Device Manager reports Code 10. It began with the 8 September update (KB5124008), per GridinSoft's 15 September report. Our rundown of the four faults in that September update covers the others.

The September emergency patch does not help either. KB5129195 (14 September, builds 26100.9457 and 26200.9457) repairs only eight-channel and 3D audio failures on class 1.0 devices that still work in stereo, Redmond Magazine reported on 16 September. So two faults share one complaint, and the cures differ: surround dead but stereo fine, or the device will not start at all.

October's notes do mention audio, which is where people get misled. KB5127648 fixes AC-3 (Dolby Digital) decode crashes in older apps and games, game mouse stutter, Hello fingerprint sign-in after a cold boot and Always On VPN, per Techdows and Windows Report on 14 October. None of that is Code 10. Four numbers decide whether waiting is worth it: how long the fault has been open, what the first fix costs, how many October repairs touch it, and how many patches have cured it.

The cost cell is the one to act on: free checks should always run before the ones that remove security patches. Here is where I part company with the usual advice: “just install the latest update” is outdated for this fault, because the latest update is the one that skips it. And Microsoft's “mitigated” is, I think, a fix of sorts, or rather a workaround with a kinder label, when your DAC is silent.

How do I fix “This device cannot start (Code 10)”?

Work through the checks in order: swap the port and toggle the device, confirm your build, switch to stereo if only surround is dead, and uninstall only after those fail.

A hwbusters headline reports that Microsoft's only advice for the surround variant is to drop to stereo.

Stop at the first row that brings sound back. If the toggle fails, the generic next step is Roll Back Driver on the Driver tab in the device's Properties. That is standard troubleshooting, not a Microsoft-confirmed cure, so treat it as a free experiment.

Should I uninstall the update to get sound back?

Only as a last resort: October's update is cumulative, so removing it may not undo a fault that began in September, and it takes the latest security fixes off your PC with it.

The route, if you must: Settings, Windows Update, Update history, Uninstall updates (Techdows, 14 October). Pausing updates is milder, and Windows allows up to 35 days. Do the sum, though: the fault began on 8 September, so a pause started today ends on 20 November, 73 days in, with no fix date from Microsoft. That is my arithmetic, not a Microsoft figure, and it says waiting out the fault is not a plan.

Whether removing October's update would bring your device back is unknowable from the public notes, and my view is not to trade security patches for a coin toss before the free checks fail.

• Do not apply a Remote Desktop mitigation to an audio fault: the 0xC000000D sign-in error after KB5124010 is a separate issue, and its mitigation switches Administrator protection off.
• Do not read an expiry notice as the cause. Office 2021 support also ended on 13 October, which has nothing to do with sound.
• Do not stack fixes: change one thing, test the sound, then the next.

The decision: keep the update and work around the fault, or remove it. Keep it. This week, replug the device in another port, toggle it in Device Manager, set a stereo format if only surround is dead, and run winver so you know your build when a real fix lands.