Windows 10’s latest patch keeps your Secure Boot certificates on track
Earlier this week, Microsoft released KB5120249, a critical security update for Windows 10 versions 22H2 and 21H2, as well as Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021.
This is the next entry in Windows 10’s Extended Security Updates program, so don’t expect any new features. Rather, this patch includes fixes for various security vulnerabilities still present in Windows 10.
According to the release notes, this update includes the following improvements and bug fixes in addition to the security vulnerabilities that have been addressed:
[Backup] File History automatic backups to network shares using Server Message Block (SMB) might fail with an incorrect “invalid credentials” error. When this issue occurs, scheduled backups do not copy any files. This update resolves the issue.
[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
As you can see, this update also continues to address the ongoing issue of outdated Secure Boot certificates needing to be updated, which affects both Windows 11 and Windows 10 users.
Incidentally, as part of this patch, Microsoft is also updating Defender, the .NET Framework, and the Windows Malicious Software Removal Tool (Microsoft’s tool for removing malicious software on Windows).
How to get this important update
Update KB5120249 is installed automatically by Windows 10 once it’s available, and installation should only take a few minutes. Alternatively, you can download the update manually via the Microsoft Update Catalog. The total download size is just under 1 GB.
But your PC will only receive KB5120249 if it’s enrolled in the Extended Security Updates (ESU) program, which ensures that your Windows 10 PC will continue to get security updates until at least October 2027. Without ESU enrollment, Windows 10 PCs lost security update support back in October 2025—so you should enroll in the ESU if you still haven’t.
