Help Desk Blogger

Windows Security shows a green tick beside Secure Boot, yet every headline says a certificate ran out. Both can be true, and that gap is the whole problem. Microsoft's Windows Production PCA 2011 expired on 19 October 2026, and the secure boot certificate that replaces it may or may not be on your PC. You can find out in about a minute, in three places, checked in order.

How do I check if my PC has the Secure Boot certificate update?

Run three checks in order and stop at the first clear answer: the exact wording in Windows Security, Event 1808 or 1801 in Event Viewer, then one registry value read in PowerShell.

1. Windows Security. Open Device security, then Secure Boot, and read the sentence under the badge. On Microsoft's status page, "all required certificate updates have been applied" means no action, while "older boot trust configuration" means install updates and restart.
2. Event Viewer. In the System log, filter for source TPM-WMI. Event 1808, "This device has updated Secure Boot CA/keys," is the all-clear. Event 1801 means certificates updated but not yet applied to firmware, per Microsoft's events list.
3. PowerShell. In an administrator window, run Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object UEFICA2023Status, UEFICA2023Error. Microsoft's registry page treats Updated with an error of 0 as finished; NotStarted or InProgress means not yet.

That is the one-minute check to run on your own PC tonight, and step one alone is not enough. Malwarebytes wrote on 28 May 2026 that a green checkmark alone does not confirm the new certificates were applied. An asker on Microsoft's Q&A site wanted to know how to confirm the fix had worked, which says plenty about the signal, or maybe just how many people share the question.

Will my PC still boot now the 2011 certificates have expired?

Yes: Microsoft says devices without the 2023 certificates continue to start and operate normally, and ordinary Windows updates still install, so an expired date alone does not lock you out.

What stops is the early-boot side. Microsoft states that such a PC can no longer receive new Boot Manager updates, Secure Boot database and revocation-list updates, or fixes for newly found boot-level flaws. Our reading: maintenance, not emergency, but with no natural reminder, so it gets skipped. The fix arrives through Windows Update, so confirm your build with the Windows 11 24H2 winver check, and if updates keep failing, start with the September Windows 11 update problems.

Worked example: a Windows 11 PC with Secure Boot on has never logged Event 1808, and still holds its factory 2011 certificates. Today is 25 October 2026. The key-exchange certificate expired on 24 June 2026, so 24 June to 24 October is 30 + 31 + 31 + 30 = 122 days, plus one to reach today: 123 days. That PC has booted through 123 days of an expired certificate without failing, so expiry alone is not the risk; the missing 2023 certificates are.

Four numbers frame the urgency, and the retry schedule comes from Microsoft's troubleshooting guide.

The retry cadence makes patience a fair first move: a PC showing Event 1801 may simply be mid-way.

What does each result mean, and what should I do?

Find your row and read across: 1808 means finished, 1801 means restart and recheck, errors 1795 and 1796 point at the firmware, and 1032 means pause BitLocker first.

Only the error rows need a human: Microsoft says to contact the device maker for 1795, and 1032 sits with your BitLocker setup.

Does the Secure Boot update trigger BitLocker recovery?

It can: Microsoft logs Event 1032 when your BitLocker setup would trigger recovery mode if the update were applied, and its fix is to suspend BitLocker for two restarts, then turn it back on.

Microsoft also notes a device may ask for the recovery key once after the update; enter it and check for firmware updates. Windows Latest reported on 26 May 2026 that HP had acknowledged a BIOS update leaving some commercial PCs in a BitLocker recovery loop, with the 2023 certificates failing to install meanwhile. Our call: treat every firmware update on a BitLocker PC as a recovery-key moment, and store the key somewhere that is not that PC.

One poster on Microsoft's Q&A forum described a status stuck at InProgress with events 1796 and 1801 repeating, an update that keeps retrying and never lands.

• Secure Boot off. A PC in legacy BIOS or CSM mode, Malwarebytes reports, sits outside this update.
• Reset to defaults. Microsoft says avoid it unless the maker's defaults include the 2023 certificates.
• Dismissed warnings. Dismiss installs nothing, and Microsoft calls it not recommended.
• Windows 10. Microsoft's expiry page lists Windows 10 22H2, so run the same three checks; patch timing is in the Windows 10 ESU extension to October 2027.

The decision is whether to wait for Windows or step in yourself, and for most PCs it is wait. Tonight, run the three checks. At Event 1808, close the laptop. Otherwise install updates, restart, recheck tomorrow, and touch firmware only once your recovery key is saved off the PC.

The Wemo app spins, then tells you the plug is offline. Alexa says the device is not responding. You reboot the router and nothing changes. If your Wemo stopped working this year, stop troubleshooting the Wi-Fi and leave the reset button alone: the fault is almost certainly Belkin's, and one wrong press can make it permanent.

Why did my Wemo plug stop working?

Your Wemo plug stopped responding because Belkin ended Wemo cloud services and app support on 31 January 2026, which also cut remote access and the Alexa and Google Assistant integrations, so your router is not the problem.

That check saves an evening. A dead app or a "device not responding" reply from Alexa is the shutdown working as designed, and no router setting brings either back. The useful question is which Wemo you own: Belkin's end-of-support table sorts its listed models into three fates, and the label's model number tells you yours.

Does Wemo still work with Apple HomeKit?

Yes, if it was already set up: Belkin says HomeKit-configured devices "may continue to function locally via HomeKit", but after 31 January 2026 you can no longer set up a Wemo device with Apple HomeKit at all.

That second half is the trap. A factory reset wipes the pairing, and with setup gone, the plug can never rejoin your Home app. Generic smart-plug advice says reset first. For a Wemo in Apple Home it is the single worst thing you can do. My read, and it is opinion: "may continue" is not a promise. If a future iOS update breaks these plugs, nobody at Belkin will fix them. Treat a surviving HomeKit Wemo as borrowed time, not a reason to buy more.

Belkin is harsher than most. Microsoft at least sold a lifeline when Windows 10 ended, and you can still check whether your PC is covered by Windows 10's extended security updates; Wemo owners get none. The closer parallel is Britain's landline switch-off, which will leave some burglar alarms and telecare devices dead: hardware that works perfectly until the service behind it disappears.

Four numbers decide your next move. The model count is Belkin's; the applet figure comes from GearBrain's January 2026 report that existing Wemo applets stopped running; the other two are our own arithmetic, counted to publication day.

The cost of keeping a paired plug is the figure that should change behaviour. A Wemo in Apple Home needs no Belkin server or subscription to switch, so replacing it early gains nothing. The only thing that can turn it into e-waste is you, holding the reset button down for a few seconds.

Wemo stopped working: what to do with yours

What you do depends on one check, the model number on the plug's label and whether it already shows in the Apple Home app, and the table below turns that check into a single action per situation.

Read the label, then the Home app, and stop at the first row that fits.

The middle rows stack on top of the others: nothing in Belkin's refund wording mentions HomeKit status, so a paired plug still inside its warranty is worth a claim.

Can I get a refund for my Wemo device?

Yes, if the product was still under Belkin's warranty on or after 31 January 2026 and you have proof of purchase, you may qualify for a refund through the Wemo end-of-support form on Belkin's website.

Belkin's Wemo support page, read on 21 October 2026, says its warranties run 1, 2 or 3 years depending on the model. That gives you a one-minute check, and it is the one to remember: take the order date from your receipt or confirmation email, add your model's warranty term, and see whether the result lands on or after 31 January 2026. Worked backwards (our arithmetic, not Belkin's), that means a 3-year model bought from about 31 January 2023, a 2-year model from 31 January 2024, or a 1-year model from 31 January 2025.

Keep expectations modest. 9to5Google reported in July 2025 that the refund is partial, and that affected products were still on sale as recently as 2023, so a late buyer on a 3-year term is very likely covered. The open question is timing. Belkin states no claim deadline, which is not an invitation to wait; well, technically it is, but nobody wants to be last in a queue a company is winding down. End-of-support notices tend to bury the useful part, much like the Office 2021 end of support pay-or-stay choice did for software.

• Resetting a HomeKit plug to "fix" it removes it from Apple Home for good.
• Works at home but not from work? That is the shutdown, not a fault.
• Delete dead Alexa and Google Assistant routines that name a Wemo.
• GearBrain recommends Matter plugs as replacements, so look for the Matter logo on the box, not a "works with Alexa" sticker.

So the decision is simple: keep what still switches, claim what you're owed, replace the rest. This week, turn every Wemo over, write down the model number from its label, open the Home app, and match each plug to its row before anyone touches a reset button.

Your USB headset or DAC went silent after an update, and Device Manager says “This device cannot start (Code 10)”. That is USB audio Code 10, and October's patch did not remove it. Start with what costs nothing: unplug the device and use a different USB port. Then, in Device Manager, right-click it, choose Disable device, and enable it again. If sound returns, you are done. If not, the order below stops you wasting an evening on the wrong fix.

Does KB5127648 fix USB audio Code 10?

No, KB5127648 does not fix it: Microsoft still lists the USB Audio Class 1.0 fault as mitigated, not fixed, and the October notes repair other things, such as Dolby Digital crashes in older games.

Microsoft's support page says KB5127648 arrived on 13 October 2026 for 24H2, 25H2 and 26H2, with builds ending in 9711. Press Windows+R, type winver and read your build: if it ends in 9711 or later, you already have the patch, so “install the latest update” is not step one.

On 24H2 Home or Pro, October was the version's last update, so nothing later is coming. Our guide to the 24H2 end of support and the one-restart move covers the way out.

According to Techdows, reading Microsoft's known-issues list on 14 October, some USB Audio Class 1.0 devices fail to start or play no sound, and Device Manager reports Code 10. It began with the 8 September update (KB5124008), per GridinSoft's 15 September report. Our rundown of the four faults in that September update covers the others.

The September emergency patch does not help either. KB5129195 (14 September, builds 26100.9457 and 26200.9457) repairs only eight-channel and 3D audio failures on class 1.0 devices that still work in stereo, Redmond Magazine reported on 16 September. So two faults share one complaint, and the cures differ: surround dead but stereo fine, or the device will not start at all.

October's notes do mention audio, which is where people get misled. KB5127648 fixes AC-3 (Dolby Digital) decode crashes in older apps and games, game mouse stutter, Hello fingerprint sign-in after a cold boot and Always On VPN, per Techdows and Windows Report on 14 October. None of that is Code 10. Four numbers decide whether waiting is worth it: how long the fault has been open, what the first fix costs, how many October repairs touch it, and how many patches have cured it.

The cost cell is the one to act on: free checks should always run before the ones that remove security patches. Here is where I part company with the usual advice: “just install the latest update” is outdated for this fault, because the latest update is the one that skips it. And Microsoft's “mitigated” is, I think, a fix of sorts, or rather a workaround with a kinder label, when your DAC is silent.

How do I fix “This device cannot start (Code 10)”?

Work through the checks in order: swap the port and toggle the device, confirm your build, switch to stereo if only surround is dead, and uninstall only after those fail.

A hwbusters headline reports that Microsoft's only advice for the surround variant is to drop to stereo.

Stop at the first row that brings sound back. If the toggle fails, the generic next step is Roll Back Driver on the Driver tab in the device's Properties. That is standard troubleshooting, not a Microsoft-confirmed cure, so treat it as a free experiment.

Should I uninstall the update to get sound back?

Only as a last resort: October's update is cumulative, so removing it may not undo a fault that began in September, and it takes the latest security fixes off your PC with it.

The route, if you must: Settings, Windows Update, Update history, Uninstall updates (Techdows, 14 October). Pausing updates is milder, and Windows allows up to 35 days. Do the sum, though: the fault began on 8 September, so a pause started today ends on 20 November, 73 days in, with no fix date from Microsoft. That is my arithmetic, not a Microsoft figure, and it says waiting out the fault is not a plan.

Whether removing October's update would bring your device back is unknowable from the public notes, and my view is not to trade security patches for a coin toss before the free checks fail.

• Do not apply a Remote Desktop mitigation to an audio fault: the 0xC000000D sign-in error after KB5124010 is a separate issue, and its mitigation switches Administrator protection off.
• Do not read an expiry notice as the cause. Office 2021 support also ended on 13 October, which has nothing to do with sound.
• Do not stack fixes: change one thing, test the sound, then the next.

The decision: keep the update and work around the fault, or remove it. Keep it. This week, replug the device in another port, toggle it in Device Manager, set a stereo format if only surround is dead, and run winver so you know your build when a real fix lands.

"Word opened fine this morning, so is Office 2021 really dead, and do I have to pay for a new one?" Start with the one check that tells you whether this affects you at all. Open Word, click File, then Account, and read the product name under Product Information. If it ends in 2021, the Office 2021 end of support date of 13 October 2026 is yours, and it has now passed. If it says Microsoft 365, you are on a subscription and nothing has changed for you.

Still here? Then check what has actually stopped. Nothing on your screen changes. Everything underneath it does.

What Office 2021 end of support changes on your PC

The change is invisible: Office 2021 apps still open and save your files, but Microsoft stopped every security fix and every form of technical help for them on 13 October 2026, and it is not selling an extension.

Microsoft's own End of support for Office 2021 notice, updated in June 2026, is blunt: there is "no extension and no extended security updates." That is the sharp difference from Windows 10, where Microsoft does sell extra patches, as our guide to checking your Windows 10 ESU enrolment through October 2027 explains. Here there is no lifeline to buy. Staying means staying unpatched.

In practice the danger arrives by email. A booby-trapped Word attachment built around a flaw found next spring will work against your copy for good, because no patch is coming.

But the notice also says your apps "may continue to function," so panic-buying makes no sense. I'd push back on the usual advice to upgrade immediately: work out which exit fits, then take it within weeks.

It is the second Microsoft deadline in a fortnight, after the Windows 11 24H2 cutoff and its one-restart fix, and the pattern repeats: the software runs while the risk grows.

Four numbers from Office Watch's June 2026 rundown decide which exit is cheapest. They are US list prices; no verified UK price was available at writing, so check Microsoft's UK store before paying.

The support date on the replacement matters more than its price. Buying Office 2024 does not end this question, it postpones it to the end of the decade, when the same choice returns.

Should I buy Office 2024 or Microsoft 365?

For a single PC, a one-time Office 2024 licence costs less than Microsoft 365 over its support life, even in the Outlook tier, and the subscription earns its price mainly in households sharing three or more PCs.

The table lines up the two paid routes, cost first. Staying put with the free browser apps is the third route, and it sits in the final row.

The right-hand column says it plainly: the subscription pays only when shared. My view, against Microsoft's own pitch, is that a one-PC home renting Microsoft 365 just to keep Word patched is overpaying.

Can I still use Office 2021 after end of support?

Yes, you can keep using Office 2021 for as long as it runs, but it is only a sensible choice on a home PC where you rarely open attachments from strangers and already have a plan to move.

The quiet winner for many readers is the free browser versions of Word, Excel and PowerPoint, patched by Microsoft on its own servers. They lack some desktop features, which rarely matters for letters and a household budget.

Waiting sounds clever and mostly isn't. Office Watch calls a new one-time Office "likely but not confirmed," so you would be betting on an unannounced product while unpatched. Patches misfire too, as the Windows 11 September update faults showed, but a buggy fix beats no fix, or at least it does once the follow-up lands.

• On a shared family PC, anyone's careless click hits your unpatched copy.
• On a work or school laptop, Microsoft says follow your IT department.
• If a reinstall fails to activate, no Microsoft support line will help.
• Holding out for the next one-time Office means waiting unpatched.

Pay or stay? For most single-PC homes the answer is pay once or go free, not subscribe. Tonight, open File, then Account in Word, and if the name ends in 2021, pick your exit before the weekend: browser apps for light use, Office 2024 for one PC, Microsoft 365 only for a shared household.

Your PC says 24H2. Windows Update says you're up to date. And somewhere you read that something ends on 13 October, which is next Tuesday. That date is the 24H2 end of support deadline for Home and Pro editions, and for most machines the fix is one restart, not a reinstall. Here is the check order, fastest first.

How do I check if my PC is on 24H2?

Press the Windows key and R, type winver, press Enter, and read the build number: if it starts 26100 you are on 24H2, and the security clock on your PC runs out next Tuesday.

Only the first five digits matter. Microsoft's release health page lists the newest 24H2 build as 26100.9550, from 22 September, so anything beginning 26100 is 24H2 however recently it was patched. That's the trap: a fully patched 24H2 machine looks healthy right up to the day the updates stop.

Next, the edition, named in the same box. On Home or Pro, 13 October 2026 is the last Patch Tuesday that reaches you. Enterprise and Education editions of 24H2 get fixes until 12 October 2027, per the same Microsoft page, so a work laptop has another year while the personal Pro machine beside it does not. Edition decides urgency, not age.

Then Windows Update. In Settings, check that updates aren't paused and that the toggle for getting the latest updates early is on. Nothing breaks on the day. Well, nothing you'd notice: the PC boots, apps open, and every flaw found after that Tuesday stays open on your machine.

If last month's patch made you pause, see our guide to Windows 11 September update problems and what KB5129195 fixes: none is a reason to stay on 24H2. An older Windows 10 machine has more room, because Windows 10 extended security updates now run to October 2027, if enrolment went through.

Four numbers decide whether this is a five-minute job or a weekend one. The date comes from Microsoft's Windows 11 release information page and the single restart from TechRepublic's 2 October report; feature updates are free, and the last figure is our own arithmetic on Microsoft's end dates.

The restart figure is the one people doubt. Newer versions reach a 24H2 PC as an enablement package, a small update that switches on features already on your drive. Files, apps and settings stay put.

Should I skip 25H2 and go straight to 26H2?

Yes for almost every home PC on 24H2: 26H2 installs the same way as 25H2, with one restart, but its Home and Pro support runs a full year longer.

The usual advice is to take whatever Windows Update offers. This month that advice is out of date: TechRepublic's August and October reports say Microsoft's automatic route for home PCs leads to 25H2, while 26H2 arrives gradually. Accept the default and you get the shorter of the two.

Read down the right-hand column and the choice makes itself. Only timing and 23H2 push back, and timing has a manual fix: if Windows Update hasn't offered 26H2, Microsoft's Installation Assistant installs it now.

What can block the 24H2 end of support fix?

Three known compatibility problems can hold a PC back from 26H2, and an older 23H2 install cannot take the quick route at all, so check both before you assume Windows Update is broken.

Microsoft blocks the upgrade where it knows something will break, a safeguard hold. As of 3 October, TechRepublic counted three, covering USB audio devices, Credential Guard and virtual desktop setups. If you record through a USB audio interface, that first one is about you.

Here's where I part company with the forums, which treat forcing past a hold as the obvious move. My view: if your income runs through that interface, take 25H2 now and let 26H2 follow once the hold lifts. A dead recording setup costs more than a second restart next year. That's opinion, and Microsoft hasn't said when the holds clear.

The other dead end is 23H2. Its Home and Pro editions are already out of support, and its latest build is 22631.7584, so a reading starting 22631 means the enablement package won't apply. You need the full feature update, and free space on an ageing drive starts to matter. If it's tight, our look at whether to buy RAM and SSD upgrades now or wait in 2026 covers what a replacement costs.

• A pause that runs past 13 October holds you on an unsupported build until it expires.
• A held PC looks like one not yet offered; Microsoft's release health page tells them apart.
• Work PCs follow your IT team's schedule; ask first.
• Back up anyway: one restart is normal, not promised.

So here's the job: open winver tonight, and if the build starts 26100, install 26H2 from Windows Update before next Tuesday's final 24H2 patch.

Related: Office 2021 end of support landed the same day, so check whether your copy is still patched

Related: check your Secure Boot certificate after the Windows 11 24H2 cutoff

"The home phone has had no dial tone since the broadband engineer came, and Mum's alarm box keeps blinking." That is the landline switch off arriving early. Providers are moving every UK line from copper to Digital Voice, and kit built for copper can fail quietly. Check in this order: the plug, the power, then the provider.

Start at the wall. A BT-style plug or small RJ11 jack means the device leans on copper and is at risk. A wider RJ45 plug means it already uses broadband. A power lead alone usually means a built-in SIM, which the change leaves alone. HomeCareGuardian's August 2026 telecare guide uses the same test.

Why does the landline switch off break working kit?

Digital Voice carries your calls as internet data through the router, so anything that expects the old copper line's signal or its power, such as older burglar alarms and telecare units, can lose its connection without any warning light.

Copper carried a small current of its own, which is why a corded phone worked through a storm. Digital Voice sends the call as data through the router, and the router needs mains power. Uswitch's explainer, updated August 2026, lists burglar alarms, CCTV, card terminals and telecare among affected kit, and confirms full fibre is not needed: ordinary broadband, SOGEA included, carries the calls. So the router is now your phone socket, and its power matters more than its speed (our comparison of Wi-Fi 7 and Wi-Fi 6E home routers covers speed).

The weak link is paperwork, not technology. Providers are meant to find vulnerable customers before moving them, and they miss some, as Ofcom's December 2025 penalty on Virgin Media and an August 2025 Which? survey of telecare firms show. The time figure below is our own count of days to the cutoff.

If you are shopping for a parent, act on the Which? finding: get the seller to confirm in writing that the alarm works on Digital Voice or has its own SIM. The same habit applies to any connected gadget, as our look at what works and what still breaks in Matter smart homes found.

Copper line vs Digital Voice: what changes at home

Digital Voice keeps your number and your handset but moves the dependency from the copper line to your router, so plug type, power and the telecare rules decide whether each device keeps working after the cutoff.

Left column: the question. Middle: how each network handles it. Right: what to do. Rows run from cost to risk.

All ticks and you are done. One cross, usually the power-cut row, means a router battery pack or a mobile kept charged, both far cheaper than a panic engineer visit in the final week.

What happens to my phone in a power cut on Digital Voice?

Your home phone stops working once the router loses power, unless the router has battery backup, and Ofcom only requires providers to offer enough backup for a short spell of emergency calls, not a night without electricity.

The GOV.UK Telecare National Action Plan, published February 2025, says analogue telecare units typically run 12 to 24 hours on their own battery, and alarms without one fail in a power cut outright. But on Digital Voice that battery only counts while the router is alive, so a unit good for a day goes deaf when the hub does. That is our reading of the two rules together, and it puts the backup question on the router.

The plan's Charter says providers will not migrate a telecare user until "a compatible and functioning telecare solution" is confirmed. My view: sound on paper, but only if the provider knows the alarm exists. Tell them yourself (or, more accurately, get whoever pays the bill to), and if brushed off, call Ofcom on 0300 123 3333. Then check any reassuring letter, as you would when verifying Windows 10 ESU enrolment.

• A burglar alarm that dials out over the phone line: ask the installer for an IP or SIM communicator.
• A router on a timer plug or an extension lead that gets switched off at night.
• Sheltered or social housing: the landlord usually owns the alarm, so ask them for the upgrade date.

This weekend, do the plug test on every device, then phone your provider with two questions: your migration date, and whether a telecare alarm is flagged on your account. If the second answer is no, the job is yours.

Related: what to check when your Wemo stopped working after Belkin's cloud shutdown