TPM-WMI Event 1801 Error: What It Means and How to Fix It

TPM-WMI error 1801 is a Windows Event Viewer entry saying that Microsoft's updated Secure Boot certificates are available for your PC but have not yet been written to its firmware. It is a status warning, not a crash: the PC keeps booting normally. The fix is to install all Windows updates, update the UEFI/BIOS from your PC maker, and restart until Event 1808 replaces it.

What Does TPM-WMI Event ID 1801 Mean?

TPM-WMI Event ID 1801 means Windows has the new 2023 Secure Boot certificates and boot manager ready, but your device firmware has not accepted them yet. Microsoft's event reference describes it as the updated certificates "not yet applied to the device firmware" and tells you to review the published guidance to complete the update.

The event is logged in Event Viewer → Windows Logs → System with the source TPM-WMI. The message usually reads "Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware", followed by technical fields such as DeviceAttributes, BucketId and UpdateType that Microsoft uses to track which kinds of hardware still need the update.

Despite the "TPM" in the source name, the TPM chip itself is not faulty. TPM-WMI is simply the Windows component that reports on Secure Boot servicing. Your TPM status in tpm.msc will normally still read "ready for use".

Why Is Windows Logging Event 1801 Now?

Windows logs Event 1801 because the original Microsoft Secure Boot certificates from 2011 reached their expiry dates during 2026, and Microsoft is replacing them on every supported PC.

Secure Boot is a UEFI firmware feature that lets only trusted, signed code start before Windows loads. The firmware decides what is trusted using certificate lists stored in its memory: the KEK (Key Exchange Key) list, which authorises changes, and the DB (allowed signatures database). When the certificates in those lists expire, Microsoft can no longer sign new boot manager fixes or revocation updates with them. So Windows must add the 2023 replacements to the firmware, and Event 1801 is what you see until that has happened.

Dates are from Microsoft's Windows Secure Boot certificate expiration and CA updates page. If Secure Boot is new to you, our explainer on how to check if Secure Boot is enabled covers the basics.

Is TPM-WMI 1801 Dangerous?

No, event 1801 TPM-WMI does not stop your PC from working. Microsoft states that devices without the 2023 certificates continue to start and operate normally, and regular Windows updates keep installing.

The risk is gradual. A PC stuck on the old certificates cannot receive new boot manager updates, new Secure Boot revocation lists or fixes for newly found boot-level vulnerabilities. Over time that weakens protection against bootkits, and Microsoft notes it can affect BitLocker hardening. It is worth fixing, but it is not an emergency that calls for reinstalling Windows.

How Do You Fix TPM-WMI Error 1801?

For most home and small-business PCs, the fix is to let Windows finish the update and make sure the firmware can accept it.

1. Open Settings → Windows Update, select Check for updates and install everything offered, including optional firmware or driver updates from your PC maker.
2. Restart the PC, then restart it a second time. Some stages of the certificate update only complete during a reboot.
3. Check that Secure Boot is on: press Windows + R, type msinfo32 and confirm Secure Boot State reads On and BIOS Mode reads UEFI.
4. Visit your motherboard or laptop maker's support page and install the latest UEFI/BIOS release. Many manufacturers have issued firmware that includes the 2023 certificates or fixes firmware that rejected them.
5. Open Windows Security → Device security → Secure Boot and read the certificate status message.
6. Open Event Viewer → Windows Logs → System, select Filter Current Log and enter 1801,1808. When Event 1808 ("This device has updated Secure Boot CA/keys") appears after the latest 1801, the update is complete.

Windows processes the update through a scheduled task called \Microsoft\Windows\PI\Secure-Boot-Update, which Microsoft says runs every 12 hours. If you have just installed updates, give it a day and a couple of restarts before deciding something is wrong.

What Do the Windows Security Secure Boot Messages Mean?

The Windows Security app now shows a plain-English Secure Boot certificate status, and it tells you whether you need to act. Microsoft's guide to Secure Boot certificate status in the Windows Security app lists the states:

• Fully updated (green tick): all certificate updates are applied. Event 1801 should stop.
• Not yet updated: stay online, install updates and restart when prompted.
• Paused due to a known issue: Microsoft has paused delivery for your hardware type; it resumes automatically.
• Hardware or firmware limitation: your firmware cannot take the automatic update. Contact the PC or motherboard maker for a firmware update.
• Requires action: follow the guidance Microsoft links from the message.

What If Event 1801 Keeps Coming Back?

If tpm-wmi 1801 keeps repeating after updates and restarts, the firmware is usually refusing or not storing the new certificates. Look for these companion events in the same log, because they explain why:

• Event 1795: the firmware rejected the update. Microsoft's advice is to contact the device manufacturer for a firmware update.
• Event 1800: a reboot is needed before the update can install. Restart and check again.
• Event 1796: a general update error with an error code. Windows retries at the next restart.

Businesses that manage updates themselves can trigger the deployment using the AvailableUpdates registry value described in Microsoft's IT-managed Secure Boot guidance. That route is designed for administrators testing fleets, so home users are better served by firmware updates and Windows Update. Some server and workstation makers also document a firmware-menu step to restore default Secure Boot keys before the update will apply; follow your manufacturer's instructions exactly for that, because a wrong change can stop the PC booting.

Do not disable Secure Boot to make the event go away. It removes the warning only because Windows stops trying to update a feature that is switched off, and it leaves the PC less protected. It can also lock you out of games and apps that require Secure Boot.

A Common Mistake We See

A common mistake is treating Event 1801 as an activation or licensing problem and reinstalling Windows or re-entering a product key. The event has nothing to do with your Windows licence or activation status: a genuine, activated copy of Windows can log it, and a clean reinstall will usually log it again until the firmware is updated.

Another is clearing the TPM because the event source says "TPM-WMI". Clearing the TPM does not install Secure Boot certificates, and on an encrypted drive it can trigger a BitLocker recovery prompt. Update first, restart, and check the Windows Security status before changing anything else.

Frequently Asked Questions

Can I ignore TPM WMI event ID 1801?

Your PC will keep working, so it is not urgent, but you should not ignore it indefinitely. Until the 2023 certificates are applied, the PC cannot receive new boot manager fixes or Secure Boot revocation updates. Install Windows and firmware updates and restart a few times to clear it.

Does TPM-WMI 1801 mean my TPM is broken?

No. TPM-WMI is only the Windows component that logs Secure Boot servicing events. Event 1801 concerns certificates stored in UEFI firmware, not the TPM chip. Check tpm.msc if you want reassurance; a healthy TPM still reports that it is ready for use.

How long does it take for Event 1808 to replace 1801?

It varies. The Windows task that applies the update runs every 12 hours, and some steps finish only after a restart. On a PC with current firmware, expect a day or two of normal use and a few restarts. If 1801 persists for weeks, update the UEFI/BIOS.

Will event 1801 tpm-wmi stop my PC from booting?

Microsoft states that devices without the new certificates continue to start and operate normally. The concern is future protection, not today's boot. A PC only fails to boot after Secure Boot changes if firmware settings are altered incorrectly, which is why you should follow your manufacturer's instructions.

Does Windows 10 get the Secure Boot certificate update?

Microsoft's certificate guidance applies to Windows 10 as well as Windows 11 and recent Windows Server versions. Because general Windows 10 support ended in October 2025, a Windows 10 PC realistically needs to be enrolled in Extended Security Updates to keep receiving the servicing that delivers these certificate changes.

Should I turn off Secure Boot to stop error 1801?

No. Turning off Secure Boot hides the symptom and removes a protection Windows 11 is built around. Some games and apps also refuse to run without it. Keep Secure Boot on and let the firmware accept the new certificates instead.

Conclusion

TPM-WMI error 1801 is Windows telling you its Secure Boot certificate refresh is unfinished, and the usual fix is Windows Update, a current UEFI/BIOS and a couple of restarts until Event 1808 appears. If you are moving an older Windows 10 machine onto a fully supported system while you are at it, our Windows 11 licences include Home and Pro keys with instant email delivery. Readers still on Windows 10 can compare their options in our Windows 10 ESU guide.

Useful Links