“SecureBoot” Folder Suddenly Appeared After Windows Update — Is It Safe to Delete?

Question

After my laptop updated with KB5089549, a mysterious “SecureBoot” folder appeared in the C:\Windows directory. What is this?

Not only that, after my Windows 10 desktop updated with KB5087544 and KB5088863, a SecureBoot folder also appeared. For now, it’s best to keep it for a while — perhaps after a few weeks, it may be safe to delete the folder automatically.

laptop

desktop computer

Answer 1

The C:\Windows\SecureBoot folder is part of Microsoft’s Secure Boot certificate update mechanism.

Secure Boot uses trusted digital certificates stored in firmware to ensure that only trusted code (boot loaders, firmware drivers, etc.) runs during startup. Microsoft is updating these certificates because the original Secure Boot certificates issued in 2011 start expiring in June 2026. To deliver and manage these updates, Windows installs additional Secure Boot components and scripts, which are stored under the SecureBoot folder (for example, rollout and orchestration PowerShell scripts).

This folder is therefore a legitimate system folder created by recent Windows security updates related to Secure Boot certificate and DB/DBX updates. It should be left in place; deleting or modifying it can interfere with current or future Secure Boot updates and may reduce protection against pre‑boot malware.

---

References:

• Windows 11 and Secure Boot
• Windows Secure Boot certificate expiration and CA updates
• Surface Secure Boot Certificates
• KB4535680: Security update for Secure Boot DBX: January 12, 2021