Skip to content
PCDecoder
Event ID 1808TPM-WMI: Secure Boot certificates updatedEvent IDWidely reported

Event ID 1808 TPM-WMI: Secure Boot certificates updated

Updated Oct 4, 2026 · Checked against Microsoft documentation · How this page is made

Quick answer

This event is a routine notification from Windows confirming that your computer's Secure Boot security certificates have been successfully updated. It is a normal part of system maintenance and does not indicate a problem with your PC. No action is required on your part.

What it means

What is Event ID 1808?

Event ID 1808 is an informational message generated by the TPM-WMI (Trusted Platform Module - Windows Management Instrumentation) service. It signals that your system has received and applied an update to the Secure Boot certificate databases. Secure Boot is a security feature built into your computer's firmware (UEFI) that ensures your PC starts using only software and drivers that are trusted by the manufacturer.

Why does this happen?

To keep your computer secure, Microsoft and your hardware manufacturer occasionally update the list of "known good" software and drivers that are allowed to run during the boot process. These lists are stored in databases known as DB (Allowed) and DBX (Revoked/Forbidden) within your system's firmware. When Windows receives an update for these databases, it applies the changes to ensure your system remains protected against potential threats like rootkits or malicious boot loaders. This event is simply the system logging that this background update process finished successfully.

Is this an error?

No, this is not an error. It is a standard operational log entry. You will typically see this event appear automatically after Windows Update installs security patches or firmware updates. Because it is a normal security maintenance task, it does not require troubleshooting or manual intervention.

Common causes

  • Automatic background updates of Secure Boot certificate databases.
  • Installation of firmware or BIOS updates from your computer manufacturer.
  • Routine Windows security updates that include updated revocation lists.
  • System synchronization between Windows and the UEFI firmware.

How to fix it

Safest and most likely fixes first. Readers' answers to "Did this fix it?" reorder this list over time.

  1. Ignore the event

    This is the correct action for almost all users as the event is informational.

    1. No action is needed.
    2. Continue using your computer as normal.
    Did this fix it?

  2. Check for pending updates

    Use this if you want to ensure your system is fully up to date.

    1. Open the Start menu and select Settings.
    2. Go to Windows Update.
    3. Select Check for updates to ensure all security components are current.
    Did this fix it?

Is it just you?

25+ Microsoft Q&A threads discuss this. Most recent activity:

Checked Oct 2, 2026. Refreshed automatically every few days.

Sources

Frequently asked questions

Is Event ID 1808 a sign of a virus?

No, this event is a legitimate system process related to Windows security features and is not caused by a virus.

Do I need to fix this event?

No, this is an informational log entry and does not require any repairs or troubleshooting.

Why am I seeing this in my Event Viewer?

Windows logs many routine maintenance tasks in the Event Viewer, and this entry is simply a record that your security certificates were updated successfully.

More event ids decoded