@prefix schema: <https://schema.org/> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix ks: <https://comcomponent.com/vocab/> .

<https://comcomponent.com/blog/windows-secure-boot-certificate-expiry-check/#article>
    schema:about <https://comcomponent.com/knowledge/uefi-secure-boot/>, <https://comcomponent.com/knowledge/windows-uefi-ca-2023/>, <https://comcomponent.com/knowledge/windows-production-pca-2011/> ;
    schema:mentions <https://comcomponent.com/knowledge/secure-boot-kek/>, <https://comcomponent.com/knowledge/secure-boot-db/>, <https://comcomponent.com/knowledge/secure-boot-dbx/>, <https://comcomponent.com/knowledge/microsoft-kek-ca-2011/>, <https://comcomponent.com/knowledge/microsoft-kek-2k-ca-2023/>, <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/>, <https://comcomponent.com/knowledge/microsoft-uefi-ca-2023/>, <https://comcomponent.com/knowledge/microsoft-option-rom-uefi-ca-2023/>, <https://comcomponent.com/knowledge/windows-boot-manager/>, <https://comcomponent.com/knowledge/secure-boot-update-task/>, <https://comcomponent.com/knowledge/availableupdates-registry/>, <https://comcomponent.com/knowledge/uefica2023status/>, <https://comcomponent.com/knowledge/get-securebootuefi/>, <https://comcomponent.com/knowledge/confirm-securebootuefi/>, <https://comcomponent.com/knowledge/pxe-boot/>, <https://comcomponent.com/knowledge/task-scheduler/>, <https://comcomponent.com/knowledge/windows-update/>, <https://comcomponent.com/knowledge/group-policy/>, <https://comcomponent.com/knowledge/intune/>, <https://comcomponent.com/knowledge/windows-event-log/>, <https://comcomponent.com/knowledge/recovery-mode/>, <https://comcomponent.com/knowledge/recovery-key/>, <https://comcomponent.com/knowledge/manage-bde/>, <https://comcomponent.com/knowledge/app-control-for-business/>, <https://comcomponent.com/knowledge/audit-mode/> .

<https://comcomponent.com/knowledge/uefi-secure-boot/> a skos:Concept ;
    skos:prefLabel "UEFIセキュアブート"@ja ;
    skos:definition "署名検証に通ったブートコンポーネントだけを起動させるUEFIの仕組み。"@ja ;
    skos:altLabel "セキュアブート"@ja ;
    skos:altLabel "Secure Boot" ;
    ks:uses <https://comcomponent.com/knowledge/secure-boot-kek/> ;
    ks:uses <https://comcomponent.com/knowledge/secure-boot-db/> ;
    ks:uses <https://comcomponent.com/knowledge/secure-boot-dbx/> ;
    ks:verifiedBy <https://comcomponent.com/knowledge/confirm-securebootuefi/> .

<https://comcomponent.com/knowledge/windows-uefi-ca-2023/> a skos:Concept ;
    skos:prefLabel "Windows UEFI CA 2023"@ja ;
    skos:definition "Microsoft Windows Production PCA 2011の後継として、Windowsのブートローダーに署名する2023年版の証明書。dbに入る。"@ja ;
    ks:succeeds <https://comcomponent.com/knowledge/windows-production-pca-2011/> ;
    ks:storedIn <https://comcomponent.com/knowledge/secure-boot-db/> ;
    ks:verifiedBy <https://comcomponent.com/knowledge/get-securebootuefi/> .

<https://comcomponent.com/knowledge/windows-production-pca-2011/> a skos:Concept ;
    skos:prefLabel "Microsoft Windows Production PCA 2011"@ja ;
    skos:definition "dbに入り、Windowsのブートローダーに署名してきたMicrosoftの証明書。2026年10月19日に期限を迎えた。"@ja ;
    skos:altLabel "Windows Production PCA 2011" ;
    skos:altLabel "PCA 2011" ;
    ks:storedIn <https://comcomponent.com/knowledge/secure-boot-db/> .

<https://comcomponent.com/knowledge/secure-boot-kek/> a skos:Concept ;
    skos:prefLabel "KEK(Key Exchange Key)"@ja ;
    skos:definition "Secure Bootで、dbとDBXを書き換える更新に署名する鍵を入れるファームウェアの領域。"@ja ;
    skos:altLabel "Secure BootのKEK"@ja ;
    ks:configuredBy <https://comcomponent.com/knowledge/secure-boot-update-task/> .

<https://comcomponent.com/knowledge/secure-boot-db/> a skos:Concept ;
    skos:prefLabel "db(Secure Bootの許可署名データベース)"@ja ;
    skos:definition "Secure Bootで、起動を許す署名者の証明書などを入れるファームウェアの領域。"@ja ;
    skos:altLabel "Secure Bootのdb"@ja ;
    skos:altLabel "Allowed signature database" ;
    ks:configuredBy <https://comcomponent.com/knowledge/secure-boot-update-task/> .

<https://comcomponent.com/knowledge/secure-boot-dbx/> a skos:Concept ;
    skos:prefLabel "DBX(Secure Bootの禁止署名データベース)"@ja ;
    skos:definition "Secure Bootで、起動を禁じる署名者やプログラムを入れるファームウェアの領域。"@ja ;
    skos:altLabel "Secure BootのDBX"@ja ;
    skos:altLabel "Forbidden signature database" .

<https://comcomponent.com/knowledge/microsoft-kek-2k-ca-2023/> a skos:Concept ;
    skos:prefLabel "Microsoft Corporation KEK 2K CA 2023"@ja ;
    skos:definition "Microsoft Corporation KEK CA 2011の後継として、KEKに入る2023年版の証明書。"@ja ;
    skos:altLabel "KEK 2K CA 2023" ;
    ks:succeeds <https://comcomponent.com/knowledge/microsoft-kek-ca-2011/> ;
    ks:storedIn <https://comcomponent.com/knowledge/secure-boot-kek/> .

<https://comcomponent.com/knowledge/microsoft-kek-ca-2011/> a skos:Concept ;
    skos:prefLabel "Microsoft Corporation KEK CA 2011"@ja ;
    skos:definition "KEKに入り、dbとDBXの更新に署名してきたMicrosoftの証明書。2026年6月24日に期限を迎えた。"@ja ;
    skos:altLabel "KEK CA 2011" .

<https://comcomponent.com/knowledge/microsoft-uefi-ca-2023/> a skos:Concept ;
    skos:prefLabel "Microsoft UEFI CA 2023"@ja ;
    skos:definition "Microsoft UEFI CA 2011の後継のうち、他社製のブートローダーとEFIアプリケーションに署名する2023年版の証明書。"@ja ;
    skos:altLabel "UEFI CA 2023" ;
    ks:succeeds <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> .

<https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> a skos:Concept ;
    skos:prefLabel "Microsoft UEFI CA 2011"@ja ;
    skos:definition "dbに入り、他社製のブートローダーとオプションROMに署名してきたMicrosoftの証明書。2026年6月27日に期限を迎えた。"@ja ;
    skos:altLabel "UEFI CA 2011" .

<https://comcomponent.com/knowledge/microsoft-option-rom-uefi-ca-2023/> a skos:Concept ;
    skos:prefLabel "Microsoft Option ROM UEFI CA 2023"@ja ;
    skos:definition "Microsoft UEFI CA 2011の後継のうち、他社製のオプションROMに署名する2023年版の証明書。"@ja ;
    skos:altLabel "Option ROM UEFI CA 2023" ;
    ks:succeeds <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> .

<https://comcomponent.com/knowledge/windows-boot-manager/> a skos:Concept ;
    skos:prefLabel "Windowsブートマネージャー"@ja ;
    skos:definition "UEFIのファームウェアが読み込み、Windowsの起動を始めるブートローダー。Secure Bootではdbの証明書で署名が確かめられる。"@ja ;
    skos:altLabel "Windows Boot Manager" ;
    skos:altLabel "bootmgfw.efi" ;
    ks:requires <https://comcomponent.com/knowledge/windows-uefi-ca-2023/> .

<https://comcomponent.com/knowledge/pxe-boot/> a skos:Concept ;
    skos:prefLabel "PXEブート"@ja ;
    skos:definition "ネットワーク経由でブートローダーを読み込んで起動する方式。"@ja ;
    skos:altLabel "ネットワークブート"@ja ;
    skos:altLabel "PXE" .

<https://comcomponent.com/knowledge/confirm-securebootuefi/> a skos:Concept ;
    skos:prefLabel "Confirm-SecureBootUEFI"@ja ;
    skos:definition "PCでSecure Bootが有効かを確かめるPowerShellのコマンドレット。有効ならTrueを返す。"@ja .

<https://comcomponent.com/knowledge/get-securebootuefi/> a skos:Concept ;
    skos:prefLabel "Get-SecureBootUEFI"@ja ;
    skos:definition "PK、KEK、db、DBXなどのSecure BootのUEFI変数を読み出すPowerShellのコマンドレット。-Decodedを付けると証明書を読める形で表示する。"@ja .

<https://comcomponent.com/knowledge/secure-boot-update-task/> a skos:Concept ;
    skos:prefLabel "Secure-Boot-Updateタスク"@ja ;
    skos:definition "Secure Bootの証明書とブートマネージャーの更新を適用するWindowsのスケジュールタスク。SYSTEMとして、起動時と12時間ごとに動く。"@ja ;
    skos:altLabel "\\Microsoft\\Windows\\PI\\Secure-Boot-Update" ;
    ks:verifiedBy <https://comcomponent.com/knowledge/uefica2023status/> ;
    ks:verifiedBy <https://comcomponent.com/knowledge/windows-event-log/> ;
    ks:requires <https://comcomponent.com/knowledge/task-scheduler/> ;
    ks:configuredBy <https://comcomponent.com/knowledge/availableupdates-registry/> ;
    ks:configuredBy <https://comcomponent.com/knowledge/group-policy/> ;
    ks:configuredBy <https://comcomponent.com/knowledge/intune/> .

<https://comcomponent.com/knowledge/uefica2023status/> a skos:Concept ;
    skos:prefLabel "UEFICA2023Statusレジストリ値"@ja ;
    skos:definition "HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\Servicingにある、2023年版の証明書への更新の状態をNotStarted、InProgress、Updatedで示すレジストリ値。"@ja ;
    skos:altLabel "UEFICA2023Status" .

<https://comcomponent.com/knowledge/windows-event-log/> a skos:Concept ;
    skos:prefLabel "Windowsイベントログ"@ja ;
    skos:definition "Application・System・Securityなどのログにアプリケーションやサービスの事象を記録し、イベントビューアーや監視ツールから運用担当者が確認できるWindows標準の記録機構。"@ja ;
    skos:altLabel "Windows Event Log" ;
    skos:altLabel "EventLog" .

<https://comcomponent.com/knowledge/task-scheduler/> a skos:Concept ;
    skos:prefLabel "タスクスケジューラ"@ja ;
    skos:definition "指定したアカウントで、スケジュールやログオンなどのトリガーに従いプログラムを実行するWindowsの仕組み。ログオン種別(対話トークン・パスワード保存・S4Uなど)の設定によっては、ユーザーがログオンしていなくても実行できる。"@ja ;
    skos:altLabel "Task Scheduler" ;
    skos:altLabel "タスク スケジューラ"@ja .

<https://comcomponent.com/knowledge/availableupdates-registry/> a skos:Concept ;
    skos:prefLabel "AvailableUpdatesレジストリ値"@ja ;
    skos:definition "HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecureBootにある、Secure Bootの更新のうちどれを行うかをビットで指示するレジストリ値。0x5944ですべての更新を指示する。"@ja ;
    skos:altLabel "AvailableUpdates" .

<https://comcomponent.com/knowledge/group-policy/> a skos:Concept ;
    skos:prefLabel "グループポリシー"@ja ;
    skos:definition "Active Directoryドメイン環境でWindowsの設定を集中構成する仕組み。"@ja ;
    skos:altLabel "GPO" ;
    skos:altLabel "Group Policy" .

<https://comcomponent.com/knowledge/intune/> a skos:Concept ;
    skos:prefLabel "Microsoft Intune"@ja ;
    skos:definition "クラウドからPC・モバイルデバイスを管理するMicrosoftのMDMサービス。"@ja ;
    skos:altLabel "Intune" .

<https://comcomponent.com/knowledge/windows-update/> a skos:Concept ;
    skos:prefLabel "Windows Update"@ja ;
    skos:definition "Microsoftが更新プログラムを配信するオンラインサービス。"@ja ;
    ks:uses <https://comcomponent.com/knowledge/secure-boot-update-task/> .

<https://comcomponent.com/knowledge/recovery-mode/> a skos:Concept ;
    skos:prefLabel "BitLocker回復モード"@ja ;
    skos:definition "通常の解除ができず、回復パスワードなど構成済みの正規の回復手段による解除が必要になった状態。"@ja ;
    skos:altLabel "回復画面"@ja .

<https://comcomponent.com/knowledge/recovery-key/> a skos:Concept ;
    skos:prefLabel "回復キー(回復パスワード)"@ja ;
    skos:definition "BitLockerの通常の解錠ができないときにドライブを解錠する48桁の数字。"@ja ;
    skos:altLabel "BitLocker回復キー"@ja ;
    skos:altLabel "48桁の回復パスワード"@ja ;
    ks:verifiedBy <https://comcomponent.com/knowledge/manage-bde/> .

<https://comcomponent.com/knowledge/manage-bde/> a skos:Concept ;
    skos:prefLabel "manage-bde"@ja ;
    skos:definition "BitLockerの状態確認・プロテクター管理を行うコマンドラインツール。"@ja .

<https://comcomponent.com/knowledge/audit-mode/> a skos:Concept ;
    skos:prefLabel "監査モード"@ja ;
    skos:definition "ブロックせずに「強制していたらブロックされていたもの」だけを記録するAppLocker/App Controlの運用モード。強制切り替え前に一巡分のイベントを集めるために使う。"@ja ;
    skos:altLabel "Audit Mode" ;
    skos:altLabel "監査のみ"@ja ;
    ks:recommendedFor <https://comcomponent.com/knowledge/app-control-for-business/> .

<https://comcomponent.com/knowledge/app-control-for-business/> a skos:Concept ;
    skos:prefLabel "App Control for Business(旧WDAC)"@ja ;
    skos:definition "Windows 10で「Device Guard」として登場した実行制御機能の現在の名称。ポリシーはマシン全体・全ユーザーに適用され、MSRCのサービス基準を満たすセキュリティ機能として設計されている。"@ja ;
    skos:altLabel "WDAC" ;
    skos:altLabel "Windows Defender Application Control" ;
    skos:altLabel "構成可能なコード整合性"@ja ;
    skos:altLabel "Device Guard" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/uefi-secure-boot/> ;
    rdf:predicate ks:uses ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-kek/> ;
    schema:description "Secure BootはKEKに入った鍵で、dbとDBXを書き換える更新の署名を確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/docs/2026/04/powershell-using-the-decoded-parameter-in-get-securebootuefi>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/uefi-secure-boot/> ;
    rdf:predicate ks:uses ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-db/> ;
    schema:description "Secure Bootはdbに入った証明書で、起動するプログラムの署名を確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/docs/2026/04/powershell-using-the-decoded-parameter-in-get-securebootuefi>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/uefi-secure-boot/> ;
    rdf:predicate ks:uses ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-dbx/> ;
    schema:description "Secure BootはDBXに入った署名者やプログラムの起動を禁じる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/docs/2026/04/powershell-using-the-decoded-parameter-in-get-securebootuefi>, <https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/microsoft-kek-2k-ca-2023/> ;
    rdf:predicate ks:succeeds ;
    rdf:object <https://comcomponent.com/knowledge/microsoft-kek-ca-2011/> ;
    schema:description "2026年6月24日に期限を迎えたMicrosoft Corporation KEK CA 2011の後継は、Microsoft Corporation KEK 2K CA 2023である。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/microsoft-uefi-ca-2023/> ;
    rdf:predicate ks:succeeds ;
    rdf:object <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> ;
    schema:description "2026年6月27日に期限を迎えたMicrosoft UEFI CA 2011の後継のうち、他社製のブートローダーに署名するのはMicrosoft UEFI CA 2023である。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/microsoft-option-rom-uefi-ca-2023/> ;
    rdf:predicate ks:succeeds ;
    rdf:object <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> ;
    schema:description "Microsoft UEFI CA 2011の後継のうち、オプションROMに署名するのはMicrosoft Option ROM UEFI CA 2023である。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-uefi-ca-2023/> ;
    rdf:predicate ks:succeeds ;
    rdf:object <https://comcomponent.com/knowledge/windows-production-pca-2011/> ;
    schema:description "2026年10月19日に期限を迎えたMicrosoft Windows Production PCA 2011の後継は、Windows UEFI CA 2023である。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/10/kb5132953-windows-production-ca-2011-expiration-bootloader-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/microsoft-kek-2k-ca-2023/> ;
    rdf:predicate ks:storedIn ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-kek/> ;
    schema:description "Microsoft Corporation KEK 2K CA 2023はKEKに入る。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-uefi-ca-2023/> ;
    rdf:predicate ks:storedIn ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-db/> ;
    schema:description "Windows UEFI CA 2023はdbに入る。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-production-pca-2011/> ;
    rdf:predicate ks:storedIn ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-db/> ;
    schema:description "Microsoft Windows Production PCA 2011はdbに入っており、期限後もdbに残っていること自体は異常ではない。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/docs/2026/04/powershell-using-the-decoded-parameter-in-get-securebootuefi> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-boot-manager/> ;
    rdf:predicate ks:requires ;
    rdf:object <https://comcomponent.com/knowledge/windows-uefi-ca-2023/> ;
    schema:description "2011年版で署名した最後のブートマネージャーは固定され、以後のブートローダーの修正はWindows UEFI CA 2023の系列だけで署名される。修正を受け取るには、dbにWindows UEFI CA 2023が要る。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/10/kb5132953-windows-production-ca-2011-expiration-bootloader-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/pxe-boot/> ;
    rdf:predicate ks:requires ;
    rdf:object <https://comcomponent.com/knowledge/microsoft-uefi-ca-2011/> ;
    schema:description "PXEの経路はMicrosoft UEFI CA 2011で署名されている。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "context-dependent" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/uefi-secure-boot/> ;
    rdf:predicate ks:verifiedBy ;
    rdf:object <https://comcomponent.com/knowledge/confirm-securebootuefi/> ;
    schema:description "Secure Bootが有効かは、Confirm-SecureBootUEFIがTrueを返すかで確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/secure-boot-certificate-updates-guidance-for-it-professionals-and-organizations> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-uefi-ca-2023/> ;
    rdf:predicate ks:verifiedBy ;
    rdf:object <https://comcomponent.com/knowledge/get-securebootuefi/> ;
    schema:description "dbにWindows UEFI CA 2023が入っているかは、Get-SecureBootUEFIでdbを読み出して確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/docs/2026/04/powershell-using-the-decoded-parameter-in-get-securebootuefi> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:verifiedBy ;
    rdf:object <https://comcomponent.com/knowledge/uefica2023status/> ;
    schema:description "証明書とブートマネージャーの更新が最後まで済んだかは、UEFICA2023StatusがUpdatedかで確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates>, <https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:verifiedBy ;
    rdf:object <https://comcomponent.com/knowledge/windows-event-log/> ;
    schema:description "更新の進み具合は、SystemログにソースTPM-WMIのイベント(1808、1801、1795、1803など)として記録される。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/windows/2022/06/secure-boot-db-and-dbx-variable-update-events> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:requires ;
    rdf:object <https://comcomponent.com/knowledge/task-scheduler/> ;
    schema:description "Secure-Boot-Updateはタスクスケジューラのタスクとして起動時と12時間ごとに動き、無効にしたり消したりしたPCには証明書の更新を適用できない。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-db/> ;
    rdf:predicate ks:configuredBy ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    schema:description "Windowsでは、Secure-Boot-Updateタスクが2023年版の証明書をdbに書き込む。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-kek/> ;
    rdf:predicate ks:configuredBy ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    schema:description "Windowsでは、Secure-Boot-UpdateタスクがKEKを2023年版に更新する。PKで署名されたKEKがないPCでは、この段階だけ処理されない。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:configuredBy ;
    rdf:object <https://comcomponent.com/knowledge/availableupdates-registry/> ;
    schema:description "タスクが行う更新はAvailableUpdatesのビットで指示し、0x5944ですべての更新を指示する。処理されたビットは消え、値が0x4000になれば完了である。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:configuredBy ;
    rdf:object <https://comcomponent.com/knowledge/group-policy/> ;
    schema:description "グループポリシーの「Enable Secure Boot Certificate Deployment」で、証明書の更新を指示できる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:configuredBy ;
    rdf:object <https://comcomponent.com/knowledge/intune/> ;
    schema:description "Intuneの設定カタログの「Enable Secureboot Certificate Updates」で、証明書の更新を指示できる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/11/microsoft-intune-method-of-secure-boot-for-windows-devices-with-it-managed-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/windows-update/> ;
    rdf:predicate ks:uses ;
    rdf:object <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    schema:description "月例の累積更新で届く証明書の更新も、Secure-Boot-Updateタスクがファームウェアに書き込む。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/secure-boot-certificate-updates-guidance-for-it-professionals-and-organizations>, <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/secure-boot-update-task/> ;
    rdf:predicate ks:mayCause ;
    rdf:object <https://comcomponent.com/knowledge/recovery-mode/> ;
    schema:description "Secure Bootの更新のあと、最初の起動だけBitLockerが回復モードに入ることがある。次の起動からは通常どおり起動する。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "context-dependent" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/pxe-boot/> ;
    rdf:predicate ks:mayCause ;
    rdf:object <https://comcomponent.com/knowledge/recovery-mode/> ;
    schema:description "PXEを先に試す設定のPCでは、Secure Bootの更新のあと起動のたびにBitLockerが回復モードに入ることがある。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-troubleshooting-guide> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "context-dependent" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/recovery-key/> ;
    rdf:predicate ks:verifiedBy ;
    rdf:object <https://comcomponent.com/knowledge/manage-bde/> ;
    schema:description "manage-bde -protectors -getはドライブで有効な保護方法の種類とIDを表示し、KB5025885はこのコマンドで表示される48桁の回復パスワードを控えるよう案内している。PCの外に控えがあるかは、このコマンドでは分からない。"@ja ;
    ks:evidence <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors>, <https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023> ;
    ks:verifiedAt "2026-10-31" ;
    ks:certainty "established" .

[] a rdf:Statement ;
    rdf:subject <https://comcomponent.com/knowledge/audit-mode/> ;
    rdf:predicate ks:recommendedFor ;
    rdf:object <https://comcomponent.com/knowledge/app-control-for-business/> ;
    schema:description "PCA 2011を名指しした規則を持つApp Control for Businessのポリシーは更新後のバイナリをブロックしうるので、ポリシーの変更はまず監査モードで配って確かめる。"@ja ;
    ks:evidence <https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/10/kb5132953-windows-production-ca-2011-expiration-bootloader-updates> ;
    ks:verifiedAt "2026-10-30" ;
    ks:certainty "established" .