Windows 11’s new SecureBoot folder is not malware and you should not delete it

A new SecureBoot folder has appeared on some Windows 11 PCs after Microsoft’s May update, but it is not malware. The folder is part of Microsoft’s preparation for upcoming Secure Boot certificate changes, and it is mainly meant for IT administrators who manage many Windows devices at once.

The folder appears under C:\Windows\SecureBoot after installing the May Windows 11 update, KB5089549. Some people noticed it because it appeared suddenly inside the Windows system directory, which naturally raised questions. A new folder in such a sensitive location can look suspicious, especially when users are already dealing with update problems and security warnings.

The SecureBoot folder contains scripts for certificate update management

Microsoft says the folder contains example scripts for organizations that need to check and deploy Secure Boot certificate updates across many PCs. These scripts can help IT teams detect whether a device has received the needed certificate update and automate the rollout in an Active Directory environment.

For home users, this means the folder is not something you need to open, run, edit, or manage. It is simply part of the Windows update package. It does not mean your PC has been infected, and it does not mean Secure Boot has been turned off.

The timing is important because some Windows Secure Boot certificates are expiring in June. Secure Boot helps protect your PC during startup by checking that trusted software loads before Windows starts. If certificate updates are not handled properly, older systems may lose Secure Boot support, which could make them more exposed to certain types of malware or boot level attacks.

The folder is mainly useful for companies, schools, and other organizations where IT staff need to manage updates across many devices. In those environments, automated scripts can help confirm certificate status and reduce the risk of machines missing important Secure Boot updates.

For normal home PCs, the safest thing to do is leave the folder alone. You do not need to delete it to free space, and removing it is not recommended. Windows Latest has warned that deleting the folder could cause problems with future Windows updates if the update process expects to find it and it is missing.

The new folder also appears during a messy period for Windows updates. The same May update is reportedly failing to install on some systems, while another Windows 11 issue has blocked updates for some users since February. That may make any new system folder feel more concerning, but this specific SecureBoot folder has a clear purpose.

The simple answer is that the SecureBoot folder is legitimate. It is connected to Microsoft’s Secure Boot certificate transition, and it is mostly there for managed business devices. If you see it on your Windows 11 PC, do not panic and do not delete it. Keep Windows Update running normally so your system can receive the certificate updates it needs before the June change.