Prepare the restart and feature checks for a Secured-core server change

Source facts

Secured-core combines security capabilities across hardware, firmware, drivers, and the operating system. Microsoft lists requirements including Secure Boot, TPM 2.0, relevant firmware protections, and processor virtualization capabilities. In Windows Admin Center, the documented workflow enables unconfigured security features and schedules a restart to retain the changes. Microsoft documentation.

Applicability

Use this review when planning a Secured-core configuration change on Windows Server. Check the exact hardware and firmware prerequisites in the current documentation. Identify the server workload and its permitted restart window before enabling features.

DSE recommendation

Have the server and hardware owners jointly review readiness. Record which features are already configured and which will change, including any prerequisite that remains unresolved. Coordinate the restart with the workload owner and preserve a supported recovery route. Pilot the change on an appropriate representative server, with named reviewers for hardware status and application acceptance.

Verification

After the planned restart, compare feature states with the approved change record. Examine reported device problems and test the workload functions selected in advance. Record the actual restart and acceptance times. Treat a feature that remains unconfigured or a workload failure as an open result requiring investigation before expanding the rollout.

Official references

Microsoft Learn: Configure Secured-core server for Windows Server. Source reviewed September 8, 2026.