Z600 new Secure Boot Certificate

[Challenger392]

Well, I had once last ditch idea that came to mind. 

Thinking about how Win11 25H2 had been booting properly up until these two updates were applied, I thought, what would happen if I was able to image the System Partition (BOOT) from a known working parition and over write the non working or bad partition on the drive that was no longer booting past post. 

Remember I took a image of the Win11 drive before 4-2026 or 5-2026 was applied. 
I've been using Macrium SW for past few years now. LOVE THIS SW.

I installed the bad drive in a USB caddy on my z640 PC and were I have the working z600 image stored. 

Macrium allows to custom restore options. Opened the working image and was allowed to just copy the SYSTEM partition to the bad drive and over write the partition there. Didn't touch the Windows partition. I did the same for the Recovery partition as I noticed there was a size difference between the image partition and the bad non working drive. 

Took seconds for the partitions to be imaged. 

Close the app and ejected the bad working drive. 

Installed the bad working drive, the one new SSD drive out of the box I tested earlier, back in the z600. 

Powered ON and BOOM, it booted past the BIOS screen and started from what I guess the last portion of the 5.2026 security update. Didn't give any percentage. Took about 1 minute maybe. 

Then the log in screen appeared. 

Wow. 

I checked the update history and saw the 5-2026 security update listed. Did not see the 4-2026 preview update. 

Kind of points to these two updates breaking the System and or Recovery Partitions on a non UEFI/GPT PC. As what ever they are doing, breaks the boot loading at the BIOS screen. 

Thoughts? 

I'm going to do some more update checking to see if anything else stands out or happens. 

[Paul_Tikkanen]

That's great news. 

I don't have a non-UEFI system to experiment with just now, but your theory may be possible. 

As I wrote yesterday Windows 11 25H2 works fine on my UEFI capable, non secure boot PC, and I fired it up yesterday just make sure. 

So that leaves the non-UEFI system as the potential issue. 

Hopefully you found a workaround. 

[etsok]

I just updated (2) z600s from Win1124H2 Pro to Win11 25H2 Pro using an inplace upgrade via Rufus since the update does not show up when "check for updates " is run.. No issues at all, all the security and the 4/26 preview show installed.  Also upgraded another z600 to Win11 25/H2 Education, no issues either. All systems are set to MBR pretty sure the BIOS is legacy.

Paul thanks for the great work

[Paul_Tikkanen]

Anytime. 

That's great news the other upgrades went well.

[Challenger392]

Did you have the 4/26 update already installed while on 24H2 or did you do that after you got 25H2? 

Mine are instatlled post 25H2 what was applied over Win10 22H2 on this one z600. 

Both 4-2026 and 5-2026 cause the boot process to fail. Only way I can get around this is to apply a clean saved working image back to these two partitions and then the drive boots correctly. 

Which 25H2 build did you use with RUFUS?

ALso did you have the Cert 2023 check or uncheck on the RUFUS app? 

Yes BIOS is Legacy that doesnt' support UEFI, Secure Boot and GPT formats. 

[Paul_Tikkanen]

All of my PCs were updated to W11 25H2 from 24H2 just by running the W11 25H2 enablement package which I downloaded from the Microsoft Update Catalog.

This works on unsupported PCs as well.  Just run the file and bingo, W11 25H2 in minutes.

KB5054156: Feature update to Windows 11, version 25H2 by using an enablement package - Microsoft Sup...

I just needed to make sure the PC's were up to date with all W11 24H2 security and cumulative updates through August, I believe.

W11 26H2 is supposed to be handled the same way, so it will be very easy to upgrade your fleet to 26H2.

When doing in-place upgrades from W10>W11, I don't use Rufus.

I used the easy method in this video:

How to Install Windows 11 25H2 on Unsupported PCs (New Easiest Method)

I used it for many W11 build updates until the 24H2>25H2 update using the 25H2 enablement package.

I use Rufus for clean installs only.

The last time I used Rufus to do a clean install a few years ago, there was no option to select Cert 2023 checks.

[Challenger392]

@Etsok

Did you have the 4/26 update already installed while on 24H2 or did you do that after you got 25H2? 

Mine are instatlled post 25H2 what was applied over Win10 22H2 on this one z600. 

Both 4-2026 and 5-2026 cause the boot process to fail. Only way I can get around this is to apply a clean saved working image back to these two partitions and then the drive boots correctly. 

Which 25H2 build did you use with RUFUS?

ALso did you have the Cert 2023 check or uncheck on the RUFUS app? 

Yes BIOS is Legacy that doesnt' support UEFI, Secure Boot and GPT formats. 

[Challenger392]

@Paul_Tikkanen

Wondering if applying Win11 over Win10 maybe a factor here. 

Though the installation of 25H2 over Win10 works. Its just when these updates start coming down does something break the boot process. No idea why. 

[Paul_Tikkanen]

I have an idea...

Make a bootable USB installation flash drive with Rufus to do an in-place upgrade from W10>W11 24H2, or use the method in the video I posted.

You can download the W11 24H2 ISO file from the link below.

Win11 24H2 (Windows 11) : Microsoft : Free Download, Borrow, and Streaming : Internet Archive

Then do all the updates to 24H2.

Then run the 25H2 enablement package to upgrade to 25H2 and see if that works to prevent the 25H2 updates from wrecking your PC like it does when you update straight from W10>W11 25H2