KB5062694: Safe OS Dynamic Update for Windows Server 2022: July 8, 2025

Applies To
Windows Server 2022

Note

  • Windows Secure Boot certificate expiration
  • Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the past months. Devices that haven’t received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. We will continue to install the newer certificates via Windows updates in the coming months.
  • You can check your PC status on the Windows Security app. If you are an IT administrator, follow the guidance on the Secure Boot Playbook for Windows clients and Windows Server.

Summary

This update makes improvements to the Windows recovery environment in Windows Server 2022.

Note This update is included in KB5063522: Windows Recovery Environment update for Windows Server 2022: July 8, 2025.

How to get this update

Install this update

To install this update, use one of the following release channels.


Available Next step
Available This update is available through Windows Update. It will be downloaded and installed automatically by Windows Recovery Environment update KB5063522.
Prerequisites There are no prerequisites to apply this update.
Restart information You do not have to restart your device after you apply this update.
Removal information This update cannot be removed once it is applied to a Windows image.
Update replacement information This update replaces the previously released update KB5060535.
Verify the installation of this update After installing this update, the WinRE version installed on the device should be 10.0.20348.3933.
Methods to verify the WinRE version installed

Run the following PowerShell script "GetWinReVersion.ps1" with Administrator credentials. After you run the script, you should receive the installed WinRE version as in the following example:

GetWinREVersion Screenshot

GetWinReVersion.ps1 PowerShell script


################################################################################################

#

# Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

# SOFTWARE.

#

################################################################################################


# Function to get WinRE path

function GetWinREPath {

    $WinRELocation = (reagentc /info | Select-String "Windows RE location")

    if ($WinRELocation) {

        return $WinRELocation.ToString().Split(':')[-1].Trim()

    } else {

        Write-Host "Failed to find WinRE path" -ForegroundColor Red

        exit 1

    }

}

 
# Creates and needs to be return the mount directory
function GetMountDir {
    # systemdirve\mnt
    $MountDir = "$env:SystemDrive\mnt"
    if (-not (Test-Path $MountDir)) {
        New-Item -ItemType Directory -Path $MountDir -Force | Out-Null
    }
    return $MountDir
}  

# Function to get WinRE version
function GetWinREVersion {

    $mountedPath = GetMountDir
    $filePath = "$mountedPath\Windows\System32\winpeshl.exe"

    $WinREVersion = (Get-Item $filePath).VersionInfo.FileVersionRaw.Revision

    return [int]$WinREVersion

}

# Main Execution

$WinREPath = GetWinREPath

# Make dir C:\mnt if not exists

$TempDir = GetMountDir

# Get the read write permission for this directory

if (-not (Test-Path $TempDir)) {

    New-Item -ItemType Directory -Path $TempDir -Force | Out-Null

}

# Mount WinRE image

dism /Mount-Image /ImageFile:"$WinREPath\winre.wim" /Index:1 /MountDir:"$TempDir"

$WinREVersion = GetWinREVersion

Write-Host "WinRE Version: $WinREVersion" -ForegroundColor Cyan

dism /Unmount-Image /MountDir:"$TempDir" /Discard

Remove-Item -Path $TempDir -Force -Recurse

File information

The English (United States) version of this software update installs files that have the following attributes. This update might contain files for additional languages.

For all supported X64-based versions
File name File version Date Time File size
skci.dll 10.0.20348.3933 5-Jul-25 2:02 315,496
conhost.exe 10.0.20348.3933 5-Jul-25 2:02 987,136
iumbase.dll 10.0.20348.3933 5-Jul-25 2:02 46,952
iumdll.dll 10.0.20348.3933 5-Jul-25 2:02 38,680
vertdll.dll 10.0.20348.3933 5-Jul-25 2:02 199,840
ucrtbase_enclave.dll 10.0.20348.3933 5-Jul-25 2:02 563,456
securekernel.exe 10.0.20348.3933 5-Jul-25 2:02 1,070,512
VbsSiPolicy.p7b Not versioned 5-Jul-25 2:02 68,351
winresume.exe 10.0.20348.3933 5-Jul-25 2:02 1,280,512
winresume.efi 10.0.20348.3933 5-Jul-25 2:02 1,954,088
winload.exe 10.0.20348.3933 5-Jul-25 2:02 1,645,176
winload.efi 10.0.20348.3933 5-Jul-25 2:02 2,395,208
bootmgfw.efi 10.0.20348.3933 5-Jul-25 2:02 2,042,272
bootmgfw_EX.efi 10.0.26100.30212 5-Jul-25 2:02 2,830,632
SecureBootRecovery.efi Not versioned 5-Jul-25 2:02 162,688
bootmgr.efi 10.0.20348.3933 5-Jul-25 2:02 2,025,904
bootmgr_EX.efi 10.0.26100.30212 5-Jul-25 2:02 2,818,464
boot.stl Not versioned 5-Jul-25 2:02 11,030
winsipolicy.p7b Not versioned 5-Jul-25 2:02 9,796
BootMenuUX.dll 10.0.20348.3933 5-Jul-25 2:02 237,568
driversipolicy.p7b Not versioned 5-Jul-25 2:02 229,162
ci.dll 10.0.20348.3933 5-Jul-25 2:02 968,384
driver.stl Not versioned 5-Jul-25 2:02 32,631
cmi2migxml.dll 10.0.20348.3933 5-Jul-25 2:02 230,840
csiagent.dll 10.0.20348.3933 5-Jul-25 2:02 718,280
diagER.dll 10.0.20348.3933 5-Jul-25 2:02 79,264
hwcompat.dll 10.0.20348.3933 5-Jul-25 2:02 251,296
hwcompat.txt Not versioned 5-Jul-25 2:02 780,048
hwexclude.txt Not versioned 5-Jul-25 2:02 51
migapp.xml Not versioned 5-Jul-25 2:02 654,548
migcore.dll 10.0.20348.3933 5-Jul-25 2:02 9,741,752
mighost.exe 10.0.20348.3933 5-Jul-25 2:02 279,968
migres.dll 10.0.20348.3933 5-Jul-25 2:02 26,016
migisol.dll 10.0.20348.3933 5-Jul-25 2:02 148,896
migstore.dll 10.0.20348.3933 5-Jul-25 2:02 1,320,376
migsys.dll 10.0.20348.3933 5-Jul-25 2:02 456,112
MXEAgent.dll 10.0.20348.3933 5-Jul-25 2:02 374,200
offline.xml Not versioned 5-Jul-25 2:02 40,820
oscomps.xml Not versioned 5-Jul-25 2:02 435,175
oscomps.woa.xml Not versioned 5-Jul-25 2:02 249,101
osfilter.inf Not versioned 5-Jul-25 2:02 21,299
pnppropmig.dll 10.0.20348.3933 5-Jul-25 2:02 103,840
reagent.dll 10.0.20348.3933 5-Jul-25 2:02 775,584
ReserveManager.dll 10.0.20348.3933 5-Jul-25 2:02 320,928
setupplatform.cfg Not versioned 5-Jul-25 2:02 6,371
setupplatform.dll 1.64.20348.3933 5-Jul-25 2:02 9,282,976
setupplatform.exe 1.64.20348.3933 5-Jul-25 2:02 202,184
SFCN.dat Not versioned 5-Jul-25 2:02 1,824
SFLCID.dat Not versioned 5-Jul-25 2:02 1,644
SFLISTW7.dat Not versioned 5-Jul-25 2:02 1,703,368
SFLISTW8.dat Not versioned 5-Jul-25 2:02 2,608,858
SFLISTWB.dat Not versioned 5-Jul-25 2:02 3,172,904
SFLISTWT.dat Not versioned 5-Jul-25 2:02 4,935,438
sflistw8.woa.dat Not versioned 5-Jul-25 2:02 954,436
SFLISTRS1.dat Not versioned 5-Jul-25 2:02 5,593,408
sflistwb.woa.dat Not versioned 5-Jul-25 2:02 1,150,134
sflistwt.woa.dat Not versioned 5-Jul-25 2:02 2,636,850
SFPAT.inf Not versioned 5-Jul-25 2:02 11,602
SFPATW7.inf Not versioned 5-Jul-25 2:02 17,396
SFPATW8.inf Not versioned 5-Jul-25 2:02 79,818
SFPATWB.inf Not versioned 5-Jul-25 2:02 91,635
SFPATWT.inf Not versioned 5-Jul-25 2:02 165,729
SFPATRS1.inf Not versioned 5-Jul-25 2:02 169,870
unbcl.dll 10.0.20348.3933 5-Jul-25 2:02 1,205,680
upgradeagent.dll 10.0.20348.3933 5-Jul-25 2:02 3,286,472
upgradeagent.xml Not versioned 5-Jul-25 2:02 70,907
upgrade_comp.xml Not versioned 5-Jul-25 2:02 6,054
upgrade_bulk.xml Not versioned 5-Jul-25 2:02 211,052
upgrade_data.xml Not versioned 5-Jul-25 2:02 41,750
upgrade_frmwrk.xml Not versioned 5-Jul-25 2:02 18,614
upgWow_bulk.xml Not versioned 5-Jul-25 2:02 114,963
uninstall.xml Not versioned 5-Jul-25 2:02 4,407
uninstall_data.xml Not versioned 5-Jul-25 2:02 11,122
wdsutil.dll 10.0.20348.3933 5-Jul-25 2:02 353,720
ClipSp.sys 10.0.20348.3933 5-Jul-25 2:02 1,127,840
lsasrv.dll 10.0.20348.3933 5-Jul-25 2:02 1,638,400
lsaadt.dll 10.0.20348.3933 5-Jul-25 2:02 217,088
ksecpkg.sys 10.0.20348.3933 5-Jul-25 2:02 214,456
offlinelsa.dll 10.0.20348.3933 5-Jul-25 2:02 157,128
netio.sys 10.0.20348.3933 5-Jul-25 2:02 652,720
ntdll.dll 10.0.20348.3933 5-Jul-25 2:02 2,100,544
ntoskrnl.exe 10.0.20348.3933 5-Jul-25 2:02 11,597,216
ntkrla57.exe 10.0.20348.3933 5-Jul-25 2:02 11,109,832
rpcrt4.dll 10.0.20348.3933 5-Jul-25 2:02 1,187,376
diagtrack.dll 10.0.10586.0 5-Jul-25 2:02 1,365,856
diagtrackrunner.exe 10.0.10586.0 5-Jul-25 2:02 88,256
reagent.admx Not versioned 5-Jul-25 2:02 1,240
reagent.xml Not versioned 5-Jul-25 2:02 837
SetupPlatform.cfg Not versioned 5-Jul-25 2:02 11,803
wdsclientapi.dll 10.0.20348.3933 5-Jul-25 2:02 334,200
wdscore.dll 10.0.20348.3933 5-Jul-25 2:02 279,992
wdscsl.dll 10.0.20348.3933 5-Jul-25 2:02 91,576
wdsimage.dll 10.0.20348.3933 5-Jul-25 2:02 1,038,752
wdstptc.dll 10.0.20348.3933 5-Jul-25 2:02 727,416
fvevol.sys 10.0.20348.3933 5-Jul-25 2:02 865,720
dumpfve.sys 10.0.20348.3933 5-Jul-25 2:02 129,560
fveapibase.dll 10.0.20348.3933 5-Jul-25 2:02 450,560
fveapi.dll 10.0.20348.3933 5-Jul-25 2:02 1,093,632
schannel.dll 10.0.20348.3933 5-Jul-25 2:02 667,648
ResetEngine.dll 10.0.20348.3933 5-Jul-25 2:02 2,299,296
ResetEngine.exe 10.0.20348.3933 5-Jul-25 2:02 38,304
ResetPluginHost.exe 10.0.20348.3933 5-Jul-25 2:02 53,248
reseteng.dll 10.0.20348.3933 5-Jul-25 2:02 688,128
resetengmig.dll 10.0.20348.3933 5-Jul-25 2:02 106,496
srms.dat Not versioned 5-Jul-25 2:02 59,554
srms62.dat Not versioned 5-Jul-25 2:02 22,841
sysreset.exe 10.0.20348.3933 5-Jul-25 2:02 372,736
systemreset.exe 10.0.20348.3933 5-Jul-25 2:02 538,640
ResetEngOnline.dll 10.0.20348.3933 5-Jul-25 2:02 221,184
SysResetErr.exe 10.0.20348.3933 5-Jul-25 2:02 71,072
tcpip.sys 10.0.20348.3933 5-Jul-25 2:02 3,216,824
FWPKCLNT.SYS 10.0.20348.3933 5-Jul-25 2:02 542,136
tcpipreg.sys 10.0.20348.3933 5-Jul-25 2:02 77,824
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 207,872
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 212,992
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 209,920
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 209,408
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 210,944
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 211,968
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 206,336
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 205,312
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 211,456
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 200,704
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 200,192
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 208,384
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 208,896
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 207,360
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 210,432
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 198,144
tcpip.sys.mui 10.0.20348.3933 5-Jul-25 2:02 198,656
winpeshl.exe 10.0.20348.3933 5-Jul-25 2:02 53,248
wpeutil.dll 10.0.20348.3933 5-Jul-25 2:02 159,744
wpeutil.exe 10.0.20348.3933 5-Jul-25 2:02 32,768
wpeinit.exe 10.0.20348.3933 5-Jul-25 2:02 57,344
startnet.cmd Not versioned 5-Jul-25 2:02 9
ReInfo.dll 10.0.20348.3933 5-Jul-25 2:02 98,304
StartRep.exe 10.0.20348.3933 5-Jul-25 2:02 663,552
RecEnv.exe 10.0.20348.3933 5-Jul-25 2:02 423,328
BootRec.exe 10.0.20348.3933 5-Jul-25 2:02 200,704
offlinelsa.dll 10.0.20348.3933 5-Jul-25 2:02 118,192
ntdll.dll 10.0.20348.3933 5-Jul-25 2:02 1,719,096
rpcrt4.dll 10.0.20348.3933 5-Jul-25 2:02 760,848
fveapibase.dll 10.0.20348.3933 5-Jul-25 2:02 365,568
fveapi.dll 10.0.20348.3933 5-Jul-25 2:02 842,240
schannel.dll 10.0.20348.3933 5-Jul-25 2:02 525,824
ReAgent.dll 10.0.20348.3933 5-Jul-25 2:02 648,608
ReInfo.dll 10.0.20348.3933 5-Jul-25 2:02 64,512
wdsnbp.com Not versioned 5-Jul-25 2:02 30,832
abortpxe.com Not versioned 5-Jul-25 2:02 79
bootmgr.exe 10.0.20348.3933 5-Jul-25 2:02 721,848
pxeboot.com Not versioned 5-Jul-25 2:02 25,358
pxeboot.n12 Not versioned 5-Jul-25 2:02 25,358
hdlscom1.com Not versioned 5-Jul-25 2:02 25,662
hdlscom2.com Not versioned 5-Jul-25 2:02 25,662
hdlscom1.n12 Not versioned 5-Jul-25 2:02 25,646
hdlscom2.n12 Not versioned 5-Jul-25 2:02 25,646
bootmgfw.efi 10.0.20348.3933 5-Jul-25 2:02 1,385,928
bootmgfw_EX.efi 10.0.26100.30212 5-Jul-25 2:02 2,376,464

References

Description of the standard terminology that is used to describe Microsoft software updates

Query words: safeos du