Note
- Windows Secure Boot certificate expiration
- Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the past months. Devices that haven’t received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. We will continue to install the newer certificates via Windows updates in the coming months.
- You can check your PC status on the Windows Security app. If you are an IT administrator, follow the guidance on the Secure Boot Playbook for Windows clients and Windows Server.
Note
IMPORTANT This update will not be offered if your Windows Recovery Environment (WinRE) meets any of the following conditions:
- If the WinRE recovery partition does not have sufficient free space, see the NOTE in the "Summary" section. The note provides instructions about how to increase the available free space in the WinRE recovery partition.
- If the WinRE recovery partition was manually updated by using the procedure in Add an update package to Windows RE and is already up to date.
- If the WinRE image has a version greater than or equal to version 10.0.20348.5017. To determine the version of your WinRE image, see the "Methods to verify the WinRE version installed" section.
- If your running PC does not have a WinRE recovery partition. To verify if you have WinRE enabled, run the following command in an elevated command prompt: reagentc /info. If WinRE is enabled, you will see Windows RE status in the output with a value of Enabled. In this scenario, this update might be needed.
Summary
This update automatically applies Safe OS Dynamic Update (KB5082243) to the Windows Recovery Environment (WinRE) on a running PC. The update installs improvements to Windows recovery features.
| NOTE This update requires 250 MB of free space in the recovery partition to install successfully. If you would like to make sure your device is offered this update, please follow the Instructions to manually resize your partition or use a sample script to increase the size of the WinRE recovery partition. Once your partition has sufficient disk space, click Start > Settings > Windows Update > Check for updates to have the update offered to you and then install it. |
|---|
How to get this update
This update is available through the following release channels.
| Release Channel | Available |
|---|---|
| Windows Update | Yes |
| Microsoft Update Catalog | No |
| Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager | No |
More information about this update
| Prerequisites | The PC must have 250 MB of free space in the recovery partition to apply this update successfully. |
|---|---|
| Restart information | You do not need to restart your device after applying this update. |
| Removal information | This update cannot be removed once it is applied to a Windows image. |
| Update replacement information | This update replaces the previously released update KB5075040. |
| Verify the installation of this update | To determine whether this update is installed on the device, go to Settings > Windows Update > Update history. If this update is installed, you should find the following update listed:
|
| End of support |
Note
|
References
Description of the standard terminology that is used to describe Microsoft software updates