Windows Secure Boot certificate expirationÂ
Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. Â
For details and preparation steps for Windows devices, see Windows Secure Boot certificate expiration and CA updates.
For details and preparation steps for Windows servers, see the following resources:
IMPORTANT This update will not be offered if your Windows Recovery Environment (WinRE) meets any of the following conditions:
-
If the WinRE recovery partition does not have sufficient free space, see the NOTE in the "Summary" section. The note provides instructions about how to increase the available free space in the WinRE recovery partition.
-
If the WinRE recovery partition was manually updated by using the procedure in Add an update package to Windows RE and is already up to date.
-
If the WinRE image has a version greater than or equal to version 10.0.20348.5017. To determine the version of your WinRE image, see the "Methods to verify the WinRE version installed" section.
-
If your running PC does not have a WinRE recovery partition. To verify if you have WinRE enabled, run the following command in an elevated command prompt: reagentc /info. If WinRE is enabled, you will see Windows RE status in the output with a value of Enabled. In this scenario, this update might be needed.
Summary
This update automatically applies Safe OS Dynamic Update (KB5082243) to the Windows Recovery Environment (WinRE) on a running PC. The update installs improvements to Windows recovery features.
|
NOTE This update requires 250 MB of free space in the recovery partition to install successfully. If you would like to make sure your device is offered this update, please follow the Instructions to manually resize your partition or use a sample script to increase the size of the WinRE recovery partition. Once your partition has sufficient disk space, click Start > Settings > Windows Update > Check for updates to have the update offered to you and then install it. |
How to get this update
This update is available through the following release channels.
|
Release Channel |
Available |
|
Windows Update |
Yes |
|
Microsoft Update Catalog |
No |
|
Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager |
No |
More information about this update
|
Prerequisites |
The PC must have 250 MB of free space in the recovery partition to apply this update successfully. |
|
Restart information |
You do not need to restart your device after applying this update. |
|
Removal information |
This update cannot be removed once it is applied to a Windows image. |
|
Update replacement information |
This update replaces the previously released update KB5075040. |
|
Verify the installation of this update |
To determine whether this update is installed on the device, go to Settings > Windows Update > Update history. If this update is installed, you should find the following update listed:
After installing this update, the WinRE version installed on the device should be greater than or equal to version 10.0.20348.5017. To find the WinRE version installed, see Methods to verify the WinRE version installed. |
|
End of support |
Support for Windows Server 2022 will end in October 2031 After October 14, 2031, Microsoft will no longer provide free software updates from Windows Update, technical assistance, or security fixes for Windows Server 2022. We recommend that you upgrade to a later version of Windows Server. |
References
Description of the standard terminology that is used to describe Microsoft software updates
