Applies To
Windows Server, version 23H2

Windows Secure Boot certificate expiration 

Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.

Summary

This update makes improvements to the Windows recovery environment (WinRE).

How to get this update

Install this update

To install this update, use one of the following release channels.

Available

Next step

Available

This update is available through Windows Update. It will be downloaded and installed automatically.

Prerequisites

There are no prerequisites to apply this update.

Restart information

You do not have to restart your device after you apply this update.

Removal information

This update cannot be removed once it is applied to a Windows image.

Update replacement information

This update replaces the previously released update KB5073449.

Verify the installation of this update

After installing this update, the WinRE version installed on the device should be 10.0.25398.2141.

To get the version of WinRE installed, run the following PowerShell script "GetWinReVersion.ps1" with Administrator credentials. After you run the script, you should receive the installed WinRE version as in the following example:

GetWinReVersion.ps1 PowerShell script

################################################################################################

#

# Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

# SOFTWARE.

#

################################################################################################
# Function to get WinRE path

function GetWinREPath {

    $WinRELocation = (reagentc /info | Select-String "Windows RE location")

    if ($WinRELocation) {

        return $WinRELocation.ToString().Split(':')[-1].Trim()

    } else {

        Write-Host "Failed to find WinRE path" -ForegroundColor Red

        exit 1

    }

}

 
# Creates and needs to be return the mount directory
function GetMountDir {
    # systemdirve\mnt
    $MountDir = "$env:SystemDrive\mnt"
    if (-not (Test-Path $MountDir)) {
        New-Item -ItemType Directory -Path $MountDir -Force | Out-Null
    }
    return $MountDir
}  

# Function to get WinRE version
function GetWinREVersion {

    $mountedPath = GetMountDir
    $filePath = "$mountedPath\Windows\System32\winpeshl.exe"

    $WinREVersion = (Get-Item $filePath).VersionInfo.FileVersionRaw.Revision

    return [int]$WinREVersion

}


# Main Execution

$WinREPath = GetWinREPath


# Make dir C:\mnt if not exists

$TempDir = GetMountDir


# Get the read write permission for this directory

if (-not (Test-Path $TempDir)) {

    New-Item -ItemType Directory -Path $TempDir -Force | Out-Null

}


# Mount WinRE image

dism /Mount-Image /ImageFile:"$WinREPath\winre.wim" /Index:1 /MountDir:"$TempDir"


$WinREVersion = GetWinREVersion

Write-Host "WinRE Version: $WinREVersion" -ForegroundColor Cyan

dism /Unmount-Image /MountDir:"$TempDir" /Discard

Remove-Item -Path $TempDir -Force -Recurse

File information

The English (United States) version of this software update installs files that have the following attributes. This update might contain files for additional languages.

File name

File version

Date

Time

File size

usb.inf

Not versioned

17-Jan-26

15:05

41,432

usbccgp.sys

10.0.25398.2141

17-Jan-26

15:05

226,720

usbhub3.inf

Not versioned

17-Jan-26

15:05

11,296

USBHUB3.SYS

10.0.25398.2141

17-Jan-26

15:05

722,376

usbport.inf

Not versioned

17-Jan-26

15:05

77,436

usbohci.sys

10.0.25398.2141

17-Jan-26

15:05

69,632

usbport.sys

10.0.25398.2141

17-Jan-26

15:05

505,248

usbhub.sys

10.0.25398.2141

17-Jan-26

15:05

558,496

usbehci.sys

10.0.25398.2141

17-Jan-26

15:05

120,224

usbuhci.sys

10.0.25398.2141

17-Jan-26

15:05

73,728

usbd.sys

10.0.25398.2141

17-Jan-26

15:05

71,112

skci.dll

10.0.25398.2141

17-Jan-26

15:05

336,160

iumbase.dll

10.0.25398.2141

17-Jan-26

15:05

46,944

iumdll.dll

10.0.25398.2141

17-Jan-26

15:05

38,680

tprtdll.dll

10.0.25398.2141

17-Jan-26

15:05

249,408

vertdll.dll

10.0.25398.2141

17-Jan-26

15:05

212,264

ucrtbase_enclave.dll

10.0.25398.2141

17-Jan-26

15:05

546,952

securekernel.exe

10.0.25398.2141

17-Jan-26

15:05

1,226,144

VbsSiPolicy.p7b

Not versioned

17-Jan-26

15:05

81,434

bootmgfw.efi

10.0.25398.2141

17-Jan-26

15:05

2,656,712

bootmgfw_EX.efi

10.0.26100.30212

17-Jan-26

15:05

2,830,632

SecureBootRecovery.efi

Not versioned

17-Jan-26

15:05

162,688

bootmgr.efi

10.0.25398.2141

17-Jan-26

15:05

2,640,288

bootmgr_EX.efi

10.0.26100.30212

17-Jan-26

15:05

2,818,464

boot.stl

Not versioned

17-Jan-26

15:05

11,030

winsipolicy.p7b

Not versioned

17-Jan-26

15:05

10,341

winload.exe

10.0.25398.2141

17-Jan-26

15:05

1,717,528

winload.efi

10.0.25398.2141

17-Jan-26

15:05

3,075,384

bcrypt.dll

10.0.25398.2141

17-Jan-26

15:05

170,904

bcryptprimitives.dll

10.0.25398.2141

17-Jan-26

15:05

563,440

BootMenuUX.dll

10.0.25398.2141

17-Jan-26

15:05

225,280

driversipolicy.p7b

Not versioned

17-Jan-26

15:05

229,162

cng.sys

10.0.25398.2141

17-Jan-26

15:05

840,304

ci.dll

10.0.25398.2141

17-Jan-26

15:05

1,059,256

driver.stl

Not versioned

17-Jan-26

15:05

33,360

cryptbase.dll

10.0.25398.2141

17-Jan-26

15:05

59,376

cryptsp.dll

10.0.25398.2141

17-Jan-26

15:05

121,320

cmi2migxml.dll

10.0.25398.2141

17-Jan-26

15:05

222,624

csiagent.dll

10.0.25398.2141

17-Jan-26

15:05

714,144

diagER.dll

10.0.25398.2141

17-Jan-26

15:05

95,648

hwcompat.dll

10.0.25398.2141

17-Jan-26

15:05

239,048

hwcompat.txt

Not versioned

17-Jan-26

15:05

969,192

hwexclude.txt

Not versioned

17-Jan-26

15:05

51

icbexclusion.inf

Not versioned

17-Jan-26

15:05

7,222

migapp.xml

Not versioned

17-Jan-26

15:05

654,548

migcore.dll

10.0.25398.2141

17-Jan-26

15:05

9,270,728

mighost.exe

10.0.25398.2141

17-Jan-26

15:05

284,104

migres.dll

10.0.25398.2141

17-Jan-26

15:05

26,016

migisol.dll

10.0.25398.2141

17-Jan-26

15:05

144,800

migstore.dll

10.0.25398.2141

17-Jan-26

15:05

1,295,776

migsys.dll

10.0.25398.2141

17-Jan-26

15:05

460,192

MXEAgent.dll

10.0.25398.2141

17-Jan-26

15:05

386,504

AppExtAgent.dll

10.0.25398.2141

17-Jan-26

15:05

484,768

offline.xml

Not versioned

17-Jan-26

15:05

41,994

oscomps.xml

Not versioned

17-Jan-26

15:05

449,323

oscomps.woa.xml

Not versioned

17-Jan-26

15:05

249,101

osfilter.inf

Not versioned

17-Jan-26

15:05

21,299

pnppropmig.dll

10.0.25398.2141

17-Jan-26

15:05

103,840

ReserveManager.dll

10.0.25398.2141

17-Jan-26

15:05

308,680

setupplatform.cfg

Not versioned

17-Jan-26

15:05

12,571

setupplatform.dll

1.80.25398.2141

17-Jan-26

15:05

9,213,384

setupplatform.exe

1.80.25398.2141

17-Jan-26

15:05

243,104

SFCN.dat

Not versioned

17-Jan-26

15:05

1,824

SFLCID.dat

Not versioned

17-Jan-26

15:05

1,644

SFLISTW7.dat

Not versioned

17-Jan-26

15:05

1,703,368

SFLISTW8.dat

Not versioned

17-Jan-26

15:05

2,608,858

SFLISTWB.dat

Not versioned

17-Jan-26

15:05

3,172,904

SFLISTWT.dat

Not versioned

17-Jan-26

15:05

4,935,402

sflistw8.woa.dat

Not versioned

17-Jan-26

15:05

954,436

SFLISTRS1.dat

Not versioned

17-Jan-26

15:05

5,593,182

sflistwb.woa.dat

Not versioned

17-Jan-26

15:05

1,150,134

sflistwt.woa.dat

Not versioned

17-Jan-26

15:05

2,636,814

SFPAT.inf

Not versioned

17-Jan-26

15:05

11,602

SFPATW7.inf

Not versioned

17-Jan-26

15:05

17,396

SFPATW8.inf

Not versioned

17-Jan-26

15:05

79,818

SFPATWB.inf

Not versioned

17-Jan-26

15:05

91,635

SFPATWT.inf

Not versioned

17-Jan-26

15:05

165,729

SFPATRS1.inf

Not versioned

17-Jan-26

15:05

169,730

unbcl.dll

10.0.25398.2141

17-Jan-26

15:05

1,082,784

upgradeagent.dll

10.0.25398.2141

17-Jan-26

15:05

3,306,952

upgradeagent.xml

Not versioned

17-Jan-26

15:05

70,907

upgrade_comp.xml

Not versioned

17-Jan-26

15:05

6,054

upgrade_bulk.xml

Not versioned

17-Jan-26

15:05

211,085

upgrade_data.xml

Not versioned

17-Jan-26

15:05

41,750

upgrade_frmwrk.xml

Not versioned

17-Jan-26

15:05

18,785

upgWow_bulk.xml

Not versioned

17-Jan-26

15:05

114,707

uninstall.xml

Not versioned

17-Jan-26

15:05

4,639

uninstall_data.xml

Not versioned

17-Jan-26

15:05

11,122

wdsutil.dll

10.0.25398.2141

17-Jan-26

15:05

349,600

WinSetupMon.hiv

Not versioned

17-Jan-26

15:05

8,192

WinSetupMon.sys

10.0.25398.2141

17-Jan-26

15:05

132,536

iertutil.dll

11.0.25398.2141

17-Jan-26

15:05

2,860,808

msIso.dll

11.0.25398.2141

17-Jan-26

15:05

278,528

edgeIso.dll

11.0.25398.2141

17-Jan-26

15:05

434,176

kernel32.dll

10.0.25398.2141

17-Jan-26

15:05

811,360

KernelBase.dll

10.0.25398.2141

17-Jan-26

15:05

3,505,424

dxgkrnl.sys

10.0.25398.2141

17-Jan-26

15:05

4,863,392

cdd.dll

10.0.25398.2141

17-Jan-26

15:05

311,296

dxgmms1.sys

10.0.25398.2141

17-Jan-26

15:05

529,824

dxgmms2.sys

10.0.25398.2141

17-Jan-26

15:05

1,172,896

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

114,176

dxgmms2.sys.mui

10.0.25398.2141

17-Jan-26

15:05

5,120

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

115,200

dxgmms2.sys.mui

10.0.25398.2141

17-Jan-26

15:05

5,632

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

115,712

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

112,640

dxgmms2.sys.mui

10.0.25398.2141

17-Jan-26

15:05

4,608

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

112,128

dxgkrnl.sys.mui

10.0.25398.2141

17-Jan-26

15:05

111,616

msasn1.dll

10.0.25398.2141

17-Jan-26

15:05

84,128

msvcrt.dll

7.0.25398.2141

17-Jan-26

15:05

687,400

netio.sys

10.0.25398.2141

17-Jan-26

15:05

669,128

ntdll.dll

10.0.25398.2141

17-Jan-26

15:05

2,265,824

windows.storage.dll

10.0.25398.2141

17-Jan-26

15:05

8,575,400

ntoskrnl.exe

10.0.25398.2141

17-Jan-26

15:05

12,694,944

ntkrla57.exe

10.0.25398.2141

17-Jan-26

15:05

11,457,992

rpcrt4.dll

10.0.25398.2141

17-Jan-26

15:05

1,208,072

diagtrack.dll

10.0.10586.0

17-Jan-26

15:05

1,365,856

diagtrackrunner.exe

10.0.10586.0

17-Jan-26

15:05

88,256

reagent.admx

Not versioned

17-Jan-26

15:05

1,240

reagent.dll

10.0.25398.2141

17-Jan-26

15:05

603,592

reagent.xml

Not versioned

17-Jan-26

15:05

837

SetupPlatform.cfg

Not versioned

17-Jan-26

15:05

19,051

wdscore.dll

10.0.25398.2141

17-Jan-26

15:05

275,912

wdsclientapi.dll

10.0.25398.2141

17-Jan-26

15:05

268,704

wdscsl.dll

10.0.25398.2141

17-Jan-26

15:05

79,264

wdsimage.dll

10.0.25398.2141

17-Jan-26

15:05

125,304

wdstptc.dll

10.0.25398.2141

17-Jan-26

15:05

186,744

fvevol.sys

10.0.25398.2141

17-Jan-26

15:05

898,504

dumpfve.sys

10.0.25398.2141

17-Jan-26

15:05

146,088

KerbClientShared.dll

10.0.25398.2141

17-Jan-26

15:05

249,408

sechost.dll

10.0.25398.2141

17-Jan-26

15:05

691,536

fveapibase.dll

10.0.25398.2141

17-Jan-26

15:05

507,904

fveapi.dll

10.0.25398.2141

17-Jan-26

15:05

1,097,728

kerberos.dll

10.0.25398.2141

17-Jan-26

15:05

1,175,552

kerb3961.dll

10.0.25398.2141

17-Jan-26

15:05

175,032

NtlmShared.dll

10.0.25398.2141

17-Jan-26

15:05

104,832

schannel.dll

10.0.25398.2141

17-Jan-26

15:05

688,128

ResetEngine.dll

10.0.25398.2141

17-Jan-26

15:05

2,766,240

ResetTelemetry.dll

10.0.25398.2141

17-Jan-26

15:05

566,728

ResetEngine.exe

10.0.25398.2141

17-Jan-26

15:05

38,304

ResetPluginHost.exe

10.0.25398.2141

17-Jan-26

15:05

53,248

srms.dat

Not versioned

17-Jan-26

15:05

60,267

sysreset.exe

10.0.25398.2141

17-Jan-26

15:05

479,232

ResetEngOnline.dll

10.0.25398.2141

17-Jan-26

15:05

208,896

SysResetErr.exe

10.0.25398.2141

17-Jan-26

15:05

71,112

tcpip.sys

10.0.25398.2141

17-Jan-26

15:05

3,319,200

FWPKCLNT.SYS

10.0.25398.2141

17-Jan-26

15:05

570,784

tcpipreg.sys

10.0.25398.2141

17-Jan-26

15:05

81,920

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

233,472

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

234,496

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

228,864

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

235,008

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

236,544

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

232,448

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

219,648

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

218,112

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

232,960

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

230,912

tcpip.sys.mui

10.0.25398.2141

17-Jan-26

15:05

215,040

tbs.dll

10.0.25398.2141

17-Jan-26

15:05

104,792

tbs.sys

10.0.25398.2141

17-Jan-26

15:05

75,168

ucrtbase.dll

10.0.25398.2141

17-Jan-26

15:05

1,129,520

msvcp_win.dll

10.0.25398.2141

17-Jan-26

15:05

650,256

nsi.dll

10.0.25398.2141

17-Jan-26

15:05

46,944

winnsi.dll

10.0.25398.2141

17-Jan-26

15:05

63,448

nsisvc.dll

10.0.25398.2141

17-Jan-26

15:05

57,344

nsiproxy.sys

10.0.25398.2141

17-Jan-26

15:05

77,824

ws2_32.dll

10.0.25398.2141

17-Jan-26

15:05

484,936

win32u.dll

10.0.25398.2141

17-Jan-26

15:05

170,904

win32k.sys

10.0.25398.2141

17-Jan-26

15:05

704,512

win32kfull.sys

10.0.25398.2141

17-Jan-26

15:05

4,182,016

win32kbase.sys

10.0.25398.2141

17-Jan-26

15:05

3,387,392

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

22,016

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

23,552

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

21,504

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

24,064

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

23,040

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

18,432

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

17,920

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

15,872

win32kbase.sys.mui

10.0.25398.2141

17-Jan-26

15:05

16,384

win32ksgd.sys

10.0.25398.2141

17-Jan-26

15:05

98,304

WindowsCodecs.dll

10.0.25398.2141

17-Jan-26

15:05

2,278,200

winpeshl.exe

10.0.25398.2141

17-Jan-26

15:05

90,112

wpeutil.dll

10.0.25398.2141

17-Jan-26

15:05

155,648

wpeutil.exe

10.0.25398.2141

17-Jan-26

15:05

36,864

wpeinit.exe

10.0.25398.2141

17-Jan-26

15:05

57,344

startnet.cmd

Not versioned

17-Jan-26

15:05

9

ReAgent.dll

10.0.25398.2141

17-Jan-26

15:05

603,552

ReInfo.dll

10.0.25398.2141

17-Jan-26

15:05

61,440

StartRep.exe

10.0.25398.2141

17-Jan-26

15:05

663,552

RecEnv.exe

10.0.25398.2141

17-Jan-26

15:05

415,136

BootRec.exe

10.0.25398.2141

17-Jan-26

15:05

180,224

winsqlite3.dll

3.51.1.0

17-Jan-26

15:05

1,074,992

bcrypt.dll

10.0.25398.2141

17-Jan-26

15:05

101,800

bcryptprimitives.dll

10.0.25398.2141

17-Jan-26

15:05

424,632

cryptbase.dll

10.0.25398.2141

17-Jan-26

15:05

33,232

cryptsp.dll

10.0.25398.2141

17-Jan-26

15:05

84,272

iertutil.dll

11.0.25398.2141

17-Jan-26

15:05

2,319,184

msIso.dll

11.0.25398.2141

17-Jan-26

15:05

205,824

edgeIso.dll

11.0.25398.2141

17-Jan-26

15:05

373,248

kernel32.dll

10.0.25398.2141

17-Jan-26

15:05

675,024

KernelBase.dll

10.0.25398.2141

17-Jan-26

15:05

2,609,952

msasn1.dll

10.0.25398.2141

17-Jan-26

15:05

52,280

msvcrt.dll

7.0.25398.2141

17-Jan-26

15:05

799,624

ntdll.dll

10.0.25398.2141

17-Jan-26

15:05

1,749,032

windows.storage.dll

10.0.25398.2141

17-Jan-26

15:05

7,017,768

rpcrt4.dll

10.0.25398.2141

17-Jan-26

15:05

760,328

KerbClientShared.dll

10.0.25398.2141

17-Jan-26

15:05

159,200

sechost.dll

10.0.25398.2141

17-Jan-26

15:05

536,232

fveapibase.dll

10.0.25398.2141

17-Jan-26

15:05

426,496

fveapi.dll

10.0.25398.2141

17-Jan-26

15:05

883,712

kerberos.dll

10.0.25398.2141

17-Jan-26

15:05

873,472

kerb3961.dll

10.0.25398.2141

17-Jan-26

15:05

110,568

NtlmShared.dll

10.0.25398.2141

17-Jan-26

15:05

64,640

schannel.dll

10.0.25398.2141

17-Jan-26

15:05

534,016

tbs.dll

10.0.25398.2141

17-Jan-26

15:05

71,408

ucrtbase.dll

10.0.25398.2141

17-Jan-26

15:05

1,181,816

msvcp_win.dll

10.0.25398.2141

17-Jan-26

15:05

507,312

nsi.dll

10.0.25398.2141

17-Jan-26

15:05

21,784

winnsi.dll

10.0.25398.2141

17-Jan-26

15:05

31,120

ws2_32.dll

10.0.25398.2141

17-Jan-26

15:05

391,064

win32u.dll

10.0.25398.2141

17-Jan-26

15:05

103,912

WindowsCodecs.dll

10.0.25398.2141

17-Jan-26

15:05

1,953,408

ReAgent.dll

10.0.25398.2141

17-Jan-26

15:05

519,624

ReInfo.dll

10.0.25398.2141

17-Jan-26

15:05

30,720

winsqlite3.dll

3.51.1.0

17-Jan-26

15:05

889,648

wdsnbp.com

Not versioned

17-Jan-26

15:05

30,832

abortpxe.com

Not versioned

17-Jan-26

15:05

79

bootmgr.exe

10.0.25398.2141

17-Jan-26

15:05

742,816

pxeboot.com

Not versioned

17-Jan-26

15:05

25,254

pxeboot.n12

Not versioned

17-Jan-26

15:05

25,238

hdlscom1.com

Not versioned

17-Jan-26

15:05

25,662

hdlscom2.com

Not versioned

17-Jan-26

15:05

25,662

hdlscom1.n12

Not versioned

17-Jan-26

15:05

25,646

hdlscom2.n12

Not versioned

17-Jan-26

15:05

25,646

bootmgfw.efi

10.0.25398.2141

17-Jan-26

15:05

2,241,952

bootmgfw_EX.efi

10.0.26100.30212

17-Jan-26

15:05

2,376,464​​​​​​​

References

Description of the standard terminology that is used to describe Microsoft software updates

Query words: safeos du

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.