Applies To
Windows Server, version 23H2

Windows Secure Boot certificate expiration 

Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.

Summary

This update makes improvements to the Windows recovery environment (WinRE) in Windows Server, version 23H2.

The following is a summary of the issues that this update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Windows Preinstallation Environment (WinPE)] New! If WinPE is unable to start an application, a message box will now be displayed instead of the debug command prompt that previously appeared.

How to get this update

Install this update

To install this update, use one of the following release channels.

Available

Next step

Available

This update is available through Windows Update. It will be downloaded and installed automatically.

Prerequisites

There are no prerequisites to apply this update.

Restart information

You do not have to restart your device after you apply this update.

Removal information

This update cannot be removed once it is applied to a Windows image.

Update replacement information

This update replaces the previously released update KB5062687.

Verify the installation of this update

After installing this update, the WinRE version installed on the device should be 10.0.25398.1913.

To get the version of WinRE installed, run the following PowerShell script "GetWinReVersion.ps1" with Administrator credentials. After you run the script, you should receive the installed WinRE version as in the following example:

GetWinReVersion.ps1 PowerShell script

################################################################################################

#

# Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

# SOFTWARE.

#

################################################################################################
# Function to get WinRE path

function GetWinREPath {

    $WinRELocation = (reagentc /info | Select-String "Windows RE location")

    if ($WinRELocation) {

        return $WinRELocation.ToString().Split(':')[-1].Trim()

    } else {

        Write-Host "Failed to find WinRE path" -ForegroundColor Red

        exit 1

    }

}

 
# Creates and needs to be return the mount directory
function GetMountDir {
    # systemdirve\mnt
    $MountDir = "$env:SystemDrive\mnt"
    if (-not (Test-Path $MountDir)) {
        New-Item -ItemType Directory -Path $MountDir -Force | Out-Null
    }
    return $MountDir
}  

# Function to get WinRE version
function GetWinREVersion {

    $mountedPath = GetMountDir
    $filePath = "$mountedPath\Windows\System32\winpeshl.exe"

    $WinREVersion = (Get-Item $filePath).VersionInfo.FileVersionRaw.Revision

    return [int]$WinREVersion

}


# Main Execution

$WinREPath = GetWinREPath


# Make dir C:\mnt if not exists

$TempDir = GetMountDir


# Get the read write permission for this directory

if (-not (Test-Path $TempDir)) {

    New-Item -ItemType Directory -Path $TempDir -Force | Out-Null

}


# Mount WinRE image

dism /Mount-Image /ImageFile:"$WinREPath\winre.wim" /Index:1 /MountDir:"$TempDir"


$WinREVersion = GetWinREVersion

Write-Host "WinRE Version: $WinREVersion" -ForegroundColor Cyan

dism /Unmount-Image /MountDir:"$TempDir" /Discard

Remove-Item -Path $TempDir -Force -Recurse

File information

The English (United States) version of this software update installs files that have the following attributes. This update might contain files for additional languages.

File name

File version

Date

Time

File size

usb.inf

Not versioned

9-Oct-25

5:42

41,432

usbccgp.sys

10.0.25398.1913

9-Oct-25

5:42

226,736

usbhub3.inf

Not versioned

9-Oct-25

5:42

11,296

USBHUB3.SYS

10.0.25398.1913

9-Oct-25

5:42

722,352

usbport.inf

Not versioned

9-Oct-25

5:42

77,436

usbohci.sys

10.0.25398.1913

9-Oct-25

5:42

69,632

usbport.sys

10.0.25398.1913

9-Oct-25

5:42

505,248

usbhub.sys

10.0.25398.1913

9-Oct-25

5:42

558,496

usbehci.sys

10.0.25398.1913

9-Oct-25

5:42

120,224

usbuhci.sys

10.0.25398.1913

9-Oct-25

5:42

73,728

usbd.sys

10.0.25398.1913

9-Oct-25

5:42

71,072

skci.dll

10.0.25398.1913

9-Oct-25

5:42

336,152

iumbase.dll

10.0.25398.1913

9-Oct-25

5:42

46,960

iumdll.dll

10.0.25398.1913

9-Oct-25

5:42

38,680

tprtdll.dll

10.0.25398.1913

9-Oct-25

5:42

249,424

vertdll.dll

10.0.25398.1913

9-Oct-25

5:42

212,216

ucrtbase_enclave.dll

10.0.25398.1913

9-Oct-25

5:42

546,912

securekernel.exe

10.0.25398.1913

9-Oct-25

5:42

1,226,144

VbsSiPolicy.p7b

Not versioned

9-Oct-25

5:42

68,351

bootmgfw.efi

10.0.25398.1913

9-Oct-25

5:42

2,658,720

bootmgfw_EX.efi

10.0.26100.30212

9-Oct-25

5:42

2,830,632

SecureBootRecovery.efi

Not versioned

9-Oct-25

5:42

162,688

bootmgr.efi

10.0.25398.1913

9-Oct-25

5:42

2,641,824

bootmgr_EX.efi

10.0.26100.30212

9-Oct-25

5:42

2,818,464

boot.stl

Not versioned

9-Oct-25

5:42

11,030

winsipolicy.p7b

Not versioned

9-Oct-25

5:42

10,341

winload.exe

10.0.25398.1913

9-Oct-25

5:42

1,718,544

winload.efi

10.0.25398.1913

9-Oct-25

5:42

3,077,512

BootMenuUX.dll

10.0.25398.1913

9-Oct-25

5:42

225,280

driversipolicy.p7b

Not versioned

9-Oct-25

5:42

229,162

ci.dll

10.0.25398.1913

9-Oct-25

5:42

1,059,272

driver.stl

Not versioned

9-Oct-25

5:42

33,360

cmi2migxml.dll

10.0.25398.1913

9-Oct-25

5:42

222,624

csiagent.dll

10.0.25398.1913

9-Oct-25

5:42

714,160

diagER.dll

10.0.25398.1913

9-Oct-25

5:42

95,648

hwcompat.dll

10.0.25398.1913

9-Oct-25

5:42

239,008

hwcompat.txt

Not versioned

9-Oct-25

5:42

969,192

hwexclude.txt

Not versioned

9-Oct-25

5:42

51

icbexclusion.inf

Not versioned

9-Oct-25

5:42

7,222

migapp.xml

Not versioned

9-Oct-25

5:42

654,548

migcore.dll

10.0.25398.1913

9-Oct-25

5:42

9,270,688

mighost.exe

10.0.25398.1913

9-Oct-25

5:42

284,080

migres.dll

10.0.25398.1913

9-Oct-25

5:42

26,016

migisol.dll

10.0.25398.1913

9-Oct-25

5:42

144,800

migstore.dll

10.0.25398.1913

9-Oct-25

5:42

1,295,776

migsys.dll

10.0.25398.1913

9-Oct-25

5:42

460,192

MXEAgent.dll

10.0.25398.1913

9-Oct-25

5:42

386,480

AppExtAgent.dll

10.0.25398.1913

9-Oct-25

5:42

484,768

offline.xml

Not versioned

9-Oct-25

5:42

41,994

oscomps.xml

Not versioned

9-Oct-25

5:42

449,323

oscomps.woa.xml

Not versioned

9-Oct-25

5:42

249,101

osfilter.inf

Not versioned

9-Oct-25

5:42

21,299

pnppropmig.dll

10.0.25398.1913

9-Oct-25

5:42

103,840

ReserveManager.dll

10.0.25398.1913

9-Oct-25

5:42

308,640

setupplatform.cfg

Not versioned

9-Oct-25

5:42

12,571

setupplatform.dll

1.80.25398.1913

9-Oct-25

5:42

9,213,360

setupplatform.exe

1.80.25398.1913

9-Oct-25

5:42

243,104

SFCN.dat

Not versioned

9-Oct-25

5:42

1,824

SFLCID.dat

Not versioned

9-Oct-25

5:42

1,644

SFLISTW7.dat

Not versioned

9-Oct-25

5:42

1,703,368

SFLISTW8.dat

Not versioned

9-Oct-25

5:42

2,608,858

SFLISTWB.dat

Not versioned

9-Oct-25

5:42

3,172,904

SFLISTWT.dat

Not versioned

9-Oct-25

5:42

4,935,402

sflistw8.woa.dat

Not versioned

9-Oct-25

5:42

954,436

SFLISTRS1.dat

Not versioned

9-Oct-25

5:42

5,593,182

sflistwb.woa.dat

Not versioned

9-Oct-25

5:42

1,150,134

sflistwt.woa.dat

Not versioned

9-Oct-25

5:42

2,636,814

SFPAT.inf

Not versioned

9-Oct-25

5:42

11,602

SFPATW7.inf

Not versioned

9-Oct-25

5:42

17,396

SFPATW8.inf

Not versioned

9-Oct-25

5:42

79,818

SFPATWB.inf

Not versioned

9-Oct-25

5:42

91,635

SFPATWT.inf

Not versioned

9-Oct-25

5:42

165,729

SFPATRS1.inf

Not versioned

9-Oct-25

5:42

169,730

unbcl.dll

10.0.25398.1913

9-Oct-25

5:42

1,082,784

upgradeagent.dll

10.0.25398.1913

9-Oct-25

5:42

3,306,928

upgradeagent.xml

Not versioned

9-Oct-25

5:42

70,907

upgrade_comp.xml

Not versioned

9-Oct-25

5:42

6,054

upgrade_bulk.xml

Not versioned

9-Oct-25

5:42

211,085

upgrade_data.xml

Not versioned

9-Oct-25

5:42

41,750

upgrade_frmwrk.xml

Not versioned

9-Oct-25

5:42

18,785

upgWow_bulk.xml

Not versioned

9-Oct-25

5:42

114,707

uninstall.xml

Not versioned

9-Oct-25

5:42

4,639

uninstall_data.xml

Not versioned

9-Oct-25

5:42

11,122

wdsutil.dll

10.0.25398.1913

9-Oct-25

5:42

349,616

WinSetupMon.hiv

Not versioned

9-Oct-25

5:42

8,192

WinSetupMon.sys

10.0.25398.1913

9-Oct-25

5:42

132,536

iertutil.dll

11.0.25398.1913

9-Oct-25

5:42

2,864,944

msIso.dll

11.0.25398.1913

9-Oct-25

5:42

278,528

edgeIso.dll

11.0.25398.1913

9-Oct-25

5:42

434,176

netio.sys

10.0.25398.1913

9-Oct-25

5:42

669,104

ntdll.dll

10.0.25398.1913

9-Oct-25

5:42

2,265,840

ntoskrnl.exe

10.0.25398.1913

9-Oct-25

5:42

12,694,944

ntkrla57.exe

10.0.25398.1913

9-Oct-25

5:42

11,457,952

diagtrack.dll

10.0.10586.0

9-Oct-25

5:42

1,365,856

diagtrackrunner.exe

10.0.10586.0

9-Oct-25

5:42

88,256

reagent.admx

Not versioned

9-Oct-25

5:42

1,240

reagent.dll

10.0.25398.1913

9-Oct-25

5:42

615,840

reagent.xml

Not versioned

9-Oct-25

5:42

837

SetupPlatform.cfg

Not versioned

9-Oct-25

5:42

19,051

wdscore.dll

10.0.25398.1913

9-Oct-25

5:42

275,872

wdsclientapi.dll

10.0.25398.1913

9-Oct-25

5:42

268,664

wdscsl.dll

10.0.25398.1913

9-Oct-25

5:42

79,264

wdsimage.dll

10.0.25398.1913

9-Oct-25

5:42

125,320

wdstptc.dll

10.0.25398.1913

9-Oct-25

5:42

186,744

fvevol.sys

10.0.25398.1913

9-Oct-25

5:42

898,464

dumpfve.sys

10.0.25398.1913

9-Oct-25

5:42

146,088

fveapibase.dll

10.0.25398.1913

9-Oct-25

5:42

507,904

fveapi.dll

10.0.25398.1913

9-Oct-25

5:42

1,097,728

tcpip.sys

10.0.25398.1913

9-Oct-25

5:42

3,319,216

FWPKCLNT.SYS

10.0.25398.1913

9-Oct-25

5:42

570,784

tcpipreg.sys

10.0.25398.1913

9-Oct-25

5:42

81,920

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

233,472

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

234,496

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

228,864

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

235,008

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

236,544

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

232,448

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

219,648

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

218,112

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

232,960

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

230,912

tcpip.sys.mui

10.0.25398.1913

9-Oct-25

5:42

215,040

WindowsCodecs.dll

10.0.25398.1913

9-Oct-25

5:42

2,224,480

winpeshl.exe

10.0.25398.1913

9-Oct-25

5:42

90,112

wpeutil.dll

10.0.25398.1913

9-Oct-25

5:42

155,648

wpeutil.exe

10.0.25398.1913

9-Oct-25

5:42

36,864

wpeinit.exe

10.0.25398.1913

9-Oct-25

5:42

57,344

startnet.cmd

Not versioned

9-Oct-25

5:42

9

ReAgent.dll

10.0.25398.1913

9-Oct-25

5:42

615,856

ReInfo.dll

10.0.25398.1913

9-Oct-25

5:42

98,304

StartRep.exe

10.0.25398.1913

9-Oct-25

5:42

663,552

RecEnv.exe

10.0.25398.1913

9-Oct-25

5:42

415,136

BootRec.exe

10.0.25398.1913

9-Oct-25

5:42

180,224

iertutil.dll

11.0.25398.1913

9-Oct-25

5:42

2,320,736

msIso.dll

11.0.25398.1913

9-Oct-25

5:42

205,824

edgeIso.dll

11.0.25398.1913

9-Oct-25

5:42

373,248

ntdll.dll

10.0.25398.1913

9-Oct-25

5:42

1,749,032

fveapibase.dll

10.0.25398.1913

9-Oct-25

5:42

426,496

fveapi.dll

10.0.25398.1913

9-Oct-25

5:42

883,712

WindowsCodecs.dll

10.0.25398.1913

9-Oct-25

5:42

1,931,784

ReAgent.dll

10.0.25398.1913

9-Oct-25

5:42

526,240

ReInfo.dll

10.0.25398.1913

9-Oct-25

5:42

62,976

wdsnbp.com

Not versioned

9-Oct-25

5:42

30,832

abortpxe.com

Not versioned

9-Oct-25

5:42

79

bootmgr.exe

10.0.25398.1913

9-Oct-25

5:42

742,816

pxeboot.com

Not versioned

9-Oct-25

5:42

25,254

pxeboot.n12

Not versioned

9-Oct-25

5:42

25,238

hdlscom1.com

Not versioned

9-Oct-25

5:42

25,662

hdlscom2.com

Not versioned

9-Oct-25

5:42

25,662

hdlscom1.n12

Not versioned

9-Oct-25

5:42

25,646

hdlscom2.n12

Not versioned

9-Oct-25

5:42

25,646

bootmgfw.efi

10.0.25398.1913

9-Oct-25

5:42

2,242,464

bootmgfw_EX.efi

10.0.26100.30212

9-Oct-25

5:42

2,376,464

References

Description of the standard terminology that is used to describe Microsoft software updates

Query words: safeos du

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.