Known issues in Microsoft Patches:
Microsoft often releases patches to address security and reliability issues. Sometimes, patches itself will introduce unprecedented issues after installing them. Here's the updated list of all the known issues in Microsoft patches and possible workaround for them.
Oops! No results for your search.
workaround
Jul 15, 2026
KB5099444
2026-07 Security Monthly Quality Rollup for Windows Server 2012 for x64-based Systems (KB5099445)
"Microsoft has received reports of an issue in which certain third-party applications might be unable to launch Microsoft Office applications or open documents after installing the Windows updates released on or after June 9, 2026. This issue affects certain third-party applications that use OLE automation to interact with Microsoft Office applications. In some cases, the Office application or document might fail to open without displaying an error message."
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099444. We recommend you install the latest Windows update for your device as it contains important improvements and issue resolutions, including this one.
workaround
Jul 15, 2026
KB5099444
2026-07 Security Monthly Quality Rollup for Windows Server 2012 for x64-based Systems (KB5099445)
"After installing this update, the OneDrive shortcut in File Explorer might not work when File Explorer is running with administrative privileges. Symptoms include an unresponsive shortcut, blank OneDrive properties, and missing sync status icons. No error message is displayed. This issue affects only the built-in Administrator account or applications run using Run as administrator."
Create a desktop shortcut to the OneDrive folder and use that shortcut to access files when using elevated applications or the built-in Administrator account.
workaround
Jul 15, 2026
KB5099445
2026-07 Security Monthly Quality Rollup for Windows Server 2012 for x64-based Systems (KB5099445)
"After installing this update, the OneDrive shortcut in File Explorer might not work when File Explorer is running with administrative privileges. Symptoms include an unresponsive shortcut, blank OneDrive properties, and missing sync status icons. No error message is displayed. This issue affects only the built-in Administrator account or applications run using Run as administrator."
Create a desktop shortcut to the OneDrive folder and use that shortcut to access files when using elevated applications or the built-in Administrator account.
workaround
Jul 15, 2026
KB5099445
2026-07 Security Monthly Quality Rollup for Windows Server 2012 for x64-based Systems (KB5099445)
"Microsoft has received reports of an issue in which certain third-party applications might be unable to launch Microsoft Office applications or open documents after installing the Windows updates released on or after June 9, 2026. This issue affects certain third-party applications that use OLE automation to interact with Microsoft Office applications. In some cases, the Office application or document might fail to open without displaying an error message."
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099445. We recommend you install the latest Windows update for your device as it contains important improvements and issue resolutions, including this one.
workaround
Jul 15, 2026
KB5099536
2026-07 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5099536) (26100.33158)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jul 15, 2026
KB5099540
2026-07 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5099540)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Jul 15, 2026
KB5099540
2026-07 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5099540)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments."
Remove the Group Policy configuration before installing the update (Recommended)
workaround
June 10, 2026
KB5094128
2026-06 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5094128) (CVE-2026-49160) (CVE-2026-50507) (CVE-2026-45586)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
June 10, 2026
KB5094127
2026-06 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5094127) (CVE-2026-49160) (CVE-2026-50507) (CVE-2026-45586)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update"
We are working on a resolution and will provide more information when it is available. To temporarily work around this issue, remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile.
workaround
May 30, 2026
KB5089573
2026-05 Cumulative Update Preview for Windows 11, version 24H2 for arm64-based Systems (KB5089573) (26100.8524)
"After you install this update (KB5089549), some devices might fail to complete installation with error code 0x800f0922. This issue occurs on devices that have limited free space on the EFI System Partition (ESP), especially if it has 10 MB or less available. What you might experience on affected devices: The update installs successfully during the initial phases. The installation fails during the restart phase at approximately 35-36% completion. Windows then rolls back the update. You may see the message: "Something didn't go as planned. Undoing changes." The installation fails with error code 0x800f0922. As a result of this issue, you might see log entries similar to the following in C:\Windows\Logs\CBS\CBS.log, indicating insufficient free space on the EFI System Partition: SpaceCheck: Insufficient free space ServicingBootFiles failed. Error = 0x70 SpaceCheck: used by third-party/OEM files outside of Microsoft boot directories"
Affected customers can use one of the following workarounds to mitigate this issue. Option 1: Allow the update to install by modifying an ESP registry setting Important: Editing the registry incorrectly can cause serious system problems. Always back up the registry before making any changes. Open Command Prompt as an administrator. Run the following command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Bfsvc /v EspPaddingPercent /t REG_DWORD /d 0 /f" Restart the affected device. Retry installing the update. Option 2: Mitigate the issue by using Known Issue Rollback (KIR) This issue is mitigated using Known Issue Rollback (KIR). The resolution has already propagated automatically to consumer devices and non-managed business devices. Restarting your Windows device might help the resolution apply more quickly. Enterprise-managed devices For devices where Windows updates are managed by IT departments, administrators can apply the mitigation by installing and configuring a special Group Policy. You can find the policy at Computer Configuration > Administrative Templates >. Group Policy download Windows 11, version 25H2 and Windows 11, version 24H2: KB5089549 260514_06221 Known Issue Rollback Important: You must install and configure the Group Policy that matches your version of Windows to resolve this issue. You must also restart affected devices to apply the policy. This Group Policy temporarily disables the change that causes the issue. For more information, seeHow to use Group Policy to deploy a Known Issue Rollback. A resolution is in progress and will be included in a future Windows update. This documentation will be updated once the resolution is available.
workaround
May 18, 2026
KB5089549
2026-05 Cumulative Update for Windows 11, version 24H2 for x64-based Systems (KB5089549) (26100.8457)
"After you install this update (KB5089549), some devices might fail to complete installation with error code 0x800f0922. This issue occurs on devices that have limited free space on the EFI System Partition (ESP), especially if it has 10 MB or less available. What you might experience on affected devices: The update installs successfully during the initial phases. The installation fails during the restart phase at approximately 35-36% completion. Windows then rolls back the update. You may see the message: \"Something didn\'t go as planned. Undoing changes.\" The installation fails with error code 0x800f0922. As a result of this issue, you might see log entries similar to the following in C:\\Windows\\Logs\\CBS\\CBS.log, indicating insufficient free space on the EFI System Partition: SpaceCheck: Insufficient free space ServicingBootFiles failed. Error = 0x70 SpaceCheck: used by third-party/OEM files outside of Microsoft boot directories"
This issue is addressed in KB5089573.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070892 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087544
2026-05 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5087544)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive."
We are working on a resolution and will provide more information when it is available. To temporarily work around this issue, remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087539
2026-05 Cumulative Update for Microsoft server operating system version 24H2 for arm64-based Systems (KB5087539) (26100.32860)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087541
2026-05 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5087541)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
May 13, 2026
KB5087545
2026-05 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5087545)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
May 13, 2026
KB5087539
2026-05 Cumulative Update for Microsoft server operating system version 24H2 for arm64-based Systems (KB5087539) (26100.32860)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5094125. After installing KB5094125, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: \"The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.\" If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set \"Configure TPM platform validation profile for native UEFI firmware configurations\" to \"Not Configured\". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
May 13, 2026
KB5087420
2026-05 Cumulative Update for Windows 11, version 23H2 for arm64-based Systems (KB5087420)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5093998. After installing KB5093998, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: \"The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.\" If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set \"Configure TPM platform validation profile for native UEFI firmware configurations\" to \"Not Configured\". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 24, 2026
KB5082052
2026-04 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5082052)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087420.
workaround
Apr 24, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087539.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087545.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 24, 2026
KB5091575
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5091575)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087539.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 24, 2026
KB5091157
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5091157) (26100.32698)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See Option 1 below.)"
This issue is addressed in KB5094125. After installing KB5094125, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: \"The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.\" If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set \"Configure TPM platform validation profile for native UEFI firmware configurations\" to \"Not Configured\". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 24, 2026
KB5083769
2026-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5083769) (26100.8246)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5083631.
workaround
Apr 24, 2026
KB5083768
2026-04 Cumulative Update for Windows 11, Version 26H1 for x64-based Systems (KB5083768) (28000.1836)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with."
This issue is addressed in KB5083806.
workaround
Apr 24, 2026
KB5083631
2026-04 Cumulative Update Preview for Windows 11 Version 24H2 for arm64-based Systems (KB5083631) (26100.8328)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5089549. After installing KB5089549, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: "The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration." If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 24, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. This issue might occur when you use more than one monitor with different display scaling settings (for example, one display set to 100% and another set to 125%). When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with"
This issue is addressed in KB5087545.
workaround
Apr 20, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"After installing this update, domain controllers in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091575. Note: If your Windows Server 2022 device is enrolled in hotpatching, you should instead install the OOB hotpatch update KB5091576. This hotpatch OOB update is released through Windows Update and does not require the device to restart.
workaround
Apr 20, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"After installing this update and restarting, domain controllers (DCs) in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091157. Note: If your Windows Server 2025 device is enrolled in hotpatching, you should instead install the OOB hotpatch update KB5091470. This hotpatch OOB update is released through Windows Update and does not require the device to restart.
workaround
Apr 20, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"A small number of devices might fail to install this update with one of the following error messages: "Install error - 0x800F0983" "Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"
This issue is addressed in out-of-band update KB5091157. Note: Hotpatch-enrolled Windows Server 2025 devices affected by this issue can install out-of-band update KB5091157 to receive the same protections as the April security update (KB5082063). However, installing KB5091157 requires a restart and pauses hotpatching. Hotpatch updates will resume after the July 2026 baseline update.
workaround
Apr 20, 2026
KB5082060
2026-04 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5082060)
"After installing this update, domain controllers in environments with multiple domains in the forest that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected domain controllers might restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable"
This issue is addressed in out-of-band update KB5091571.
workaround
Apr 15, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5082060
2026-04 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5082060)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070879 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"Windows Server Update Services (WSUS) does not display error details"
After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
workaround
Apr 15, 2026
KB5083769
2026-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5083769) (26100.8246)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5089549. After installing KB5089549, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: "The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration." If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 15, 2026
KB5082200
2026-04 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5082200)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profi"
Option 1: Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. Option 2: Apply the Known Issue Rollback (KIR) before installing the update A Known Issue Rollback (KIR) is available for customers who cannot remove the PCR7 group policy before deploying this update. The KIR prevents the automatic switch to the 2023 Boot Manager, avoiding the BitLocker recovery trigger. The KIR should be deployed before installing the update on affected devices. Contact Microsoft’s Support for business to obtain this KIR. Next steps A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 15, 2026
KB5082142
2026-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5082142)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set "Configure TPM platform validation profile for native UEFI firmware configurations" to "Not Configured". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. A permanent resolution for this issue is planned in a future Windows update. More information will be provided when it is available.
workaround
Apr 15, 2026
KB5082063
2026-04 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB5082063) (26100.32690)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5094125. After installing KB5094125, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: \"The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.\" If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set \"Configure TPM platform validation profile for native UEFI firmware configurations\" to \"Not Configured\". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:
workaround
Apr 15, 2026
KB5082052
2026-04 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5082052)
"Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments. BitLocker is enabled on the OS drive. The Group Policy "Configure TPM platform validation profile for native UEFI firmware configurations" is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually). System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as "Not Possible". The Windows UEFI CA 2023 certificate is present in the device's Secure Boot Signature Database (DB), making the device eligible for the 2023-signed Windows Boot Manager to be made the default. The device is not already running the 2023-signed Windows Boot Manager. In this scenario, the BitLocker recovery key only needs to be entered once -- subsequent restarts will not trigger a BitLocker recovery screen, as long as the group policy configuration remains unchanged. For help finding your BitLocker recovery key, see the article, Find your BitLocker recovery key. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. (See the Workaround below.)"
This issue is addressed in KB5093998. After installing KB5093998, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. If your device was impacted, Event ID 1032 will appear in the System event log when installing Windows updates: \"The Secure Boot update Boot Manager (2023) was not applied due to a known incompatibility with the current BitLocker configuration.\" If you receive Event ID 1032, Microsoft strongly recommends removing the Group Policy configuration before installing updates so that you can install the 2023-signed Windows Boot Manager and continue to receive the latest Secure Boot protections. Remove the Group Policy configuration before installing the update (Recommended) Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Set \"Configure TPM platform validation profile for native UEFI firmware configurations\" to \"Not Configured\". Run the following command on affected devices to propagate the policy change: gpupdate /force Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command to resume BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: This updates the BitLocker bindings to use the Windows-selected default PCR profile. If you do not wish to remove this Group Policy configuration, you can install the new Windows Boot Manager by temporarily suspending BitLocker and installing the Secure Boot update. To do this: Run the following command to suspend BitLocker (if BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: Run the following command: Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\" Restart the device. Once the new Windows Boot Manager is successfully installed, enable BitLocker by running the command: manage-bde -protectors -enable C:.
Disclaimer:This webpage is intended to provide you information about patch announcement for certain specific software products. The information is provided "As Is" without warranty of any kind. The links provided point to pages on the vendors websites. You can get more information by clicking the links to visit the relevant pages on the vendors website.