Windows Update KB5025885 Prevents Reinstallation of Microsoft Windows

Applies to: Windows client and server media

On May 9, 2023, Microsoft started to push KB5025885 to all impacted devices. The update is marked as critical or automatic, and Windows automatically consume and install the update.

Only after the manual remediation, all OSRI media that have been created prior to the policy update will become unbootable including:

• Recovery media and ISOs (including Dell SupportAssist OSRI, SupportAssist USB media, SupportAssist OS streaming through BIOSConnect)
• Windows backups created before the update was installed
• Windows Recovery
• Windows PE
• Push-Button Reset
• Windows Deployment Service (WDS)
• Microsoft Deployment Toolkit (MDT)
• HTTPS Boot
• Official Windows media from Microsoft
  • Media Creation Tool
  • Volume Licensing or Visual Studio subscription downloads
• USB Media

For full mitigation see Microsoft Security Advisor KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932

Existing OSRI media and Windows Backups continue to work.

Dell is actively working on updating OSRI media. We will update this article as we progress, and updated images become available.

No.

Dell does not recommend reducing the security posture of a device.

Windows Boot Manager may stop the boot process with error 0xC0000428: Windows cannot verify the digital signature when OSRI was performed from media.

(Figure 1. Boot Manager Error)

Windows may stop with error 0xC0e90002 when Windows Recovery (WinRE) is invoked.

(Figure 2. Error when Push-Button Reset or Windows Reset was used)

1. Open Event Viewer.
   • Windows versions with the Start menu:
     • Choose Start menu > Control Panel > Administrative Tools > Event Viewer.
   • Windows versions with the Start screen:
     • Open Search, type eventvwr to find the Event Viewer.
2. Click Windows Logs.
3. Click System.
4. Click the Find button on the right side of the screen. A window opens.
5. Type either Secure boot or dbx.
6. If renovation is installed, it shows "Secure Boot Dbx update applied successfully" (Figure 3). If not, then it is safe to do OSRI using your preferred method.
   
   (Figure 3. Secure Boot Dbx update applied successfully message)

If the revocation is installed, operating system reinstall media may not work.