2026-07 Security Update (KB5101650) (26200.8875) causes boot failure

Windows11 automatically downloaded and installed this update overnight. Fatal error during reboot, and Windows booted into repair mode, waiting for BitLocker security key to be manually entered to start disk repair. Repair process found no disk errors and eventually decided to reverse the update, after which the machine booted successfully.

Windows event log reported that update had failed with 0x800f0845 error.

Second attempt to install the update resulted in exactly the same outcome - machine would not boot, entered repair mode requiring BitLocker key to be manually entered, repair process uninstalled the update to enable the machine to boot successfully.

I have paused updates for the maximum 35 days, in the hope that Microsoft fixes KB5101650 by then

JonStu299 said:

I have paused updates for the maximum 30 days,

Click to expand...

The maximum is 35 days.

Check your computer mfg. for a BIOS update.

Thanks Josey. It's a Lenovo ThinkPad. All manufacturer's updates have been installed. I suspect this feature in the update package is the source of the problem:

[Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Certificate deployment via Windows updates continues

BruceR said:

The maximum is 35 days.

Click to expand...

The pause is 35 days. It can then be paused again for another 35 days.

I installed the Windows 8875 update in a similar AMD ThinkPad laptop (T495s), no problems at all. BitLocker is not active.

I also installed a UEFI firmware update for this laptop, which was published a few days ago, and updates the 2023 Secure Boot certs in the firmware.

This laptop is almost 7 years old, the Lenovo support finished officially in 2024.

As was stated Windows Update can be paused within the WU app in 35 day increments. But it can be paused using the registry for 20 years.

@JonStu299 Welcome to ElevenForum.

Here's ten points, just for filling out your computer specs.


You can just disable Secure Boot temporarily, and check here to see about the required certifications...



It looks and sounds complicated but the topic's author, @garlin can help you with it.
He has VERY...

I don't know if Secure Boot is involved. Sometimes a BIOS update can temporarily invalidate the BitLocker key stored in the TPM, and request you provide it by hand to confirm nothing is amiss. Normally the Secure Boot update process should be suspending BitLocker for 1-2 reboots to prevent this from happening during a planned update.

To check whether Secure Boot is a culprit or not, I suggest running this script and post the results:

garlin's PowerShell scripts for updating Secure Boot CA 2023