Solved ASUS, Microsoft and Macrium bootable Media... story. "Info"

Ghot · Dec 7, 2025

Here's an interesting mess... (System One in my specs)

I was on BIOS 5101. I flashed to 5201 and it broke my activation. So, I flashed back to 5101 and restored from a backup, and all was well.
Then ASUS came out with the 5302 BIOS in a very short time period. I thought... they must have fixed things so it won't break Activation.
So, I flashed to 5302...

I was wrong. Seven days after the flash to 5302, the Activation broke again.
But, thinking I may need it, I had grabbed a Win 11 Home key from Stack Social for $9.97

So... I used the new key and all was well again. But I was wrong again.

Because of all the Microsoft Secure Boot mess, I decided to remake my Macrium bootable Media,
just to be on the safe side.
But no... the new media with the latest WinPE ADK, error-ed when trying to boot from it.

No setting was changed in the BIOS.

Normally, before this fiasco, I always ran the Macrium Bootable Media from the UEFI option.
The Corsair Voyager is my Macrium bootable USB stick.

But now, thanks to ASUS and Microsoft, I can only run it from the non-UEFI option.
I think MS should keep their mitts off Secure Boot till they actually know what their doing. ^^

garlin · Dec 7, 2025

What are the results of the Secure Boot check script (with the USB drive)?

Ghot · Dec 7, 2025

My Secure Boot certs...

Ghot · Dec 7, 2025

garlin said:
What are the results of the Secure Boot check script (with the USB drive)?

Looks like it's... BANNED.

Is there a way to fix that? I have to undo the UEFI DBX Certs don't I?
Someone had posted a command, that they later deleted to "create" the entry under UEFI DBX Certs.

I would have kept a copy but they deleted the post too fast. I remember it ended in 0x80

garlin · Dec 7, 2025

Because it's using the old boot files, which goes back to the ADK or WinRE thing with Macrium.

Code:

copy N:\EFI\Microsoft\Boot\BCD N:\EFI\Microsoft\Boot\BCD.BAK
bcdboot C:\Windows /f UEFI /s N: /bootex
copy N:\EFI\Microsoft\Boot\BCD.bak N:\EFI\Microsoft\Boot\BCD

Ghot · Dec 7, 2025

garlin said:
Because it's using the old boot files, which goes back to the ADK or WinRE thing with Macrium.

Code:

copy N:\EFI\Microsoft\Boot\BCD N:\EFI\Microsoft\Boot\BCD.BAK bcdboot C:\Windows /f UEFI /s N: /bootex copy N:\EFI\Microsoft\Boot\BCD.bak N:\EFI\Microsoft\Boot\BCD

Brb I'm going to see what happens with the MR bootable media.

Rollback_Jockey · Dec 7, 2025

Have you checked for a Macrium update?

Ghot · Dec 7, 2025

@garlin

That fixed it. I barely understand what that did, but it worked.

Question: If I have to rebuild the MR bootable Media (with new WinPE ADK), again, will I have to re-run those commands?

@Brink

Give @garlin a raise. ^^

garlin · Dec 7, 2025

You're all assuming the Macrium devs have figured out how to do the right thing... I don't use Macrium, but if you're a paid customer, file a product feedback to them.

How to fix Macrium (for Macrium developers):

1. Check if reg key WindowsUEFICA2023Capable exists.

2. If value is 1 or 2 (UEFI CA 2023 is enrolled in DB), check if W10 22H2 or W11 version is July 2025 or later.

3A. If Windows is before July 2025, then force user to download December 2024/Feb 2025 ADK. Do it the old way.

3B. If Windows is July 2025 or later and WindowsUEFICA2023Capable is non-zero, then use bcdboot /bootex to make the USB bootable for CA 2023. Otherwise if equal to zero, then use bcdboot (without the /bootex flag) for CA 2011.

Ghot · Dec 7, 2025

garlin said:
You're all assuming the Macrium devs have figured out how to do the right thing... I don't use Macrium, but if you're a paid customer, file a product feedback to them.

How to fix Macrium (for Macrium developers):

1. Check if reg key WindowsUEFICA2023Capable exists.

2. If value is 1 or 2 (UEFI CA 2023 is enrolled in DB), check if W10 22H2 or W11 version is July 2025 or later.

3A. If Windows is before July 2025, then force user to download December 2024/Feb 2025 ADK. Do it the old way.

3B. If Windows is July 2025 or later and WindowsUEFICA2023Capable is non-zero, then use bcdboot /bootex to make the USB bootable for CA 2023. Otherwise if equal to zero, then use bcdboot (without the /bootex flag) for CA 2011.

Now I'm confused. I'm guessing that "3B" is the situation I'm in currently.
Is this what I should check?

I've also saved this as a text file. I'm gonna publish it in every English newspaper the world over.
You'll be lauded in song and story.

PerpetualCycle · Dec 7, 2025

You can manually update macrium so it uses the 2023 bootmgr files when it makes a rescue media.

Assuming you have you macrium boot files in the default location c:\boot, then make the following changes in a elevated command window:

Admin Command Prompt Type:

mountvol s: /s
copy s:\EFI\Boot\bootx64.efi c:\boot\macrium\WinREFiles\media\EFI\bootx64.efi
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

This will copy the 2023 signed boot files from your EFI partition to the files macrium uses to generate rescue media. Whenever you make a new media, it will have the correct 2023 CA signed files

This whole situation is why Microsoft recommended not to ban the 2011 CA prematurely. Users shouldn't have to endure this. They never should have made that announcement until they had it a little more together.

Edited for typoe. E: -> C: (i had my macrium boot folder on E:)

Ghot · Dec 7, 2025

PerpetualCycle said:
Assuming you have you macrium boot files in the default location c:\boot, then make the following changes in a elevated command window:

Note the "Date Modified".

These are Macrium's directions for rebuilding their bootable Media when needed...
I'm guessing that following these directions... overwrites the files in the pic just above?

PerpetualCycle · Dec 7, 2025

fixed a couple of typos in the above

Ghot · Dec 7, 2025

In short Macrium's directions say... get rid of the current WinPE ADK files, download a new set, and rebuild the Media.

garlin · Dec 7, 2025

Macrium also does a poor job explaining this.

If you have July 2025 or later, LATEST BOOT FILES FOR both 2011 & 2023 are already inside the Windows folder. The ADK is required if you're running some ancient W10 or W11 (before 24H2) system which never got updated. ADK's are normally used to help build custom Windows ISO's and bootable images, so they include a full copy of boot files.

Which is duplicated in Windows after July 2025 (well technically April 2024, except for the SVN issue). Does downloading the ADK hurt if you're on 24H2/25H2? No, but it's a wasted step. Unless they're just lazy and don't want to rewrite their code/customer guide to make it easier.

Ghot · Dec 7, 2025

PerpetualCycle said:
fixed a couple of typos in the above

I don't understand those commands at all bro.
@garlin just explained that I won't need the "newest" ADK files.

Those Macrium directions were from early 2024 for the "revocations".
I just "assumed" they were still needed.

I have these commands saved... I understand them a tiny bit better than your commands.

copy N:\EFI\Microsoft\Boot\BCD N:\EFI\Microsoft\Boot\BCD.BAK

bcdboot C:\Windows /f UEFI /s N: /bootex

copy N:\EFI\Microsoft\Boot\BCD.bak N:\EFI\Microsoft\Boot\BCD

If Microsoft doesn't get their act together... I'm going back to Windows 7.
I still have the retail DVD around here somewhere. LOL

SIW2 · Dec 7, 2025

PerpetualCycle said:
You can manually update macrium so it uses the 2023 bootmgr files when it makes a rescue media.

Assuming you have you macrium boot files in the default location c:\boot, then make the following changes in a elevated command window:

Admin Command Prompt Type:

mountvol s: /s
copy s:\EFI\Boot\bootx64.efi c:\boot\macrium\WinREFiles\media\EFI\bootx64.efi
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

This will copy the 2023 signed boot files from your EFI partition to the files macrium uses to generate rescue media. Whenever you make a new media, it will have the correct 2023 CA signed files

This whole situation is why Microsoft recommended not to ban the 2011 CA prematurely. Users shouldn't have to endure this. They never should have made that announcement until they had it a little more together.

Edited for typoe. E: -> C: (i had my macrium boot folder on E:)

Are they different fonts as well ?

garlin · Dec 7, 2025

Technically you're supposed to copy all the _EX files. But Macrium isn't probably using them for their needs, and can skip the extra files.

PerpetualCycle · Dec 7, 2025

Ghot said:
I don't understand those commands at all bro.
@garlin just explained that I won't need the "newest" ADK files.

Those Macrium directions were from early 2024 for the "revocations".
I just "assumed" they were still needed.

I have these commands saved... I understand them a tiny bit better than your commands.

If Microsoft doesn't get their act together... I'm going back to Windows 7.
I still have the retail DVD around here somewhere. LOL

They mount the EFI partition and copy the 2023 CA boot files from there to the boot files macrium uses to make WINRE rescue media.

Ghot · Dec 7, 2025

PerpetualCycle said:
They mount the EFI partition and copy the 2023 CA boot files from there to the boot files macrium uses to make WINRE rescue media.

I understand that.

Future scenario....

MS does something else weird, and I'm "sure" I need to rebuild the bootable media with a fresh, new copy of the WinPE ADK files.
I'm guessing that your excellent commands won't survive that?

I mean, who knows what I'll try in the wee hours of the night.

Or as my English professor used to say: "Consider your audience". <---- which, in this case, would be me. LOL

Solved ASUS, Microsoft and Macrium bootable Media... story. "Info"

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers