Solved ASUS, Microsoft and Macrium bootable Media... story. "Info"

Ghot said:

I understand that.

Future scenario....

MS does something else weird, and I'm "sure" I need to rebuild the bootable media with a fresh, new copy of the WinPE ADK files.
I'm guessing that your excellent commands won't survive that?

I mean, who knows what I'll try in the wee hours of the night.

Click to expand...

Macrium will update them sometime soon I expect. The same commands will work as long as you have already updated the certificates in windows, so that the EFI partition is up-to-date. I doubt Microsoft will change how they boot windows, but who knows what they might do in the future.

PerpetualCycle said:

Macrium will update them sometime soon I expect. The same commands will work as long as you have already updated the certificates in windows, so that the EFI partition is up-to-date. I doubt Microsoft will change how they boot windows, but who knows what they might do in the future.

Click to expand...

Then there's part two of my issue...

There's no way I'm paying $79 a year for Macrium X
I'm on MR 8.1.8631 (paid "lifetime" version of 8.1)

When MS does something that breaks this version, I'll switch to Hasleo.

I just marked this as Solved.
I'm sure there's enough excellent info in here, now, to help many folks.

You hieroglyphics speakers (command and powershell aware folks), are great. ^^


Sigh, as per post #1 this topic, I'm gonna switch over to my Win 10 SSD and see if it's deactivated.

The problem with some UEFI firmware updates, is Windows takes part of the firmware and generates a hash of the contents. This hash is added to the HW "fingerprint" that identifies your PC. When the hash changes, your PC's fingerprint does too.

Windows thinks you're on a different PC and invalidates the current license. Follow the normal instructions for informing MS you "moved to a different PC". Someone probably remembers that tutorial.

garlin said:

The problem with some UEFI firmware updates, is Windows takes part of the firmware and generates a hash of the contents. This hash is added to the HW "fingerprint" that identifies your PC. When the hash changes, your PC's fingerprint does too.

Windows thinks you're on a different PC and invalidates the current license. Follow the normal instructions for informing MS you "moved to a different PC". Someone probably remembers that tutorial.

Click to expand...

I spent hours, days, trying to register my comp with MS... can't do it for some reason. Even after the new product key.

Anyway, I can't boot at all into Windows 10... I'm now getting the message I got for the MR bootable media when I'm on the Win 10 SSD. I even tried Macrium's Fix Boot Problems... no luck.



I do have a backup of Win 10 made on Nov 13th.
On another day, I'll probably try to set up dual boot on the Win 11 SSD, with that MR backup.

Currently, I'm set up like this...




But that project is for another day. I'm... yes I admit it... tuckered out. LOL
I'm gonna restart just to make sure Win 11 boots.

It reboots !!

Ghot said:

I spent hours, days, trying to register my comp with MS... can't do it for some reason. Even after the new product key.

Anyway, I can't boot at all into Windows 10... I'm now getting the message I got for the MR bootable media when I'm on the Win 10 SSD. I even tried Macrium's Fix Boot Problems... no luck.

View attachment 155990

I do have a backup of Win 10 made on Nov 13th.
On another day, I'll probably try to set up dual boot on the Win 11 SSD, with that MR backup.

Currently, I'm set up like this...

View attachment 155989


But that project is for another day. I'm... yes I admit it... tuckered out. LOL
I'm gonna restart just to make sure Win 11 boots.

It reboots !!

Click to expand...

in your Windows 10 install what are the registry entries for secure boot please.
as you may have to repeat the process to update the secure boot on Windows 10
as you did on your Windows 11 install to get Windows 10 to boot from the 2023 secure boot cert.

this will register the 2023 secure boot cert within the Windows 10 install
but at this time please DO NOT revoke the 2011 secure boot cert.
best of luck Steve ..

It still boots. But now I'm gonna take like a three hour break.
Thanks everyone that helped.

XxXxX said:

in your Windows 10 install what are the registry entries for secure boot please.
as you may have to repeat the process to update the secure boot on Windows 10
as you did on your Windows 11 install to get Windows 10 to boot from the 2023 secure boot cert.

this will register the 2023 secure boot cert within the Windows 10 install
but at this time please DO NOT revoke the 2011 secure boot cert.
best of luck Steve ..

Click to expand...

I can't boot to Win 10.
I can access command prompt for Win 10, via the MR bootable media, but not powershell.




On Win 11 I did your HowTo before I flashed the BIOS to 5302.
I guess I should have done it on Win 10 also, before I flashed the BIOS
See post #1 this topic.

garlin said:

The problem with some UEFI firmware updates, is Windows takes part of the firmware and generates a hash of the contents. This hash is added to the HW "fingerprint" that identifies your PC. When the hash changes, your PC's fingerprint does too.

Windows thinks you're on a different PC and invalidates the current license. Follow the normal instructions for informing MS you "moved to a different PC". Someone probably remembers that tutorial.

Click to expand...

I haven't had that happen to me, retail license. Does that only apply to OEM licenses as they are tied to the hardware?

You can boot W10, just disable Secure Boot. The wrong boot files are in place.

If your W10 22H2 is at least pre-ESU (Oct. 2025), then do:

PerpetualCycle said:

I haven't had that happen to me, retail license. Does that only apply to OEM licenses as they are tied to the hardware?

Click to expand...

Honestly I don't know. On my PC's, I haven't had any BIOS firmware updates break the licensing. This seems to happen more with ASUS/ASR motherboards.

Awwww @Ghot . I don't know where I got the idea but I thought that you and I were the ride or die rebels against secure boot. Now I find I am all alone.
I'm heartbroken...and lonely.

garlin said:

You can boot W10, just disable Secure Boot. The wrong boot files are in place.

If your W10 22H2 is at least pre-ESU (Oct. 2025), then do:

Code:

mountvol S: /s
bcdboot C:\Windows /f UEFI /s S: /bootex /d
mountvol S: /d

Click to expand...

I'm on Win 10 right now with Secure Boot disabled.
And then I can re-enable secure boot?
Or do I need to do @XxXxX 's How to first?

Ghot said:

I'm on Win 10 right now with Secure Boot disabled.
And then I can re-enable secure boot?

Click to expand...

The other boot files are part of W10 22H2 (since July 2025). Just run the bcdboot command to install them. Then you can re-enable Secure Boot.

I'm just leaving this here as any casual user might venture and find it useful.

I never use any 3rd party softwares for system backup. Primary reason being adding another layer outside of Windows build in systems, which should be the priority number 1. More so, adding another 3rd party software makes the process prone to bugs and failure. Best strategy in my opinion is to use Dism. There can be nothing more compatible than Dism itself for backup and restoration. But this only applies if the backup/target machine is the same. The only reason to use the 3rd party software would be to have the luxury of the extended features these programs provide, not possible entirely with Dism.

So here it goes, the simple method.

Prepare your system for backup, cleanup any temp data/Recycle bin etc. Make sure system is in the state you would want it restored.

Boot from WinPE, capture image with Dism. Additionally use wimscript if you want to skip some files like pagefile/hyberfile etc

Save image anywhere you like, USB/external Media/addditional disks connected to system.

Restore:
Just boot from Winpe, use Dism Applyimage and you'll be off and running within minutes. Dism procedure ensures no nasty surprises. However, it lacks extended features provided by 3rd party software like moving system from one machine to another or having incremental copies etc. But for basic backup/restore, Dism is simple and most effective way.

Also, if you think SecureBoot is actually about Security, you want to read the what the Dev of Rufus has to say about it. It will open your eyes up to a certain degree.

garlin said:

The other boot files are part of W10 22H2 (since July 2025). Just run the bcdboot command to install them. Then you can re-enable Secure Boot.

Click to expand...

This is on Windows 10 with Secure Boot ON...





For comparison, this is my Win 11 results...




Win 10 registry...

Ok... afk while I make a fresh Win 10 backup.



Alright... fresh backups of Win 10 and Win 11, a MR bootable Media that works.






Extra kudos to @garlin and @XxXxX ^^



Note: 2 days till patch Tuesday.

Summary...

For all who haven't done this stuff, here's the important parts...



Links to @garlin 's codes that were successful...

Fix MR bootable Media (if you get the RED Invalid signature detected error when trying to boot)...

Fix Win 10 or 11 boot (if you get the RED Invalid signature detected error when trying to boot)...





@Brink

Here's the major takeaways:

After you do the Secure Boot update, always perform two actions:
1. Rebuild your Macrium (or whatever) recovery USB, so it has the new boot files.

2. Backup the current Windows image, since the boot files have changed. If you restore from an older backup (before the switch), it might have the old boot files. In that case, you can temporarily disable Secure Boot, then figure out how to move forward (run Windows Update, or copy newer boot files by hand).

Don't panic. Your data isn't gone if there's a security violation error from BIOS.

Like I did.
I even forgot where my towel was.