Solved bcdboot supports a new /bootex command-line option

bcdboot now has a /bootex argument to specifically copy CA 2023-signed boot files (if your source has them).
BCDBoot Command-Line Options

Great spotting @garlin I used that command the other day when creating a new USB boot recovery drive.

I was checking the MS reference docs for building a bootable Windows USB, and they've quietly updated the instructions.

Being MS, they couldn't easily explain:

CA 2011:
\Windows\Boot\EFI
\Windows\Boot\Font

CA 2023:
\Windows\Boot\EFI_EX
\Windows\Boot\Fonts_EX

Copy which version you need into your image. Because any Windows ISO before W11 24H2 is missing EFI_EX, you're gonna have to figure a way to retrofit any legacy install images by transferring the files from 24H2, or a fully updated W10 22H2 ISO.

That would have saved so much time than trying to decipher the hidden agenda in the crappy KB articles.

Offering W10 ESU implies support for 3 more years... 2 years past the Oct 2026 deadline. They can't pretend to not instruct ESU clients on how to make a post-CA 2011 install image if your W10 system needs a clean wipe. Legitimate ESU clients are the same ones who can't run with Secure Boot disabled.

garlin said:

Being MS, they couldn't easily explain:

Click to expand...

That is the issue in a nutshell because of how they've managed the comms and release of key technical documentation.