Hasleo Emergency Boot disk, winload.efi Error

Froggie · Apr 24, 2026

starchase said:
Windows 11 Home 25H2 build 26200.8246

My Hasleo Emergency Boot disk gives me an error when trying to boot from it.

My ASUS Windows 11 unsupported desktop has been updated with CA 2023 certs which is allowed, and my Hasleo free version Recovery Disk has the CA 2023 Cert Allowed. But when I boot from the USB disk I get a Blue Scree Error that states "The digital signature for this file couldn't be verified: \windows\system32\boot\winload.efi Error code 0xc0000428." The USB boot disk will work fine if I disengage Secure Boot.

Copilot says "The error occurs because the entire WinPE image (including its boot chain) is signed with older Microsoft certificates, and Secure Boot rejects it" and that Hasleo WinPE environment still contains a winload.efi signed with an older Microsoft certificate. How can I get a correct WinPE from Hasleo when creating their Recovery Disk? I'm running the latest Hasleo version 5.6.2.1 and made a Recovery Disk from that version. But apparently it has the older CS2023 cert in this file.

Here is the Blue Screen Error and date from running Garlin's script: "Check_UEFI-CA2023.ps1 -bootmedia -verbose":

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.322, SVN 8.0

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Bootable Media
--------------
USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
D:\EFI\Boot\bootx64.efi
File Version: 28000.322, SVN 8.0

View attachment 169682

The Hasleo version you are currently running does not support the creation of certified 2023 certificates... it hasn't been released yet. If you need this feature, download the supported BETA at the link below...

Hasleo Backup Suite V5.8.2.1 Released!

@Froggie, Quote:For us to improve, we'll just have to move I don't know about you, but at 73 I have moved for the last time, unless it is to a nursing home or the cemetery! @al3x is welcome to the glo

www.easyuefi.com

starchase · Apr 24, 2026

starchase said:
But your Double Boot concept actually WORKED!

My error, I still get the above Blue Screen when I boot. I apologize to all. I should have rebooted after I reapplied the script Update_UEFI-CA2023.ps1, even though I did notice the statement at the end that said "reboot for the settings to take effect. Instead I can the Check_UEFI-CA2023.ps1 script and saw the new certs applied and then immediately rebooted into the Emergency disk. I did that this morning and got the Blue Screen error, the one in the first post.

I guess I'll just use the work around, temporarily disable Secure Boot to perform a recovery, and then re-enable when I'm done.

Though I will try the suggestion in using the Beta version and making a boot disk using that.

starchase · Apr 24, 2026

Froggie said:
The Hasleo version you are currently running does not support the creation of certified 2023 certificates... it hasn't been released yet. If you need this feature, download the supported BETA at the link below...

Hasleo Backup Suite V5.8.2.1 Released!

@Froggie, Quote:For us to improve, we'll just have to move I don't know about you, but at 73 I have moved for the last time, unless it is to a nursing home or the cemetery! @al3x is welcome to the glo

www.easyuefi.com

I did install the BETA version and created an Emergency Disk but I still get the error screen as in post #1, the winload.efi file can't be validated. But thanks for the suggestion anyway.

Froggie · Apr 24, 2026

Sorry, I have to ask... did you select (CheckMark) the option during Emergency Disk creation called "Enable support for 'Windows UEFI CA 2023'?" This is supposed to produce an EFI BOOTloader for the BOOTable media that will work with both CA 2011 & CA 2023.

garlin · Apr 24, 2026

Froggie said:
Sorry, I have to ask... did you select (CheckMark) the option during Emergency Disk creation called "Enable support for 'Windows UEFI CA 2023'?" This is supposed to produce an EFI BOOTloader for the BOOTable media that will work with both CA 2011 & CA 2023.

I don't understand this statement, it needs to be clarified.

When you have added CA 2023 certs to a PC, but not revoked CA 2011 -- then boot files signed by either cert will boot. Once you have revoked CA 2011, then the boot file must be CA 2023. This same media would not work for someone who hasn't applied CA 2023 on their PC.

So this notion that it works on both isn't true. If you have installed the product, maybe you can pass along the vendor's specific instructions. Maybe those will state what they're doing.

SIW2 · Apr 24, 2026

@starchase

Can you try booting the hasleo wim off disk and see if that works. You could try the hasleo add boot menu option

It extracts the wim from the .iso to %systemdrive%\boot folder, renames it somelongnumber.wim and adds a winpe entry to the current bcd store.
Then there should be an entry called hasleo something on your boot menu.

If that works it might indicate somelongnumber.wim\windows\system32\winload.efi is ok and there is a problem somewhere on the usb stick

starchase · Apr 24, 2026

Froggie said:
Sorry, I have to ask... did you select (CheckMark) the option during Emergency Disk creation called "Enable support for 'Windows UEFI CA 2023'?" This is supposed to produce an EFI BOOTloader for the BOOTable media that will work with both CA 2011 & CA 2023.

Yes, I did.

starchase · Apr 24, 2026

SIW2 said:
@starchase

Can you try booting the hasleo wim off disk and see if that works. You could try the hasleo add boot menu option

It extracts the wim from the .iso to %systemdrive%\boot folder, renames it somelongnumber.wim and adds a winpe entry to the current bcd store.
Then there should be an entry called hasleo something on your boot menu.

If that works it might indicate somelongnumber.wim\windows\system32\winload.efi is ok and there is a problem somewhere on the usb stick

Hi. I'm not sure what you mean by booting the hasleo wim off disk.

I tried the Fix The Digital Signature for This File Couldn't Be Verified Error Code 0xc0000428 In Windows 11/10 and was able to complete all the instructions to rebuild the bcdboot and it finally reported that the boot files were successfully created. But I still get the same blue screen that can't validate the bootload.efi file. I used the latest Windows 11 iso from Microsoft to reconstruct it, by booting into this Rufus ISO and getting to a Command Prompt but it didn't work. Still get the Blue Screen - failed to validate the winload.efi file. Below is the Cert Information of this file from the C:\Windows\System32\Boot location (image below).

At least I can use the Emergency Disk after disabling Secure Boot. It seems on this machine I'm stuck with this workaround. At least I have a workaround!

SIW2 · Apr 24, 2026

I'm not sure what you mean by booting the hasleo wim off disk.

boot menu option

that is how to boot the wim off disk

starchase · Apr 24, 2026

SIW2 said:
boot menu option

that is how to boot the wim off disk

View attachment 169785

Ah, I see. Do you think this will furnish a winload.efi file that will validate?

SIW2 · Apr 24, 2026

Try it and find out

starchase · Apr 24, 2026

SIW2 said:
Try it and find out

If I add it can I remove it if it doesn't solve the issue?

SIW2 · Apr 24, 2026

starchase · Apr 25, 2026

SIW2 said:
boot menu option

that is how to boot the wim off disk

View attachment 169785

I just now added the Boot Menu and still resulting in a non-boot issue. The resulting screen mentions the same file that won't validate and suggests a couple things to try all of which I've done with negative results.

By the way, it is simple to remove the boot menu as the Add Boot Menu box changes to Remove Boot Menu.

Thanks for the suggestion though.

SIW2 · Apr 25, 2026

I just now added the Boot Menu and still resulting in a non-boot issue. The resulting screen mentions the same file that won't validate

Does your winre.wim work ok?

admin cmd prompt type:
reagentc -boottore
(then press enter)

restart and it should boot winre.wim

starchase · Apr 25, 2026

SIW2 said:
Does your winre.wim work ok?

admin cmd prompt type:
reagentc -boottore
(then press enter)

restart and it should boot winre.wim

I had it enabled a day or so ago because it was disabled. Checking it now it is disabled. I don't know if my repeated clearing the Secure Boot keys trying various things has influenced its status. But I can enable it again.

starchase · Apr 25, 2026

. . . . so after I ran reagentc -boottore (see above) I restarted and the machine booted just fine as it always has done (except when I boot from a Rescue Disk with Secure Boot enabled )

I did read that running the command enables it on the next boot.

SIW2 · Apr 25, 2026

Are you saying winre.wim is fine with secure boot disabled. But it is not fine with secure boot enabled ?

If the "winpe components" have not been downloaded, hasleo creates boot media from winre.wim.

It just adds the program files, winpeshl.ini and some entries in the software hive - the key .

I dont see how there is any difference between the boot critical files in hasleo boot.wim and the original winre.wim.

garlin · Apr 25, 2026

Can you run these commands from PowerShell as Admin?

Code:

$LastBootUpTime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime

Get-WinEvent -FilterHashtable @{LogName='System'; Id=12; StartTime=$LastBootUpTime} | where { $_.Message -match 'LSASS.exe was started as a protected process with level: 4.' }

If you see the last line return "LSASS.exe was started as a protected process with level: 4.", you have an UEFI lock on your VBS policy.

That might be the reason you can't boot that image. I've been trying to figure out how to clear an UEFI lock, but none of the documented methods have worked for me.

starchase · Apr 25, 2026

garlin said:
Can you run these commands from PowerShell as Admin?

Code:

$LastBootUpTime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime Get-WinEvent -FilterHashtable @{LogName='System'; Id=12; StartTime=$LastBootUpTime} | where { $_.Message -match 'LSASS.exe was started as a protected process with level: 4.' }

If you see the last line return "LSASS.exe was started as a protected process with level: 4.", you have an UEFI lock on your VBS policy.

That might be the reason you can't boot that image. I've been trying to figure out how to clear an UEFI lock, but none of the documented methods have worked for me.

Here is the result of your 2 commands:
PS C:\Users\theislands> $LastBootUpTime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
PS C:\Users\theislands> Get-WinEvent -FilterHashtable @{LogName='System'; Id=12; StartTime=$LastBootUpTime} | where { $_.Message -match 'LSASS.exe was started as a protected process with level: 4.' }

ProviderName: Microsoft-Windows-Wininit

TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
04/25/2026 4:22:05 PM 12 Information LSASS.exe was started as a protected process with level: 4.

PS C:\Users\theislands>

SIW2 said:
Are you saying winre.wim is fine with secure boot disabled. But it is not fine with secure boot enabled ?

If the "winpe components" have not been downloaded, hasleo creates boot media from winre.wim.

It just adds the program files, winpeshl.ini and some entries in the software hive - the key .

I dont see how there is any difference between the boot critical files in hasleo boot.wim and the original winre.wim.

All I know is that when I boot either a Macrium Reflect Recovery Disk or the Hasleo Emergency Disk with Secure Boot enabled I get the Blue Screen stating the winload.efi file can't be validated. But If I disable Secure Boot I can boot from either USB media. Sadly I don't have the knowledge about how all this works so I don't know why nothing I try to solve this has worked. But the machine boots just fine when not engaging the USB Media.

Hasleo Emergency Boot disk, winload.efi Error

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads