Hasleo Emergency Boot disk, winload.efi Error


starchase said:
Macrium Reflect Recovery Disk or the Hasleo Emergency Disk with Secure Boot enabled I get the Blue Screen stating the winload.efi file can't be validated.
Click to expand...

I was going around in circles trying to get my Macrium boot menu to boot. Same issue with the
winload.efi.

I decided to try something and it worked!

I copied the SkuSiPolicy.p7b from the EFI partition to the boot menu EFI/Microsoft/Boot directory.
I can't explain why it worked, but it did. From there I rebuilt my USB boot media and it booted as well.

Might be worth a try.
 

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI BIOS 4505 11/29/25
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe 25H2 DEV/Games
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    350Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

    System 3 Specs
    Win 11 Pro 25H2 26200.8524
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
  • Operating System
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i7-11700F
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
SkuSiPolicy.p7b

cant find one of those on my esp only a WinSiPolicy.p7b

according to the linked article:

Suspend BitLocker if it is enabled

Turn off Secure Boot from the UEFI BIOS menu

Remove the SkuSiPolicy.p7b policy.

Start Windows normally and then sign in.

The SkuSiPolicy.p7b policy must be removed from the following location:

<EFI System Partition>\Microsoft\Boot\SkuSiPolicy.p7b

Turn on Secure Boot from BIOS



Guidance for blocking rollback of Virtualization-based Security (VBS) related security updates - Microsoft Support

support.microsoft.com support.microsoft.com
 
Last edited:

My Computers

System One System Two

  • OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i
  • Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
Only users who are running VBS should have a copy of SkuSkiPolicy.p7b on their ESP, for additional security. It's recommended by MS.
 

My Computer

System One

  • OS
    Windows 7
Scott said:
I was going around in circles trying to get my Macrium boot menu to boot. Same issue with the
winload.efi.

I decided to try something and it worked!

I copied the SkuSiPolicy.p7b from the EFI partition to the boot menu EFI/Microsoft/Boot directory.
I can't explain why it worked, but it did. From there I rebuilt my USB boot media and it booted as well.

Might be worth a try.
Click to expand...
I don't have this file either, but perhaps it's because I haven't revoked the CA 2011 cert yet. When you say you copied the file from the EFI partition you mean the EFI on the system disk, not the USB Media, right? Or vice versa?
The funny thing is I can boot the Hasleo Emergency Disk just fine on my HP Spectre with Secure Boot enabled! But not on the ASUS.

Edit. I don't have VBS running on my machines.
 

My Computers

System One System Two

  • OS
    Windows 11 Home, ver 25H2 build 26200.8246
    Computer type
    Laptop
    Manufacturer/Model
    Hewlett-Packard Spectre 13-4001 x360 convertable
    CPU
    Intel Core i5 5200U @ 2.20GH
    Motherboard
    Hewlett-Packard 802D
    Memory
    4 GB
    Graphics Card(s)
    Intel HD Graphics 5500 on board
    Sound Card
    Intel Smart Sound Technology (Intel SST)
    Hard Drives
    Micron 256GB M.2 2280 NGFF SSD MTFDDAV256TBN, (SATA 6.0 Gb/s)
    Keyboard
    Model # G01KB
    Antivirus
    Microsoft Defender
    Other Info
    born on date: 25 Feb 2016
  • Operating System
    Win 11 Home 25H2 build 26200.7922
    Computer type
    PC/Desktop
    Manufacturer/Model
    Asus Desktop model M32AD-US019S (DOM: 6/9/2014 )
    CPU
    Intel Core i7 4th Gen 4790 (3.60GHz), Haswell 22nm Technology, SOCKET 1150
    Motherboard
    H81M-E/M51AD/DP_MB
    Memory
    Samsung 16 GB DDR3 (8GB in 2 modules)
    Graphics card(s)
    NVIDIA GeForce GTX 760, 3GB, and on-board Intel HD Graphics 4600 Rev 6
    Monitor(s) Displays
    HP EliteDisplay E241i LED; HP EliteDisplay E243
    Hard Drives
    Samsung 500GB SSD, 870 EVO (SATA 6.0 )
    Micron 250GB SSD, CT250MX500
    Toshiba HDD, 3GB (original drive w/PC)
    Case
    ASUS
    Keyboard
    ASUS-------------------------
    Antivirus
    MS Defender
    Other Info
    Additional Laptops:

    HEWLETT PACKARD
    HP OmniBook X Flip NGAI (Next Gen AI),
    Model: 16-as0023dx
    PT# B5UH1UA#ABA Product #: B5UH1UA
    delivered and setup 7/25/25
    16" 2K Touch-Screen Laptop
    Intel Core Ultra 7 256V '24 Series 2 - CPU
    Boost Clock Frequency 4.8 gigahertz; Neural Processing Unit (NPU) Yes;
    16GB Memory, LPDDR5X
    1TB SSD PCIe 4.0
    Graphics: Intel Arc 140V
    1 x HDMI 2.1
    1 x Thunderbolt 4
    2K Touch-Screen display, LED, IPS; 1920 x 1200 (Full HD+)
    USB Ports: 1 x USB-C 3.1, 2 x USB-A 3.1
    Wi-Fi 6E
    weight 4.15 pounds

    DELL
    Model:I7591-7483BLK-PUS 2-in-1 (7000 Series)
    purchased 12/3/2019,
    15.6 inch 2-IN-1;
    4K Ultra HD Touch-Screen, 3840 x 2160,
    Intel Core i7 10510U CPU 1.80GHz,
    16GB RAM DDR4 SDRAM 2400 megahert (2 slots),
    dedicated graphics Nvidia GeForce MX250 2 GB Graphics,
    PCIe 512GB Intel SSD + 32GB Optane Memory (Intel Optane Memory H10 with solid-state storage),
    wireless-AX & Bluetooth
    Battery: 68wh, Type 4VGMP 4 cell
I'm working on a script that clears the UEFI lock. Sometimes you might not realize your UEFI has another layer of protection, but this one can interfere if you manually update the SkuSiPolicy file or remove it. The UEFI lock adds a hidden variable that takes over policy enforcement.

This script downloads a special EFI boot file (LsaPplConfig.efi) from MS, copies it to your EFI and creates a short batch file.

1. Run "UEFI_Lock.ps1". If you don't have an UEFI lock, the script exits.

2. Run the batch file, "ClearUEFI_Lock.bat"

3. Restart Windows. When the boot manager starts up, a different text screen will come up. You only have a few seconds to respond, before it thinks you ignored it. Hit F3, and then any key to resume. At this point, Windows will start.

4. No more UEFI lock! Now see if your USB drive boots fine.
 

Attachments

My Computer

System One

  • OS
    Windows 7
garlin said:
Only users who are running VBS should have a copy of SkuSkiPolicy.p7b on their ESP, for additional security. It's recommended by MS.
Click to expand...
Yes it says that in the article.
 

My Computers

System One System Two

  • OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i
  • Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
You must log in or register to reply here.

Similar threads

Computer failure booting to Hasleo emergency disk
Replies
10
Views
1K
dagar7
D
Make Hasleo Rescue Disk Cert 2023 OK
Replies
4
Views
904
garlin
G
Solved garlin's PowerShell scripts for updating Secure Boot CA 2023
105 106 107
Replies
2K
Views
172K
garlin
G
Solved Hasleo restore backup from emergency disk
Replies
6
Views
9K
smalltalk
smalltalk

Latest Support Threads

Latest Tutorials

Back
Top Bottom