Win Update KB5085516 Windows 11 Out-of-band Update build 26100.8039 (24H2) and 26200.8039 (25H2) - March 21

pietcorus2 · Mar 24, 2026

Nothing important , if not on an EUFI-bios , all disks,SSDs , etc on MBR.................... :wink:

hader · Mar 24, 2026

gunrunnerjohn said:
I think the real issue that comes up is many machines won't get the update at all for various compatibility and/or BIOS reasons. It'll be really interesting to see how MSC deals with those millions of machines.

Yes I am curious also. Everybody can switch off Secure Boot and your machine will still boot Windows. But MS is marking those machine as "tainted" and are not (at least not all of them) getting any updates anymore.

This is a policy what MS is stuffing through everybody's throats in their campagne of "Security". Stuffing already AI though our throats while nobody wanted it. Continue to spying on us also to sell our data so they are getting more profits then selling licenses alone..... They want to own our machines. In future versions Windows will be sitting in the cloud and we have all to pay for a subscription..... Mo Money.

And yes something have to give..... MS or the users.....

FIREMEDIC2700 · Mar 24, 2026

hader said:
Yes I am curious also. Everybody can switch off Secure Boot and your machine will still boot Windows. But MS is marking those machine as "tainted" and are not (at least not all of them) getting any updates anymore.

This is a policy what MS is stuffing through everybody's throats in their campagne of "Security". Stuffing already AI though our throats while nobody wanted it. Continue to spying on us also to sell our data so they are getting more profits then selling licenses alone..... They want to own our machines. In future versions Windows will be sitting in the cloud and we have all to pay for a subscription..... Mo Money.

And yes something have to give..... MS or the users.....

i am not using secure boot however my install media is made via rufus and it has the windows ca 2023 or something like that and i still get updates through windows updates . i did have this machine booting in secure boot but like a big Dumb Ass i replaced the cmos battery and when i did the bios reset and now it will not go into secure boot . just for poops and giggles i am going to do another clean install and see what happenes.

hader · Mar 24, 2026

fg2001gf11F said:
You need to see that when you try to "Clean up the system files".

Yes. Aware of that. Before this update (8037); 380Mb, Cleanmgr refused to clean this up. After this 8039 update it grew to 570Mb. Tried to clean, It cleaned some of it what went well but the same figure appeared at the end 380Mb. Cleanmgr for unknown reason also refused to clean the remainders/leftovers also.

I can do this by hand after some searching, but the problem is; Cleanmgr invokes the TrustedInstaller for this job. The highest user inside Windows. Even I as Admin does not have those rights. Is there any other alternative that respects Windows law and does not clean the wrong things? Any ideas out there?

hader · Mar 24, 2026

FIREMEDIC2700 said:
i am not using secure boot however my install media is made via rufus and it has the windows ca 2023 or something like that and i still get updates through windows updates . i did have this machine booting in secure boot but like a big Dumb Ass i replaced the cmos battery and when i did the bios reset and now it will not go into secure boot . just for poops and giggles i am going to do another clean install and see what happenes.

That strange. The BIOS sits on a lower level than Windows does. Did you flash your BIOS with the latest version for your motherboard. If not, I would do that first. You should be able to turn on secure boot. (There are some other settings involved here like CSM (Combability Support Module) must be disabled.) and Secure Boot must be set on "Windows UEFI Mode" (Secure boot mode) If left on "Other OS" it's assuming an other OS like Linux. (No secure boot mode)

Now? Windows will boot regardless if Secure boot is turned on or off. When CA2023 has been introduced? The same. Only your are not getting all the updates that MS is sending out. It will apply them only when in Secure Boot mode..... During the boot proces with secure boot is turned on, Windows will load drivers and when signed check if they are signed with the valid and not expired CA2011 certificate. (later replaced by the new CA2023 certificate) If not? It will not load the driver. In theory Windows must obey this BIOS setting. It only checks it's setting to decide if checking is needed yes or no. Despite which setting Windows will boot. It is possible that the bootloader is damaged.

You can correct this using the guidelines in this page; How to Repair EFI/GPT Bootloader on Windows 10 or 11 | Windows OS Hub

pietcorus2 · Mar 24, 2026

" Windows will load drivers and when signed check if they are signed with the valid and not expired CA2011 certificate. (later replaced by the new CA2023 certificate) If not? It will not load the driver. ".................I dont need drivers from MS , so again , no problem staying on Legacy-bios !
Works and boots fine still , while ASUS has no bios-updates for the Z97-K :wink:

Awesomehorse · Mar 24, 2026

Will this update mean that today's supposed "preview update" is going to be pushed or something? or is it going to be released at some point soon as planned?

kamil96500 · Mar 24, 2026

Since the March 10 update, I've been experiencing random network disconnections when the laptop is in power-saving mode. Is anyone else having this issue?

Unfortunately, my laptop uses the worst Realtek network card.

Cor3 · Mar 24, 2026

kamil96500 said:
Since the March 10 update, I've been experiencing random network disconnections when the laptop is in power-saving mode. Is anyone else having this issue?

Unfortunately, my laptop uses the worst Realtek network card.

I had problems with network Jan - Feb. Connection drops, I tried all I can think of, but fix was to do Asus Cloud Recovery.

remover · Mar 24, 2026

I also had the same issue last year: but my issue was fixed with the Tutorial: posted on this form (I also have a Realtek card) Reset Network Adapters in Windows 11
25H2 os build: 26200.8039

hader · Mar 24, 2026

pietcorus2 said:
" Windows will load drivers and when signed check if they are signed with the valid and not expired CA2011 certificate. (later replaced by the new CA2023 certificate) If not? It will not load the driver. ".................I dont need drivers from MS , so again , no problem staying on Legacy-bios !
Works and boots fine still , while ASUS has no bios-updates for the Z97-K

No drivers? Uhm delete this directory c:\Windows\system32\drivers then and see if then Windows boots up....

Everywhere you look MS drivers are loaded.... Ever opened device management? Even Linux needs drivers.

kamil96500 · Mar 25, 2026

Cor3 said:
I had problems with network Jan - Feb. Connection drops, I tried all I can think of, but fix was to do Asus Cloud Recovery.

I have a 7-year-old HP laptop, so support for it will end in late 2024. I’m hoping Microsoft will come up with a solution.

kamil96500 · Mar 25, 2026

remover said:
I also had the same issue last year: but my issue was fixed with the Tutorial: posted on this form (I also have a Realtek card) Reset Network Adapters in Windows 11
25H2 os build: 26200.8039

I’ll give your solution a go after the non-security update, which should be released this week.

pietcorus2 · Mar 25, 2026

hader said:
No drivers? Uhm delete this directory c:\Windows\system32\drivers then and see if then Windows boots up.... Everywhere you look MS drivers are loaded.... Ever opened device management? Even Linux needs drivers.

So , you mean ; I have to change legacy (MBR) to EUFI ( GPT) , if I dont , I cant use my Win11 anymore..................???!

Then WHY (??) ASUS does not update my bios still......?

Awesomehorse · Mar 25, 2026

Had a security intelligence update today that took a bit longer than usual to install rather than it being near-instant

hader · Mar 25, 2026

pietcorus2 said:
So , you mean ; I have to change legacy (MBR) to EUFI ( GPT) , if I dont , I cant use my Win11 anymore..................???!
Then WHY (??) ASUS does not update my bios still......?

Wait...
Hold things separate.
- UEFI BIOS is the follower of the old Legacy BIOS used in the past. It contains "new" features like GPT and Secure Boot.

- MBR or GPT. Master Boot Record is an older type of tables with an index that can points to the starting block (e.a. 4K) of files on a disk. That fileblock point to the next fileblock of 4K etc. until it ends (end of file) It has it limits; The maximum it can address (32bit) are 4 partitions of 2TB. So if you have a disk larger than 2TB you have to switch over to GTP. That can address (64bit) are 128 partitions of 9ZB or 9 billion TB. So if you have a disk of 1TB you don't have to switch over to GPT. GPT is no faster than MBR but it has one big advantage; It contains an CRC for integrity purposes. So I converted all of my disks to GPT. An action that takes a few seconds.

- ASUS BIOS. Yes it can happen. Manufactures roll out new BIOS's for there new products mainly. They can contain bugs etc. So when needed the release a newer BIOS version. Then they level off; most of the issues has been addressed and fixed. And after a few years they stop serving the motherboard and will not release newer BIOS's anymore. (Out of service) If bought an ASUS motherboard in 2015. The latest BIOS for this motherboard was 2018. Bought a new ASUS Prime Z690 motherboard (because my old motherboard couldn't cope with the newly bought RTX3060Ti Graphics card. Videos say it could...) in 2022. Updated the BIOS every time a new one came out. Updated during 2024/2025. The frequency was slowing down.

But this does not have to be a problem. This whole CA2023 issue is revolving arround Keys. 1 set (Default) comes default from manufactures. 1 set (Current) comes from Microsoft. Only the Current values must have the correct and up-to-date keys. So incase you have an older PC/Laptop that don't have a 24/25/2026 updated BIOS? This mismatches may be reflected in the Red Crosses (Default section) using this program; "Check UEFI PK, KEK, DB and DBX.cmd" (GitHub - cjee21/Check-UEFISecureBootVariables: PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables as well as scripts for other Secure Boot related items.) As long as the Current Value settings of UEFI PK, KEK and DB have green checkmarks; you are OK. Those values are active now and needed for the upcoming CA2023 change.

In my case I had 1 red cross inside the Default UEFI DB. Went to the manufacture and saw that they released a new BIOS version in Dec-2025. Downloaded it, flashed it and after that that 1 red cross became green also. I think there are millions and millions who can't get a recent BIOS also. That's OK as long as the current values are in order. (Green)

hader · Mar 25, 2026

hader said:
OOB or not. It seems to hit everyone. The reason for this fix (I noticed this earlier; My current PC did not show up (did earlier) inside my MS-account whatever I did. Strangely it did see my older (non TPM and CPU compliant) PC with 25H2 and a much older laptop with Win10.) was to fix an issue with the MS-account originated from our machines. Some setting was not correct. The fix did it's job. It appeared again. DISM, SFC were fine and no additional to cleanup packages it was a short and fast update....

Damn.... Just found out.....
It seems that that whole MS-account stuff was broken by the previous update; KB5079473 (26200.8037) dated 10-03-2026.
This KB5085516 (26200.8039) dated 21-03-2026 was pushed through to fix this problem.

As I had said before; 25H2 is one of the worst releases ever. We have seen that cycle before; update - fix - update - update - fix etc.

And to make things worse; I download the latest version of Check-UEFISecureBootVariables on github. Ran it and.... All my 3 SVN's were "None" again despite they showed earlier 7.0, 3.0 and 3.0.

Had to run these commands again inside Powershell (as admin)
- reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
- Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Immediately after that the program it showed 7.0, 3.0 and 3.0 again. So that last fix tinkered with these settings also for God know why....... :ffs:

pietcorus2 · Mar 25, 2026

hader said:
Wait...
Hold things separate.
- UEFI BIOS is the follower of the old Legacy BIOS used in the past. It contains "new" features like GPT and Secure Boot.

- MBR or GPT. Master Boot Record is an older type of tables with an index that can points to the starting block (e.a. 4K) of files on a disk. That fileblock point to the next fileblock of 4K etc. until it ends (end of file) It has it limits; The maximum it can address (32bit) are 4 partitions of 2TB. So if you have a disk larger than 2TB you have to switch over to GTP. That can address (64bit) are 128 partitions of 9ZB or 9 billion TB. So if you have a disk of 1TB you don't have to switch over to GPT. GPT is no faster than MBR but it has one big advantage; It contains an CRC for integrity purposes. So I converted all of my disks to GPT. An action that takes a few seconds.

- ASUS BIOS. Yes it can happen. Manufactures roll out new BIOS's for there new products mainly. They can contain bugs etc. So when needed the release a newer BIOS version. Then they level off; most of the issues has been addressed and fixed. And after a few years they stop serving the motherboard and will not release newer BIOS's anymore. (Out of service) If bought an ASUS motherboard in 2015. The latest BIOS for this motherboard was 2018. Bought a new ASUS Prime Z690 motherboard (because my old motherboard couldn't cope with the newly bought RTX3060Ti Graphics card. Videos say it could...) in 2022. Updated the BIOS every time a new one came out. Updated during 2024/2025. The frequency was slowing down.

But this does not have to be a problem. This whole CA2023 issue is revolving arround Keys. 1 set (Default) comes default from manufactures. 1 set (Current) comes from Microsoft. Only the Current values must have the correct and up-to-date keys. So incase you have an older PC/Laptop that don't have a 24/25/2026 updated BIOS? This mismatches may be reflected in the Red Crosses (Default section) using this program; "Check UEFI PK, KEK, DB and DBX.cmd" (GitHub - cjee21/Check-UEFISecureBootVariables: PowerShell scripts to check the DBX Secure Bo UEFI KEK, DB and ot variables as well as scripts for other Secure Boot related items.) As long as the Current Value settings of UEFI PK, KEK and DB have green checkmarks; you are OK. Those values are active now and needed for the upcoming CA2023 change.

In my case I had 1 red cross inside the Default UEFI DB. Went to the manufacture and saw that they released a new BIOS version in Dec-2025. Downloaded it, flashed it and after that that 1 red cross became green also. I think there are millions and millions who can't get a recent BIOS also. That's OK as long as the current values are in order. (Green)

Im on legacy cant check these DBX Secure Bo UEFI KEK, DB and ot variables as well as scripts for other Secure Boot related items , seems I dont have them , on my MBR/Legacy-bios.
If I understand you well , I can still using my Win11 , with MBR/legacy...............??

hader · Mar 25, 2026

pietcorus2 said:
Im on legacy cant check these DBX Secure Bo UEFI KEK, DB and ot variables as well as scripts for other Secure Boot related items , seems I dont have them , on my MBR/Legacy-bios.
If I understand you well , I can still using my Win11 , with MBR/legacy...............??

MBR will not an issue but about the legacy part?.... It should not be a problem as long as you bypass during installation some requirements that Windows 11 want to see; TPM2.0, A more modern CPU, onboard RAM > 4Gb and..... Secure boot....

That last problem may become an issue. No secure boot. I can see you already installed 25H2 onto your system so far so good. Now? Secure boot on or off is not an issue now. According to the information after the introduction of CA2023 Windows 11 will boot normally. But it does not check (it does not checks it also now with the CA2011 certificate) the drivers as they are loading if they are signed and if so is it signed by a valid CAxxxx certificate.

So if your system boots now it will continue to do so after that CA2023 update. In your case of having a Legacy BIOS there is no need to run that script I pointed to. Because It's a Legacy BIOS and not an UEFI BIOS. You don't need to fix your system because it isn't capable to run in EUFI mode.

So in the end; What are there risks then? That whole UEFI and CA2023 revolves just arround one thing: Security. This mechanism is stopping possible suspicious driver injection into your system. Now it can't check that so your system is running the risk by opening an e-mail or going to a suspicious site who inject suspicious code into your system etc. But you can reduce that risk by having a good antivirus program installed who watches your internet traffic, you file system and watches for rootkits.

Future will tell if hackers are capable of injecting stuff into our machines to gather personal data. Not only Microsoft will adapt for new ways, but anti-virus manufactures also. To keep things in perspective; it is not very lucrative to hack into individual machines. They rather hack into big companies in order to steal data that contains sensitive data by the millions. They will sell that data for a lot of money to anyone who is interested and wants to pay for that information.

An example: Some time ago a Telecom company (Odido) here in the Netherlands had a break in by hackers who stole millions of customers data. They refused to pay ransom. ("We don't give in into demands!!!...") Yep. That maybe so. The hackers then sold the data to the market on Telegram. All customers mad as hell when they heard this. Yeah it's also a good way to ruin your reputation because they thought that it was not that important to monthly apply patches on their infrastructure.... (Saves us money.....) On your way to bankruptcy you are..... Many current customers will flee and new customers will look elsewhere.....

pietcorus2 · Mar 25, 2026

Woow ! You made my day !

So , no reason to change from legacy to EUFI , all is fine now , Antivirus ok also , I know what I have , but.........dont know after changing to EUFI !
Will stay on this OS/bios , coz its just a very fine machine............ :wink:

AI Component	Version
Image Search	1.2602.1451.0
Content Extraction	1.2602.1451.0
Semantic Analysis	1.2602.1451.0

Available	Next Step
	Open Start > Settings Update & Security > Windows Update. In the Optional updates available area, you will find the link to download and install available updates. Check for optional updates
	To install this release from the Microsoft Update Catalog, select the option that matches your device architecture (arm64 or x64), and then follow the instructions.

Win Update KB5085516 Windows 11 Out-of-band Update build 26100.8039 (24H2) and 26200.8039 (25H2) - March 21

March 21, 2026 - KB5085516 (OS Builds 26200.8039 and 26100.8039) Out-of-band​

Improvements​

AI Components​

Windows 11 servicing stack update (KB5083532)- 26100.8035​

Known issues in this update​

How to get this update​

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads

March 21, 2026 - KB5085516 (OS Builds 26200.8039 and 26100.8039) Out-of-band

Improvements

AI Components

Windows 11 servicing stack update (KB5083532)- 26100.8035

Known issues in this update

How to get this update