Whoever solves this Microsoft certificate puzzle, please come forward !!!

garlin · 2026-07-01T10:42:39-0400

If you have separate EFI volumes, and picked a different boot device in the UEFI boot list, then you have to check the other disk's SVN. Only the Secure Boot certs and the SVN is global across all the boot devices on the PC.

Temporarily disable Secure Boot, boot from the other drive, run the check script.

suatcini54 · 2026-07-01T10:48:55-0400

When I try to boot to not-yet-updated Windows, I get this message and PC turns off. SVN mismatch. This is becoming a real pain. I had better start thinking of using the other Windows disk as a data disk.

garlin · 2026-07-01T10:57:32-0400

Disable Secure Boot, boot from the other disk, run the update script.

You only have to do this when the boot manager changes. It's not every month, but the last times were October 2025, April 2026, June 2026.

suatcini54 · 2026-07-01T11:01:23-0400

garlin said:
Disable Secure Boot, boot from the other disk, run the update script.

I will do that.

garlin said:
You only have to do this when the boot manager changes. It's not every month, but the last times were October 2025, April 2026, June 2026.

That's a load off.

Monika1491 · 2026-07-01T11:05:43-0400

"Rufus formats the drive in NTFS" "There were two UEFI OS entries."
"MCT formats the drive in FAT32"
"My Asus M/B (of late 2014) has no problem booting to NTFS formatted drives."

1)
Rufus creates two partitions on the usb flash, one is FAT and the other is NTFS. If UEFI has NTFS support, the user sees two options, one starts efi on the Rufus FAT partition and the other bootx64.efi on the NTFS partition. The cleaner option is bootx64.efi, because efi on the Rufus partition just starts bootx64.efi.

2)
MCT creates a FAT32 partition.
Rufus creates FAT + NTFS partitions on the USB Flash.
You have NTFS support. Me too.
The best option is not to use MCT or Rufus.
Have only one NTFS partition on the USB flash and copy the files there manually, either from the iso or using dism from the esd.
(It is then of course necessary to copy the files signed with the 2023 certificate as bootx64.efi.)

suatcini54 · 2026-07-01T11:29:49-0400

@Monika1491 In my system, Rufus created a single NTFS partition for the bootable USB drive. No other partition. This was a 16 GB USB drive. MCT creates FAT32 partition and splits the install.esd file into install.swm and install2.swm. I don't know how Rufus decides to create two partitions, one in FAT32 and the other in NTFS in some systems.

XxXxX · 2026-07-01T11:46:37-0400

suatcini54 said:
When I try to boot to not-yet-updated Windows, I get this message and PC turns off. SVN mismatch. This is becoming a real pain. I had better start thinking of using the other Windows disk as a data disk.

View attachment 175685

you could use a live Linux USB, like linux Lite, and use 'disks'
to copy and paste the EFI/BOOT partition folders from the system that is booting
into the EFI/Boot partition that is not booting.

that will update the boot loader and the SVN so it should boot.
best of luck Steve ..

Monika1491 · 2026-07-01T11:51:15-0400

suatcini54 said:
@Monika1491 In my system, Rufus created a single NTFS partition for the bootable USB drive. No other partition. This was a 16 GB USB drive. MCT creates FAT32 partition and splits the install.esd file into install.swm and install2.swm. I don't know how Rufus decides to create two partitions, one in FAT32 and the other in NTFS in some systems.

View attachment 175687

In your case Rufus created two partitions. If it had only created one, you wouldn't see 2 boot options.
Look in diskpart .-) There will be two partitions.

garlin · 2026-07-01T11:53:11-0400

You don't need to boot Linux. Boot from the working Windows.

1. From Disk Manager or diskpart, assign a temporary drive letter to the second disk's EFI volume.

2. Replace the boot manager.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Boot\Microsoft\bootmgfw.efi

suatcini54 · 2026-07-01T12:01:21-0400

Monika1491 said:
In your case Rufus created two partitions. If it had only created one, you wouldn't see 2 boot options.
Look in diskpart .-) There will be two partitions.

This is the Rufus created boot disk. Disk 4. There are two partitions on disk 4 but one partition is too small (1039 KB) to place any usable boot file on it.

What do you make of it ?

XxXxX · 2026-07-01T12:03:26-0400

garlin said:
You don't need to boot Linux. Boot from the working Windows.

1. From Disk Manager or diskpart, assign a temporary drive letter to the second disk's EFI volume.

2. Replace the boot manager.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Boot\Microsoft\bootmgfw.efi

it would be doubtful i would be able to remember the code to write
so i use copy and paste instead. but if the code works then i hope the OP tries it.

best of luck Steve ..

Monika1491 · 2026-07-01T12:05:07-0400

suatcini54 said:
This is the Rufus created boot disk. Disk 4. There are two partitions on disk 4 but one partition is too small (1039 KB) to place any usable boot file on it.

View attachment 175688

What do you make of it ?

It doesn't matter that it's small. On that small partition is the bootable efi from Rufus.

I wrote that the only thing the Rufus efi does is run bootx64.efi on an NTFS partition. The size of the Rufus efi file on the Rufus partition is a few kB.

Monika1491 · 2026-07-01T12:07:46-0400

garlin said:
You don't need to boot Linux. Boot from the working Windows.

1. From Disk Manager or diskpart, assign a temporary drive letter to the second disk's EFI volume.

2. Replace the boot manager.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Boot\Microsoft\bootmgfw.efi

Maybe like this

Code:

mountvol S: /S
xcopy "c:\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "S:\EFI\Microsoft\Boot\bootmgfw.efi" /Y
xcopy "c:\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "S:\EFI\Boot\bootx64.efi" /Y
mountvol S: /D

Note: But AI tells me that other files equivalent to cert 2023 should also be copied there, e.g. fonts.

suatcini54 · 2026-07-01T12:23:56-0400

Monika1491 said:
It doesn't matter that it's small. On that small partition is the bootable efi from Rufus.
I wrote that the only thing the Rufus efi does is run bootx64.efi on an NTFS partition. The size of the Rufus efi file on the Rufus partition is a few kB.

O.K. If that's true, I stand corrected.

My motherboard sometimes makes two boot entries for some disks.

As you can see from the above screenshot, I have two Windows disks, one is Samsung SATA disk and one is Corsair M.2 NVMe disk. For Samsung SATA disk, I have two boot entries. For Corsair disk, I have one boot entry.

For Rufus disk, I took it to be like Samsung disk, two entries.

Thanks for the info.

garlin · 2026-07-01T12:26:37-0400

Monika1491 said:
Maybe like this

Code:

mountvol S: /S

"mountvol [letter] /S" will only mount the EFI volume used by the currently booted system drive. It doesn't mount the separate EFI volume on the other drive. @suatcini54 specifically mentioned he has two "standalone" drives.

While you can find out the other EFI volume's GUID and pass that to mountvol, it's probably simpler to use Disk Manager or diskpart to assign a drive letter.

Monika1491 · 2026-07-01T12:28:06-0400

garlin said:
"mountvol [letter] /S" will only mount the EFI volume used by the currently booted system drive. It doesn't mount the separate EFI volume on the other drive.

While you can find out the other EFI volume's GUID and pass that to mountvol, it's probably simpler to use Disk Manager or diskpart to assign a drive letter.

Okay, I didn't think of that

suatcini54 · 2026-07-01T12:40:43-0400

Thanks for the inputs.

copy command does not work for copying bootmgfw.efi file.

xcopy command works.

I used correct EFI partition using Diskpart -> List Vol command to copy the files but still I cannot boot to the other Windows. I get this:

WhatsApp Image 2026-07-01 at 19.30.17.webp

winload.efi file is problematic.

I think I have no other choice but to disable Secure Boot and update the non-booting Windows.

garlin · 2026-07-01T13:01:07-0400

winload.efi error is because your SkuSiPolicy doesn't match what Windows Update was last applied. This is what I warned about.

This setup can work, but you have to invest extra time to make sure you're updating everything. Windows is applying a layered defense, so a failure in one security feature doesn't allow an attacker to win.

1. UEFI checks boot file (bootmgfw.efi or bootx64.efi) for correct signing cert.
2. Boot manager checks for the minimum SVN version from DBX.
3. SkuSiPolicy checks if your winload.efi's version is blocked or not.

The security model is working as it was designed. A question is can you adapt to the requirements, or is it easier to skip having SkuSiPolicy installed? Having more security means more overhead. In English, the expression is "there is no free lunch".

suatcini54 · 2026-07-01T13:09:49-0400

@garlin So if I delete SKUSiPolicy file, I will be able to boot or so I understand.

I will do that. I have nothing to lose because that Windows is not booting anyway.

suatcini54 · 2026-07-01T13:38:03-0400

After deleting SKUSiPolicy.P7b file, I still get winload.efi digital signature error. I must be able to replace winload.efi file from the working Windows. But this is more work than disabling Secure Boot.

Whoever solves this Microsoft certificate puzzle, please come forward !!!

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers