Solved Windows 11 version 25H2 fails to install: we couldn't update the system reserved partition

Gary Blok's advice is to first delete the \EFI\HP\BIOS\Previous, and \Current. \New1 also looks like a duplicate copy.

If you're concerned, use File Explorer to move the folders somewhere on C: drive. Now try running the upgrade.

garlin said:

Gary Blok's advice is to first delete the \EFI\HP\BIOS\Previous, and \Current. \New1 also looks like a duplicate copy.

If you're concerned, use File Explorer to move the folders somewhere on C: drive. Now try running the upgrade.

Click to expand...

I was just going to mention that exact thing.

Hazel123 said:

Edit - apologies - 200mb is my boot partition. When I checked with diskpart, my system reserved partition is only 16mb!

Click to expand...

Don't confuse System reserved partition with Microsoft Reserved Partition (MSR)
The System Reserved partition is the EFI partition and it's normally 100M but on OEM computers the EFI partition may have some tools other than just the boot manager.

From Google AI
The System Reserved Partition (SRP) in Windows 11 is a small (usually 100-500 MB), hidden partition essential for booting, storing BitLocker encryption data, and recovery files. If it becomes full during updates, it triggers "We couldn't update system reserved partition" errors. Fixes include using diskpart to extend the partition or freeing space by deleting unnecessary fonts.

Open a CMD window as administrator and type:

diskpart
select disk 0
Select part 1
detail part
Exit

Don't do anything if Bitlocker is enabled.
Is Bitlocker enabled?

The attached files are the ones on Tenforums. Remove the Txt sulfix and run them and post them zbook as instructed

garlin said:

Gary Blok's advice is to first delete the \EFI\HP\BIOS\Previous, and \Current. \New1 also looks like a duplicate copy.

If you're concerned, use File Explorer to move the folders somewhere on C: drive. Now try running the upgrade.

Click to expand...

Thank you very much, Sir! After following your advice, I was able to successfully update!





My conclusion is that Hewlett‑Packard’s poorly designed BIOS update system filled the EFI partition, which in turn caused both BIOS and Windows updates to fail.

What command(s) did you run?

From Command Prompt as Administrator:

mountvol y: /s
Y:
cd EFI\HP\BIOS
dir

rmdir Previous
rmdir New1

exit

Then I rebooted.

Nick12345 said:

My conclusion is that Hewlett‑Packard’s poorly designed BIOS update system filled the EFI partition, which in turn caused both BIOS and Windows updates to fail.

Click to expand...

Yes and no. The original guideline from MS was to assign 100 MB to EFI, which was more than enough for MS boot files.

Dell and HP got the bright idea, instead of bothering users to find a spare USB drive that could overwritten to fit the BIOS flash files, they would copy the same files into the EFI. More convenient right? Except what that borrowed space got larger over time. And they didn't really care about cleaning up loose ends (old files).

Depending on when this Windows install was done, they may not have followed the current recommendation for at least 200 MB. And for Dell and HP PC's, because they keep caching files, actually more like 400-600 MB.

If you were to re-install Windows from scratch, it would probably do 280 MB. It's up to you whether you feel like doing a re-partition to expand the EFI. This requires running a 3rd-party partition manager to shrink Windows and shift it sideways to give up more room to the EFI.

I would worry first about a successful 25H2 upgrade. Decide later if you want to resize EFI. Now you know the trick for the next time this system gets upgraded.

Nice.


Please see these links on secure boot updates:


Frequently asked questions about the Secure Boot update process - Microsoft Support
https://techcommunity.microsoft.com...ook-for-certificates-expiring-in-2026/4469235
https://learn.microsoft.com/en-us/w...=windows-11#14-signature-databases-db-and-dbx
https://support.microsoft.com/en-us...-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
Updating Microsoft Secure Boot keys before expiration in June 2026 | Windows 11 Forum
Secure boot update HowTo | Windows 11 Forum

@garlin Thank you, yes, I know the trick, I think. The trick is to make sure I remove any unwanted directories from the BIOS directory to ensure enough space is available. Am I right? Please, confirm.

There is one more directory currently there:



Can you please confirm if New can be removed? Additionally, does 2 File(s) 0 bytes indicate that these two .bin files are empty?


@zbook I will check it out, thank you

EDIT: Am I OK now?

I suspect those files are zero length because the BIOS update process may have run out of disk space.

The real trick is to remove the non-MS folders, but never touch the MS folders since those are required (except you can ditch some of the fonts if English is your normal language).

Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: HP-ENVY-Laptop-17
Description:
The Secure Boot update failed to update a Secure Boot variable with error Unknown HResult Error code: 0xc00703ee. For more information, please see Secure Boot DB and DBX variable update events - Microsoft Support

Click to expand...

Offhand, that looks like a KEK failure. Like it's one of those problem BIOS'es from HP.

In the case of HP, the EFI partition also contains files to run hardware diagnostics, in the SystemDiags folder.

To run diagnostics, the F2 key is used at boot. The diagnostics are searched for successively in three locations: a connected UFD, the EFI partition, and the UEFI firmware.

garlin said:

Offhand, that looks like a KEK failure. Like it's one of those problem BIOS'es from HP.

Click to expand...

Looks like that failure was YESTERDAY before he fixed this update problem and the next one says success.
What do you think? Are they related or unrelated? Should he worry about it?

john1955 said:

Looks like that failure was YESTERDAY before he fixed this update problem and the next one says success.
What do you think? Are they related or unrelated? Should he worry about it?

Click to expand...

No, I read "Secure Boot CA/keys need to be updated" as not updated.