Forum Discussion
Update bootloader in Win10 Iot Ent LTSC (21H2) applied images?
The product I work on uses Windows 10 IoT Enterprise LTSC (21H2). I am trying to update the bootloader in the extracted and applied images to the version signed in 2023, to work around the issue with the default bootloader signatures expiring in 2026 (see KB5012170).
KB5012170 updates the bootloader on an installed system. I can apply this hotfix to an installed device, and the bootloader on the hidden partition indeed gets updated. However, if I sysprep and extract the image from this machine, and apply it to a new machine, after using bcdboot to set the boot image, the new machine ends up with the old expiring bootloader installed. It seems KB5012170 only updates the "live" version of the bootloader on the hidden partition. It does not update the bootloader that ends up in the extracted image?
Updating to Windows 10 IoT 22H2 or Windows 11 IoT is not an option for us for now.
I do not want to have to require users to always install KB5012170 every time they install our product moving forward. I would like newly created images of our product to contain the updated bootloader by default. But I cannot find a way to do this.
KB5012170 seems to be the only way to get the updated bootloader for our edition of Windows. Is there another way to get the updated bootloader I am missing?
Is there a tool or trick that I am missing that would allow us to update the bootloader in the extracted, applied image without requiring a subsequent install of KB5012170?
2 Replies
Hi, I think the key detail here is that the boot files you are seeing are coming from the EFI/System partition and from what `bcdboot` lays down, not just from the captured Windows partition.
If the image capture only contains the OS volume, it can easily miss the updated boot files that KB5012170 placed on the live system partition. Then when you apply the image and run `bcdboot`, Windows may rebuild the boot files from the older source files that are still present in the image.
I would check whether your capture process includes all required partitions, especially the EFI System Partition. If you are intentionally deploying only the Windows partition, the safer supported route may be to include KB5012170 as a required post-apply step before the device is considered ready. Manually copying bootloader files can get risky with Secure Boot, servicing, and supportability, so I would avoid making that the production process unless Microsoft/OEM support confirms the exact offline-servicing method for Windows 10 IoT Enterprise LTSC.
Earlier in our development we had problems copying the EFI system partition. It may be worth another try as a long shot.
The "emergency fallback backup plan" we have is exactly as you suggest: include installation of the KB as a post-install step. I was hoping to avoid that b/c it extends our installation time by ~10 mins.
Thank you Jamony!
