Windows 11 Insider Setup fails with 0x800B0109 before UEFI disk layout error

More info on problem:

Windows Update and the official Insider ISO both fail to complete Setup on this device.

Setup terminates before reaching partition selection, with:

"Windows can't be installed because this PC has an unsupported disk layout for UEFI firmware."

However, Panther logs (setupact.log / setuperr.log) show an earlier, more specific failure

during Authenticode signature verification of Facilitator.dll (and Mitigation.dll is

referenced but does not appear to exist as a standalone file in this build's install.wim),

returning error 0x800B0109 (CERT_E_UNTRUSTEDROOT).

I extracted Facilitator.dll directly from install.wim (index 6, Windows 11 Pro) inside the

official ISO (Windows11_InsiderPreview_Client_x64_en-us_29617_1000.iso) and inspected its

certificate chain manually:

Get-AuthenticodeSignature returns Status: UnknownError, with the underlying chain

terminating at:

Subject: CN=Microsoft Development Root Certificate Authority 2014

Issuer: CN=Microsoft Development Root Certificate Authority 2014 (self-signed)

Thumbprint: F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB

Intermediate:

Subject: CN=Microsoft Development PCA 2014

Thumbprint: 5F444A6740B7CA2434C7A5925222C2339EE0F1B7

Leaf:

Subject: CN=Microsoft Windows, O=Microsoft Corporation

Thumbprint: 1B5C9E0CFDFD9CD0744637D8B2D3B62B5081C467

NotBefore: 2025-05-15, NotAfter: 2026-08-11

This is an internal Microsoft development signing root, not part of the public trust chain,

which is why the file fails Authenticode verification on a standard, fully-patched consumer

system (this is expected behavior for a dev-signed file — the concern is that a

publicly-distributed Insider ISO appears to contain a component still signed with an

internal dev certificate rather than the production signing chain).

System context:

- Previous build: 26200.8894, with KB5121767 installed successfully

- UEFI boot, Secure Boot enabled, TPM 2.0 enabled

- SFC /scannow and DISM /RestoreHealth both completed with no integrity issues

- System clock verified correct; root certificate store refreshed via

certutil -generateSSTFromWU (returned "No Updates!", consistent with this root not

being part of the public WU root catalog)

- Confirmed by extracting Facilitator.dll directly from install.wim via DISM mount,

bypassing any local system state entirely — so this is a property of the ISO/build itself,

not a local misconfiguration

Requesting: please confirm whether this is a known signing issue in this specific flight,

and whether a corrected build/servicing update is planned.

Your logs show two separate blockers: certificate trust error 0x800B0109 and the UEFI disk-layout message. Microsoft’s SetupDiag guidance says that when multiple failures are present, the last failure is typically fatal, so the earlier Authenticode entry does not prove it caused the rollback. First, run the latest SetupDiag as administrator and review its result together with setupact.log and setuperr.log. Then enable the CAPI2 Operational log, reproduce the signature check, and inspect events 11 and 30 for the failing certificate chain. Do not import an arbitrary root certificate. Separately, run Get-Disk and confirm the operating-system disk uses GPT. If it is MBR, back up first and run mbr2gpt /validate /allowFullOS; convert only if validation succeeds, then retain UEFI firmware mode. I cannot confirm this exact failure as a documented known issue. If both checks pass, file Feedback Hub feedback with the SetupDiag, Panther, and CAPI2 logs, build, channel, and ISO details.