Event details

Whether you're actively managing device security or planning your next steps, this AMA is your opportunity to connect directly with Microsoft experts and get clear, actionable guidance on updating Se...
Heather_Poulsen
Updated Jun 04, 2026
AMA
ClientAdmin's avatar
ClientAdmin
Brass Contributor
Jun 01, 2026

Hi JonasKrueger​ 
Maybe I can help you on this point.
The new option "Use Windows Boot Loader signed with Windows UEFI CA 2023" is only for PXE Responder without Windows Deployment Service. If you don't configure the PXE with "Eanble a PXE responder wihtout Windows Deployment Service" the UEFI CA 2023 option has no effect.

If you still want to rely on PXE with WDS you need to copy wdsmgfw.efi and bootmgfw.efi from %windir%\System32\RemInst\boot_EX\x64 from your up to date server to %RemoteInstallFolder%\SMSBoot\x64. Then remove the "_EX" suffix from the files.

I hope this information helps.

Kind regards,
Matias

 

robbinsa's avatar
robbinsa
Copper Contributor
Jun 04, 2026

Thank you, I will try this out. I have been mounting and patching winpe.wim trying to get a 2023 signed copy of bootmgfw.efi to copy out to ADK as bootx64.efi as I'm sure I had done about a year and a half ago, and I just keep getting 2011 signed .efi files except for bootmgfw_EX.efi. I kept the files to manually swap out, but trying to avoid that if possible. I don't recall simply renaming and overwriting, but maybe that's what I had done.

Then the next step was to try to address for WDS and I haven't been able to get any AMA replies about this, or even on my opened MS case via 3rd party. If struggling with WDS, next step to try moving away from it working with the NET team on iphelpers and DHCP options.