BitLocker Loop / Soft-Brick After Secure Boot 2023 Certificate Update (ASUS ROG G713QE)
Hello, following the June 2026 Windows Update regarding the transition to "Microsoft UEFI CA 2023" Secure Boot keys, my machine (ASUS ROG Strix G713QE, AMD Ryzen CPU with fTPM) experienced a critical failure cascade leading to an infinite BitLocker recovery loop. Exact Step-by-Step Failure Chronology: Initial Post-Update Boot: The machine booted directly into the blue BitLocker Recovery screen, prompting for the 48-digit recovery key. First Unlock & WinRE Access: Entering the correct 48-digit key successfully decrypted the drive and allowed access to the Windows Recovery Environment (WinRE). Standard Recovery Failures: All default automated repair methods (Startup Repair, etc.) failed, systematically looping back to the WinRE menu. Failed Update Uninstall: Attempting to use the "Uninstall latest quality/feature update" option threw an error stating that Windows could not uninstall the update due to an update currently in progress. (Note: This strongly suggests that pending transaction flags or file-lock attributes in the Component-Based Servicing store were never cleared due to the unfinalized update state). System Restore Attempt: A System Restore point was selected. The progress bar completed successfully, and the validation/success pop-up appeared. A reboot was then triggered. The Hard Loop: Upon this post-restore reboot, the system fell into an infinite BitLocker loop. Entering the 48-digit key now causes an immediate crash/reset, completely locking out any further access to the Windows Recovery Environment (WinRE). Current Root Cause Analysis: The only way to regain temporary access to the OS was to perform a full UEFI BIOS reflash, which allowed exactly one functional boot (rebooting at this state threw us back to the BitLocker hard loop). Once inside, the loop was permanently stabilized by executing the following command in an elevated prompt to purge the stuck transaction: DISM /Online /Cleanup-Image /RevertPendingActions BitLocker protection has also been suspended (manage-bde -protectors -disable C:) to prevent the TPM from locking up the system again. There is a major structural conflict on this motherboard generation between the new Microsoft CA 2023 certificate write-orders in the NVRAM, the CBS transaction state, and the ASUS fTPM firmware validation. Please deploy a BIOS fix or implement a compatibility safeguard hold on Windows Update for this hardware profile.
