ISO Black Lotus (KB5025885) Mitigations Causing Boot Issues in Win PE

This article focuses on the issue encountered while creating a Windows Preinstallation Environment (WinPE) using the Windows Server 2022 ADK with Microsoft Server operating system-21H2 security updates installed. The WinPE fails to boot in an ISO Virtual Machine (VM) after downloading and installing the updates. In this article, we will discuss the possible mitigations causing boot issues in WinPE and their solutions.

Understanding the Issue

The Microsoft Server operating system-21H2 security updates include several mitigations to enhance the security of the system. However, some of these mitigations may cause compatibility issues with older software or environments, such as WinPE. In this case, the WinPE fails to boot due to these mitigations.

Potential Mitigations

Disable Secure Boot

Secure Boot is a security standard that ensures that only trusted code is loaded during the boot process. Disabling Secure Boot in the VM settings may help resolve the boot issue. Here's how to do it:

 1. Open the VM settings.
 2. Go to the "System" tab.
 3. Uncheck the "Enable Secure Boot" option.
 4. Save the changes and restart the VM.
 

Disable Integrity Checks

Integrity checks are used to ensure that the files loaded during the boot process are not tampered with. Disabling integrity checks may help resolve the boot issue. Here's how to do it:

 1. Open the VM settings.
 2. Go to the "Options" tab.
 3. Under "Advanced," check the "Disable Integrity Checks" option.
 4. Save the changes and restart the VM.
 

Create a Custom WinPE Image

Creating a custom WinPE image with the necessary drivers and components may help resolve the boot issue. Here's how to do it:

 1. Download and install the Windows ADK.
 2. Open the "ImageX" tool.
 3. Mount the WinPE image using the "ImageX /mount  " command.
 4. Add the necessary drivers and components using the "DISM" tool.
 5. Create a new WinPE image using the "ImageX /export   /c:" command.
 

• The Microsoft Server operating system-21H2 security updates may cause boot issues in WinPE.
• Disabling Secure Boot or integrity checks may help resolve the issue.
• Creating a custom WinPE image with the necessary drivers and components may also help resolve the issue.

References:

• Microsoft: Secure Boot
• Microsoft: Integrity Checks
• Microsoft: Create a Custom WinPE Image