This is the hub page for my posts on the Secure Boot certificate transition and the BlackLotus revocations. This series focuses on Microsoft Configuration Manager: PXE, boot images, and task sequence media. Everything in the posts was tested in my lab. I’ve included detailed information (file sizes, log lines, and screenshots) that can be used to compare against your own environment.
Start here
- Secure Boot 2023 Certificates and ConfigMgr OSD - the overview: what the firmware checks, where Configuration Manager stages those files, and the order of operations.
The deep dives, in order
- Using the ConfigMgr 2023 Boot Loader Checkbox - what the checkbox changes (a package flag and one staging folder), what it does not change (the WIM and media), and how to prove what a client received from the responder log.
- Secure Boot 2023 on WDS-Based Distribution Points - why they behave differently from the responder, the rule that decides which loader every client gets, how to roll it back, and how to switch the DP to the responder.
- Patching winpe.wim and Task Sequence Media in 2026 - the cumulative update procedure with the common pitfalls, and why the in-WIM swap fixes media.
- Testing KB5025885 Steps 3 and 4 - what a device refuses after each revocation step, how to read the “Secure boot version check failed” screen, what moves the Step 4 floor, what happens when a task sequence deploys Windows to a revoked device, and what the OEMs say about applying Step 3 at all.
Look-ups
- Reference and Troubleshooting - the “who can boot what” matrix, the version screen decoder, the verification commands, file sizes and hashes, and a symptom table.
- SVN History and Release Tracker - every boot manager Security Version Number since 2024 and the other values that change every month.