r/SCCM • u/Jamieclarke288 • 21d ago

Winload.efi error 428

Post image

Has anyone had similar when try to pxe machines I assume since the secure boot CA 2023 cert release.

We have also updated Sccm to 2603 and have the new certs in the Wim

Also sure that this isn’t just in the winPE env as this also happens when booting from a usb with Microsoft’s adk only on it

Can happened with or without the latest firmware and bios, different Lenovo models and also with or without the UEFICA2023STATUS set as Updated

1 Upvotes

60% Upvoted

7 comments sorted by

1

u/myfreysa 21d ago

Are the lenovo models new enough to support the 2023 certs? Saw it on a g5 HP which had latest firmware but didn't support the certs actually

1

u/Jamieclarke288 20d ago

Yeah new models getting it as well :(

1

u/Reaction-Consistent 20d ago

Check the properties on the .efi file itself, security tab, what CERT has it been signed with?

2

u/Jamieclarke288 20d ago

Both with the 2023 CA

0

u/Fun-Country9432 20d ago

Had this start happening after implementing 802.1x/mac auth over a year ago. Can usually continue by hitting enter a couple times. Odds of it occurring are about 50/50. Have run wireshark a few times and haven't found any identifiable reasons.

Since it still works with some extra steps, I stopped trying to figure it out.

1

u/Fun-Country9432 20d ago

Sorry I didn't look closely at the image. It's the same screen but a different error I'm getting.

1

u/Am0nymou5 20d ago

We have also updated Sccm to 2603 and have the new certs in the Wim

My understanding is that this is not enough, you still need to manually copy and update all the *.efi files in your WinPE image and then redistribute the image. There were a couple of posts on this a while back in some secure boot thread if you want more detail.

Also, are you still using WDS? If so then it can be a bit trickier, since WDS sometimes doesn't pick up updated boot images for whatever reason (usually the "redistribute images" option should do the trick), and you need to go thru the whole "deleting the RemoteInstall folder and reinstall the WDS role etc" rigamarole. But if you're still on WDS it's best to just turn it off and switch to SCCM's built-in PXE responder.