注意：如何解决Windows Server 2008 R2 EFI启动模式安装2019年8月更新KB4512486 KB4512506 KB4512514后自动进入修复模式，无法正常启动问题！！！

淡淡的烟草味﹌ 2024-04-18 16:56 46阅读 0赞

2019.12月发现累积几个月的更新没有重启动，

重启动后BIOS模式也遇到启动自动进入恢复模式了,使用

dism.exe /image:c:\\ /cleanup-image /revertpendingactions

取消更新，正常启动后继续安装更新正常。

————————————————————————————————————————————————————————

早期原文：

EFI模式请慎重安装KB4512486 KB4512506 KB4512514

物理机或者虚拟机EFI模式启动将有问题，BIOS模式启动的没问题！

<table> 
 <tbody> 
 <tr> 
 <td> IA64 设备（在任何配置中）和使用预配的 EFI 启动的 x64 设备在安装 7 月 9 日的更新和/或跳过建议的更新 (<a href="https://support.microsoft.com/zh-cn/help/3133977" rel="nofollow">KB3133977</a>) 之后，可能无法启动并出现以下错误： “文件: \Windows\system32\winload.efi 状态: 0xc0000428 信息: Windows 无法验证此文件的数字签名。”</td> 
 <td> 要解决此问题，请按照针对错误代码 0xC0000428 的&nbsp;<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4472027%2F2019-sha-2-code-signing-support-requirement-for-windows-and-wsus&amp;data=02%7C01%7CChristine.Ahonen%40microsoft.com%7C46c9cc2392114131417808d72341be56%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637016637622234224&amp;sdata=GrNP4b5ywE8RX1QQSNTyk3Dxh6QseEUaxACtOHJMpCg%3D&amp;reserved=0" rel="nofollow">SHA-2 支持常见问题解答</a>文章中概述的步骤进行操作。 </td> 
 </tr> 
 </tbody> 
</table>

<table> 
 <tbody> 
 <tr> 
 <td> IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (<a href="https://support.microsoft.com/en-us/help/3133977" rel="nofollow">KB3133977</a>), may fail to start with the following error: "File: \Windows\system32\winload.efi Status: 0xc0000428 Info: Windows cannot verify the digital signature for this file."</td> 
 <td> To resolve this issue please follow the steps outlined in the&nbsp;<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4472027%2F2019-sha-2-code-signing-support-requirement-for-windows-and-wsus&amp;data=02%7C01%7CChristine.Ahonen%40microsoft.com%7C46c9cc2392114131417808d72341be56%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637016637622234224&amp;sdata=GrNP4b5ywE8RX1QQSNTyk3Dxh6QseEUaxACtOHJMpCg%3D&amp;reserved=0" rel="nofollow">SHA-2 support FAQ</a>&nbsp;article for error code 0xc0000428. </td> 
 </tr> 
 </tbody> 
</table>

处理方法如下：

自动进入修复模式,界面如下（如没自动进入修复模式，也可以从安装光盘引导，选择R进入修复模式）：

也可使用MSDaRT光盘(不需要本地Administrator帐号密码)MSDaRT **全称是：Microsoft Diagnostics and Recovery Toolset**（**微软诊断和恢复工具集**）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70][]

此时按下一步按钮,之后的界面选命令行恢复,在命令行提示符下输入dism.exe /image:c:\\ /cleanup-image /revertpendingactions

如下图：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 1][]

完成后按提示选择重启动,系统可以启动到更新回滚界面,如下图：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 2][]

回滚完成后可正常登录系统；

登录系统后需要先安装KB3133977更新，重启动系统后再安装KB4512486 KB4512506 KB4512514；

以上修复方法经过测试。

另一种方法，恢复模式下DISM安装KB3133977更新包，测试重启动后还是进入恢复模式,不能恢复正常,该方法无效。

操作命令如下：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 3][]

再另一种方法，恢复模式下删除更新包，测试重启动后还是进入恢复模式,不能恢复正常,该方法无效。

操作命令如下：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 4][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 5][]

参考国外谈论：

Site Feedback

[FE][]

[Fearless96][FE]Created on August 17, 2019

## KB4512506 / KB4512486 winload.efi Windows cannot verify the digital signature ##

TLDR - After you uninstall the broken update to get your OS working again, install KB3133977 and try again.

The full story:

Until I fixed it, I couldn't boot after installing KB4512506 or KB4512486 - Windows cannot verify the digital signature of winload.efi.

On the first boot failure I had to recreate the BCD. On every subsequent failure I had to uninstall the update via the recovery console.

I already had KB4474419-v2 installed and no 3rd party antivirus. Dism /Online /Cleanup-Image /CheckHealth found no corruption.

I restored a system image to a spare HDD and booted it to troubleshoot. I found that installing all optional updates fixed the issue. I didn't want that to be the solution for my permanent OS so I investigated further. I eventually installed only KB3133977 to fix the issue. (That update is for a BitLocker issue but I don't use BitLocker. I don't know why it helped.)

I recommend this discussion (81)



### Discussion Info ###

--------------------

Last updated September 9, 2019Views 2,167Applies to:

*  [Windows 7][]
 *  
 *  /
 *  
 *  [Windows update, recovery, & backup][Windows update_ recovery_ _ backup]

### [Replies (3) ][Replies _3_] ###

[DA][]

[DannyMoses][DA]Replied on August 20, 2019

Thank you for the tip. Downloading and installing KB3133977 allowed me to finally, successfully install KB4512506 on my Windows 7 SP1 X64 system.

Up vote (7)

[ED][]

[EdwardG1345][ED]Replied on August 22, 2019

This fix applies to Windows Server 2008 R2 as well. After installing, in August 2019, Microsoft Security Only Patch KB4512486, all our physical 2008 R2s rebooted into System Recovery and the only fix we could find was to revert via "dism.exe /image:C:\\ /cleanup-image /revertpendingactions". Needless to say, this prevented the patch from being installed. I recently found this post, gave it a shot with the 2008 R2 x64 version of KB3133977, and now the servers are good to go. Thanks for finding this.

Up vote (9)

[SL][]

[sleighty][SL]Replied on August 27, 2019

Just an FYI for those having issues getting KB3133977 to install - KB3125574 supersedes 3133977.

[https://support.microsoft.com/en-us/help/3125574/convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2][https_support.microsoft.com_en-us_help_3125574_convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2]

[![Image][]][Image 1]

Up vote (4)

## Windows Updates KB4512506/KB4512486 drops error 0x80092004 ##

Posted on [2019-08-14][] by [guenni][]

![Windows Update][]\[[German][]\]A brief information for users who install the August 2019 security updates KB4512506 or KB4512486 for Windows 7 SP1 and Windows Server 2008 R2 in an installation error 0x80092004. It is highly likely that updates to retrofit SHA-2 support will then be missing.

--------------------

Advertising

--------------------

### Users report error 0x80092004 ###

![format_png][]It didn’t take long after the release of the security updates KB4512506 (Monthly Rollup) or KB4512486 (Security Only) for Windows 7 SP1 and Windows Server 2008 R2 until the first users reported issues within my German blog. German blog reader Heidemann wrote in [this comment][]:

> The attempt to install the update to W2K8R2 fails here with Installation Failure: Windows failed to install the following update with error 0x80092004: Security Update for Windows (KB4512486).
> 
> No Symantec or Norton (but McAfee) on the systems.

And a short time later M. Gruber posted [this comment][this comment 1] with the same tenor, but to another German blog post.

> I repeatedly fail to install KB4512506 (Monthly Security Quality Rollup) with code 80092004 under a naked Win7 x64 without AV software.  
> Am I the only one or is there a workaround?

The user then pointed out similar feedback from users in the [English DSL forum][].

> I can’t install KB4512506 on two different Windows 7 64 bit systems. Each one fails with the error code: 80092004. Multiple restarts and retries result in same error. Anyone else seeing this?

I found also a [japanese post][] mentions this error code without giving further hints.

### The error has already occurred with .NET ###

I mentioned the error code 0x80092004 in some blog posts (see links at the end of the article) and Microsoft also published [a KB article][] about the error. However, this KB article refers to a bug in the .NET framework that prevents updates from being installed. However, I don’t consider this to be a valid cause, as these are currently Windows updates.

--------------------

Advertising

--------------------

### What does error code 0x80092004 stands for? ###

Before you start any wild experiments, it’s good to know what the cause of the error is. The error code 0x80092004 stands for CRYPT\_E\_NOT\_FOUND. Windows Update could not find any cryptographic value and rejects the update.

### There was something SHA-2 signing? ###

I had it mentioned in the blog post [Symantec/Norton blocks Windows Updates (SHA-2)][Symantec_Norton blocks Windows Updates _SHA-2]. Microsoft changed the signing of update packages for Windows 7 SP1 and Windows Server 2008/R2 for the first time in August 2019. Instead of signing the packages with both SHA-1 and SHA-2, only a SHA-2 hash value is stored in the package. The above error code indicates that Windows Update is looking for the SHA-1 signature in the package and does not find it.

### What should be checked ###

One possibility is that an external virus scanner recognizes and modifies the update packets incorrectly. The blog post [Symantec/Norton blocks Windows Updates (SHA-2)][Symantec_Norton blocks Windows Updates _SHA-2] mentions that Symantec and Norton security solutions cause trouble. In this scenario, however, Microsoft blocks the delivery of security updates.

Weighting the above information, there is a lot of evidence that the support for the new updates and Windows signed exclusively by SHA-2 is simply missing. As of March 12, 2019, Microsoft had extended support article [4472027][] (2019 SHA-2 Code Signing Support requirement for Windows and WSUS) to include the SHA-2 updates required for Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, and Windows Server 2008 Service Pack 2.

*  Update [KB4474419][] (SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7: March 12, 2019) adds support for SHA-2 signature checks for the above operating systems.
 *  In addition, the Servicing Stack Update [KB4490628][] was published in March 2019. This fixes a problem in the Servicing Stack, which occurs as soon as packages are signed with SHA-2 only.

I had mentioned within my blog post [Windows 7: Updates for SHA-2 support][Windows 7_ Updates for SHA-2 support], that it’s required both updates are installed. Within my German [comment here][] I had recommended checking to see if the relevant updates were available. In fact, blog reader M. Gruber [reported here][] that the SSU KB4490628 was missing on his machine. After installing the Servicing Stack Update (SSUs) from March 2019, the August 2019 security update for Windows 7 SP1 and Windows Server 2008 R2 was successfully installed. And I got a 2nd feedback, that this was the root cause for the update install error. Perhaps it will help one or the other affected person.

**Similar articles**  
[Fix for .Net Framework Update KB4340558 error 0x80092004][]  
[.Net Framework: Update KB4340558 drops error 0x80092004?][.Net Framework_ Update KB4340558 drops error 0x80092004]  
[Patchday: Updates for Windows 7/8.1/Server (August 13, 2019)][Patchday_ Updates for Windows 7_8.1_Server _August 13_ 2019]  
[Symantec/Norton blocks Windows Updates (SHA-2)][Symantec_Norton blocks Windows Updates _SHA-2]  
[Windows 7: Updates for SHA-2 support][Windows 7_ Updates for SHA-2 support]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/841a384dfe6a4f90950f0767d56c2c13.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/0a29ba2c416b458daeb690f4e7260464.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/ac3e8e3732984e89b1a06eab0e42b6d1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 3]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/6060c60a66e446599f8e2c08358c355d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 4]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/88e34195e4bd4608b80a7f40c5bb3182.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2FsbHdheTI_size_16_color_FFFFFF_t_70 5]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/18/0a0aef395e5c43318de647c614e1246c.png
[FE]: https://answers.microsoft.com/en-us/profile/0a61d1bf-3bfc-4648-ab38-099725fe3168
[Windows 7]: https://answers.microsoft.com/en-us/windows/forum/windows_7?tab=Threads
[Windows update_ recovery_ _ backup]: https://answers.microsoft.com/en-us/windows/forum/windows_7-update?tab=Threads
[Replies _3_]: https://answers.microsoft.com/en-us/windows/forum/all/kb4512506-kb4512486-winloadefi-windows-cannot/228fbffc-e64d-4976-9530-e0e818bd3c59?tab=AllReplies#tabs
[DA]: https://answers.microsoft.com/en-us/profile/119a3265-dd37-427b-9e84-d46cc8529ef3
[ED]: https://answers.microsoft.com/en-us/profile/ab77275a-413d-434b-b3df-41b7c80bf518
[SL]: https://answers.microsoft.com/en-us/profile/4302afa8-1eb8-4cab-8aa2-0e2051ba331d
[https_support.microsoft.com_en-us_help_3125574_convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2]: https://support.microsoft.com/en-us/help/3125574/convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2
[Image]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9maWxlc3RvcmUuY29tbXVuaXR5LnN1cHBvcnQubWljcm9zb2Z0LmNvbS9hcGkvaW1hZ2VzLzVmNDdjYzZiLTA1ZGUtNDVmZS1hYjExLWNmYTQ4MjAyODRjYT91cGxvYWQ9dHJ1ZQ?x-oss-process=image/format,png
[Image 1]: https://filestore.community.support.microsoft.com/api/images/5f47cc6b-05de-45fe-ab11-cfa4820284ca?upload=true
[2019-08-14]: https://borncity.com/win/2019/08/14/windows-updates-kb4512506-kb4512486-drops-error-0x80092004/
[guenni]: https://borncity.com/win/author/guenni/
[Windows Update]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly93d3cuYm9ybmNpdHkuY29tL2Jsb2cvd3AtY29udGVudC91cGxvYWRzLzIwMTUvMDIvVXBkYXRlLmpwZw?x-oss-process=image/format,png
[German]: https://www.borncity.com/blog/2019/08/14/windows-updates-kb4512506-kb4512486-verursachen-error-0x80092004/
[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly92ZzAxLm1ldC52Z3dvcnQuZGUvbmEvNjEyMTZiNzk2OGEzNGMzZTgyNGQzMDExMmQwNDIxZDU?x-oss-process=image/format,png
[this comment]: https://www.borncity.com/blog/2019/08/14/patchday-updates-fr-windows-7-8-1-server-13-august-2019/#comment-76291
[this comment 1]: https://www.borncity.com/blog/2019/08/14/kritische-windows-patches-cve-2019-1181-cve-2019-1182-zum-13-august-2019/#comment-76300
[English DSL forum]: https://www.dslreports.com/forum/r32478603-Microsoft-August-2019-Security-Updates
[japanese post]: https://freesoft.tvbok.com/cat97/2019/wu_memo_2019_08.html
[a KB article]: https://support.microsoft.com/de-de/help/4345232/0x80092004-error-and-updates-kb4340557-and-kb4340558-don-t-install-aft
[Symantec_Norton blocks Windows Updates _SHA-2]: https://borncity.com/win/2019/08/14/symantec-norton-blocks-windows-updates-sha-2/
[4472027]: https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus
[KB4474419]: https://support.microsoft.com/en-us/help/4474419
[KB4490628]: https://support.microsoft.com/en-us/help/4490628
[Windows 7_ Updates for SHA-2 support]: https://borncity.com/win/2019/03/19/windows-7-updates-for-sha-2-support/
[comment here]: https://www.borncity.com/blog/2019/08/14/patchday-updates-fr-windows-7-8-1-server-13-august-2019/#comment-76293
[reported here]: https://www.borncity.com/blog/2019/08/14/kritische-windows-patches-cve-2019-1181-cve-2019-1182-zum-13-august-2019/#comment-76308
[Fix for .Net Framework Update KB4340558 error 0x80092004]: https://borncity.com/win/2018/08/28/fix-for-net-framework-update-kb4340558-error-0x80092004/
[.Net Framework_ Update KB4340558 drops error 0x80092004]: https://borncity.com/win/2018/07/11/net-framework-update-kb4340558-drops-error-0x80092004/
[Patchday_ Updates for Windows 7_8.1_Server _August 13_ 2019]: https://borncity.com/win/2019/08/14/patchday-updates-for-windows-7-8-1-server-august-13-2019/