Error when creating new ISO with Updated Secure Boot Certs

If you have a physical DVD, there is a special boot sector. But everyone uses some tool to convert the ISO image into an USB drive, and the BIOS doesn’t use a boot sector on removable USB drives. I honestly don’t know what happens if you were to create an actual physical DVD, because no one discusses that procedure.

Instead the UEFI searches on a FAT32 filesystem, for a file named bootmfgw.efi or bootx64.efi (as the fallback if bootmgfw.efi is missing). This file chain boots into winload.efi, which ultimately starts up Windows.

For Windows, bootmgfw.efi and bootx64.efi are identical files, but are sometimes copied to into different locations if the boot media is WinPE-based (bootx64.efi) or WinRE-based (bootmgfw.efi). WinRE implies basically you get a copy of almost all of the extra files (ie. fonts, policy files).

Every W10 22H2 and W11 release has both sets of boot files in parallel folders, \Windows\Boot\EFI and \Windows\Boot\EFI_EX. The only difference being which signing cert is used for each version. The ISO defaults to having the CA 2011 version written to \EFI\Boot\bootx64.efi.

What Rufus or the official MS script Make2023BootableMedia.ps1 does is pick boot files from the EFI_EX (CA 2023) folder.

Suppose we’re outside of NTLite or another tool. If you have a pre-existing USB boot device you can switch the boot manager with:

WinPE:
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi E:\EFI\boot\bootx64.efi

WinPE:
bcdboot /s E: /f UEFI /bootex

The difference being if you used bcdboot, don’t forget to preserve the original BCD file under \EFI\Microsoft\Boot, because it will get overwritten. Technically you could just remember exactly which files that bcdboot copies, but it’s easily to run bcdboot. The rules for updating the boot media equally apply to if you’re using Macrium or Hasleo to build a recovery USB.

Old Macrium 8 is too dumb (because it’s outdated) to known about the new boot files. Macrium X and Hasleo do know about them.