Windows 10: Can I still get other security updates if I can't install KB5012170

Hi there : .. apologies if this is a dumb question and it's related to this thread in a wayhttps://answers.microsoft.com/en-us/windows/forum/all/kb5012170-security-update-for-secure-boot-dbx/699b8c9b-6b97-4216-acd4-b86d91bb9cf9 That particular security update for Windows 10 refers to secure boot which my ancient motherboard does not support to begin with so of course it won't install on my version of Windows at all and yep I know I need to upgrade my hardware so my PC will support Windows 11 come the year 2025, replacing my motherboard/CPU/RAM with something more modern is on the to

:)

 

KB5012170

Hello Bradley,

Microsoft had released KB5012170 to Windows 11 version 22H2. It has already been released for previous versions on August 9.

KB5012170: Security update for Secure Boot DBX: August 9, 2022

 

KB5012170: Security update for Secure Boot DBX: August 9, 2022 - Install error - 0x800f0922

I've been fighting the same issues all day. KB5012170 fails to install with error 0x800f0922. Looking through C:\Windows\Logs\CBS\CBS.log reveals errors pointing to BitLocker (which is a red herring) and Secure Boot (the real culprit).

I finally got it to install successfully as follows:

1. Open a cmd.exe or powershell.exe window running as Administrator

2. dism.exe /online /cleanup-image /restorehealth

3. sfc /scannow

4. Reboot

5. Manually download the MSU appropriate for your Windows version directly from the Microsoft Update Catalog here: Microsoft Update Catalog

6. Double click the MSU file to install

This still didn't work for me, but it did clean up the CBS store and allowed me to successfully install the August 2022 Cumulative Update. However, manually installing KB5012170 still failed with the same error as Windows Update in Settings: 0x800f0922

Next, I also performed these additional steps:

7. Reboot into UEFI BIOS

8. Enabled Secure Boot (it was disabled in my case) => Note: This alone didn't work for me. I also needed to do the next step.

9. Clear Secure Boot keys (i.e. reset the Secure Boot keys to default factory settings)

10. Save and exit UEFI BIOS

After this, I repeated Steps 1-6 above and the KB5012170 MSU package successfully installed.

Not sure if this will work for everyone, but since KB5012170 updates the Secure Boot Forbidden Signature Database (DBX) in UEFI, clearing the old and potentially stale boot keys and resetting to factory defaults allowed the update to install required changes to DBX.

Motherboard: Asrock Z87 Extreme6/ac

 

KB5012170: Security update for Secure Boot DBX: August 9, 2022

Read more: https://support.microsoft.com/en-us/...8-c42bd211bb15