Windows 10: Secure Boot Failure after Installing Microsoft Windows 10 November 2018 Update

I am the Information Technology Director for the school district at which I work. After applying the November 2018 Cumulative update, all of my Lenovo Yoga Laptop (ThinkPad) - Type 20CD laptops are unresponsive and will not boot past this screen:



After changing Secure Boot to Disabled in the BIOS, the laptops will load the OS--this is not a solution! Obviously, the update(s) has/have made changes causing the secure boot to fail, I would like an explanation for the manipulation of the boot files...

:)

 

Microsoft Security Bulletin(s) for November 2018

Release Notes
November 2018 Security Updates
Release Date: November 13, 2018






The November security release consists of security updates for the following software:

• 
  
  [*]Internet Explorer
  [*]Microsoft Edge
  [*]Microsoft Windows
  [*]Microsoft Office and Microsoft Office Services and Web Apps
  [*]ChakraCore
  [*].NET Core
  [*]Skype for Business
  [*]Azure App Service on Azure Stack
  [*]Team Foundation Server
  [*]Microsoft Dynamics 365 (on-premises) version 8
  

Please note the following information regarding the security updates:

• 
  
  [*]A list of the latest servicing stack updates for each operating system can be found in
  
  ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.
  [*]Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the
  
  Microsoft Update Catalog.
  [*]Starting in March 2017, a delta package will be available on the Microsoft Update Catalog for Windows 10 version 1607 and newer. This delta package contains just the delta changes between the previous month and the current release.
  [*]Updates for Windows RT 8.1 and Microsoft Office RT software are only available via
  
  Windows Update.
  [*]For information on lifecycle and support dates for Windows 10 operating systems, please see
  
  Windows Lifecycle Facts Sheet.
  [*]In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.
  

The following CVEs have FAQs with additional information and may include * further steps to take after installing the updates.

• 
  
  [*]ADV180025
  [*]CVE-2018-8407
  [*]CVE-2018-8408
  [*]CVE-2018-8454
  [*]CVE-2018-8545
  [*]CVE-2018-8558
  [*]CVE-2018-8563
  [*]CVE-2018-8565
  [*]CVE-2018-8573
  [*]CVE-2018-8578
  [*]CVE-2018-8579
  [*]CVE-2018-8581*
  [*]CVE-2018-8592*
  

Known Issues

• 
  
  [*]4467691
  [*]4467696
  [*]4467686
  [*]4467702
  [*]4467107
  

{{windowTitle}}

 

Windows 10 Update

Well just noticed a pretty large one pop up coming in at 914MB, seems it makes some pretty serous updates.

KB3172985
https://support.microsoft.com/en-us/kb/3172985

This security update includes improvements and fixes in the functionality of Windows 10 Version 1511 and Windows Server 2016 Technical Preview 4. It also resolves the following vulnerabilities in Windows:

• 3175677 MS16-094: Security update for secure boot: July 12, 2016
• 3174060 MS16-093: Security update for Adobe Flash Player: July 12, 2016
• 3171910 MS16-092: Security update for Windows Kernel: July 12, 2016
• 3170048 MS16-091: Security update for .Net Framework: July 12, 2016
• 3171481 MS16-090: Security update for Kernel Mode Drivers: July 12, 2016
• 3170050 MS16-089: Security update for Windows secure kernel mode: July 12, 2016
• 3170005 MS16-087: Security update for the Microsoft Print Spooler: July 12, 2016
• 3169999 MS16-085: Cumulative security update for Microsoft Edge: July 12, 2016
• 3169991 MS16-084: Cumulative security update for Internet Explorer: July 12, 2016

 

Microsoft Botches Up UEFI Support for Windows 7 on ASUS Motherboards



Microsoft suggests updating to Windows 10 to patch Windows 7

• 
  
  
• Chris Merriman
• 
  @ChrisTheDJ
• 05 May 2016

• Tweet
• Facebook
• Google plus
• Send to

9 Comments

MICROSOFT HAS confirmed a potentially lappy-borking problem that it won't be fixing, because Windows 7.

Woody Leonhard, the respected Windows columnist, points to a problem involving Asus motherboards, which also appear rebadged in a variety of other manufacturers' machines, and the activation of UEFI Secure Boot for Windows 7 in a patch KB3133977.

Short version: install update, welcome to Borksville, population you.

Both Asus and Microsoft acknowledged the problem. Microsoft entitled the article "BitLocker can't encrypt drives because of service crashes in svchost.exe process in Windows 7 or Windows Server 2008 R2", but we prefer to just call it "Trevor for brevity."

The firm's advice was that it's an optional update, leave well alone, you'll be fine, or alternatively turn secure boot off.

Then Microsoft did a silly, silly thing.

It moved the update from 'optional' to 'recommended' and anyone who reads this site regularly will know what happens when Microsoft does this. That's right boys and girls - it makes it automatically install, unless you've specifically told your machine not to.

So now, if you have one of the affected motherboard and you keep your security updates automatic like wot Microsoft recommends, then your machine will stop working properly.

We should add it's not permanently bricked, but it will take some mucking about in the BIOS to fix and that's a pain even for an experienced computer user.

Microsoft has, by offering a workaround, suggested heavily that it won't be fixing the problem, though we have asked the question, so expect a response in about a fortnight.

But the real kicker is this piece of advice: "Note The Secure Boot feature is supported in Windows 10. To learn more about the security advantages of this feature and about the upgrade path from Windows 7 to Windows 10, go to the following Windows website"

Holy toledo, this company really knows how to rub people up the wrong way.

After all - if the advice is to manually avoid the update or move to a version of the operating system where there's virtually no control over updates, then Microsoft is dealing in massive contradictions.

A more cynical site would suggest that it's yet another example of Microsoft running Windows 7 into the ground and adding built in obsolescence to encourage quicker updates. But we're not that sort of site.

Its the patching to force secure boot that is the problem win 7 does not support secure boot
hence it borks systems and well microsofts answer is Cactus >your Asshole > insert

from the inquirer