Windows Deployment Services with MDT - Updating Boot Image to 2023 Boot Certificates

[DavR]

Has anyone managed to do this yet in their environment? 

The majority of our devices built in WDS / MDT with the expiring 2011 boot certs just fine, even though their firmware was updated to use the 2023 certs. One model of HP laptop, though, stubbornly refuses to.

 

It started with error 272 on the initial boot. This was resolved by updating wdsmgfw.efi and bootmgfw.efi to 2023-certified versions, so now the device boots to WDS, and WDS itself is 2023 cert ready.

 

However, the next step is it hits the boot image wim and fails to boot into it, with error 428 below (not my image, borrowed). OK, so this means its a signature fail between the device and the boot image. But I've tried everything I can, and cannot get a boot image that works! I've tried updating the wim from ADK 10.1.26100 Dec 2024 with updated bootmgfw.efi. I've tried the wim from the newest ADK 10.1.28000 nov 2025. I've tried this guide, this guide and this note, but none of them seem to do it.

 

I could just turn off secure boot during build, I suppose. But given that the 2011 certs will get revoked one day, it seems like I should be getting my boot images Cert 2023 ready. Any ideas?