What Is the Root Cause of the Problems with Windows Updates, Secure Boot, and IGEL OS?
Microsoft raised the requirement for the version of the bootloader GRUB via Windows Update, writing it into a read-only EFI variable that cannot be rolled back once applied.
Which Windows Update Can Cause a Problem?
The specific Windows update that introduced the grub,5 requirement has not been confirmed. Also, there is no confirmation about when grub,6 will be required.
What Can Happen When I Run a Windows Update on a Device/Image on which UD Pocket, IGEL OS Dual Boot, BC&DR, or the IGEL OS SCCM Add-on is Used?
Your Windows Update may be the one enforcing the grub,5 requirement. Any IGEL OS boot chain still on a previous GRUB version causes a “Security Violation” message. To boot the device into Windows, the BitLocker recovery key may be required.
This affects UD Pocket, Dual Boot, BC&DR, and SCCM deployment images.
Which Versions of IGEL OS Contain a Fix?
The following versions of IGEL OS have grub,6 which fixes the problem:
-
12.8.4 LTS PR2
-
12.10.1
-
12.11.0 (release planned in November 2026)
Is the Original 12.8.4 LTS Release Enough?
No – IGEL OS 12.8.4 Patch Release PR2 or later is required.
Are the Shim Updates for IGEL OS 12.8.4 PR2 Included in IGEL OS 12.10.1?
The GRUB/SBAT fix is part of IGEL OS 12.10.1; no shim update is required for SCCM. Shim remains unchanged (shim,4) in IGEL OS 12.10.1 for the SCCM boot chain.
Do Unaffected Devices Still Need Updating?
Yes. A device that has not received the relevant Microsoft revocation is unaffected today, but the update is expected to reach it over time. Proactive updates across all deployments are recommended.
Why Does the Same UD Pocket Work on One PC but Not Another?
The Secure Boot revocation policy is enforced on the host. Different hosts can have different SBAT levels even with similar Windows patch histories.
Is there a Preventive Workaround?
If your device has not yet received the update, i.e. the grub,6 requirement is not yet applied, you can add a Windows Registry entry as follows:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\SBAT" /v OptOut /t REG_DWORD /d 1 /f
Should I Reinstall BC&DR or Restore from Backup?
No, neither of the two. A reinstall or restore removes UMS registration and configuration, and the device still needs the updated bootloader. Use the in-place update as described in “Troubleshooting for IGEL OS Dual Boot (BC&DR): IGEL OS Does Not Boot with Secure Boot Enabled After Windows Updates”. Reinstall only if IGEL Support advises it.
Does the OSCW Shim Blocklist also Affect SCCM In-place Builds?
No, the OSCW shim blocklist does not affect SCCM.
Does IGEL OS Have a Certificate in the Boot Loader?
Yes. IGEL OS uses a shim bootloader signed by Microsoft's 3rd-party UEFI CA, which chainloads GRUB. There is no IGEL-owned certificate in the device BIOS, so IGEL remains dependent on Microsoft's signing/SBAT decisions.
When Migrating from Windows 11 to IGEL OS 12 via SCCM Task Sequence: Do I Need to Disable Secure Boot?
If the IGEL OS version to be deployed is on the list below, keep Secure Boot enabled.
-
12.8.4 LTS PR2
-
12.10.1
-
12.11.0 (release planned in November 2026)
If the IGEL OS version to be deployed is not on the list AND the device has already received the Windows update that raised the EFI SBAT policy, disable Secure Boot. Please note that disabling Secure Boot is a temporary workaround; it requires IT security approval and BitLocker recovery keys, since boot-environment changes can trigger BitLocker recovery.
How Is IGEL Reducing the Risk of Recurrence?
IGEL is evaluating a proactive prevention approach covering upstream monitoring, compatibility validation, updater readiness and earlier customer communication.