Cumulative Updates

OSD 23.5.15.1+ Updated May 15, 2023

I've added the ability to apply a Cumulative Update to an OSDCloud Template due to the Secure Boot vulnerability. The next two links give some details on the issue

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Supportsupport.microsoft.com

Update Windows installation media with Dynamic UpdateMicrosoftLearn

Download the Cumulative Update

Start by downloading the update from Microsoft Update Catalog and specifying the path to the downloaded update. Start by downloading the x64 version at this link if you are using the ADK for Windows 11 version 22H2

Microsoft Update Catalogwww.catalog.update.microsoft.com

Apply the Cumulative Update

Once you have the update downloaded, use the CumulativeUpdate parameter and supply the Path to the downloaded MSU. In the example below I applied this in my default OSDCloud Template as this will be the one I use the most

1. Cumulative Update is applied

2. Updated Windows Information is displayed

3. Boot files are updated

4. DISM Component Cleanup is run

Apply the WRONG Cumulative Update

It's absolutely possible to apply the wrong Cumulative Update for WinPE, so make sure you understand that the Cumulative Update that you download must match your ADK. So if you are using the ADK for Windows 11 version 22H2, you need the Windows 11 22H2 x64 Cumulative Update

1. Cumulative Update is applied

2. Updated Windows Information is displayed. In this case, the UBR did not change

3. Warning is displayed that the UBR has not been changed. The Boot files will not be updated

4. DISM Component Cleanup is run

I'm not properly staffed to answer individual questions about which Cumulative Update you need for the ADK you have installed. If this is not something you can resolve on your own, then you should probably wait for updated Media from Microsoft that already has the Secure Boot updates applied

The Code

If you are interested in reviewing how this works, here is a snipped from the New-OSDCloudTemplate function

OSD/Public/OSDCloudSetup/OSDCloudTemplate.ps1 at a8547e4868a9ff99fe7880fea52158ee5ff7642f · OSDeploy/OSDGitHub