Lenovo Tiny Secure Boot issue

[HCHTech]

Well, this was a frustrating time-consuming demoralizing interesting issue I ran into this week. A client called that one of their workstations was booting to a blue screen. 0xc0430001 to be exact. This machine was new in August of 25, is currently on 25H2 and is under our management (RMM, MAV, EDR, etc.). A quick google of that stop code told me this is a secure boot issue:

(Error code 0xc0430001 is a Windows boot and Code Integrity failure. It often happens after installing the Windows 11 update (such as KB5094126) on systems with a small 100MB EFI System Partition that runs out of space when handling new Secure Boot certificates)

The only recent patch installed was KB5007651, which isn't a match, and is also not uninstallable, apparently. Great. There are no available patches as of the latest check.

I talked the client through disabling Secureboot in the BIOS, which let the computer boot again, but obviously is not a long-term solution. I have spent a couple of evenings (the only time the computer is free) futzing around with this, to no avail. I have

• Checked the BIOS - it's on the latest available version
• Confirmed the EFI partition is at the beginning of the disk, so I can't just make it larger (assuming it even is out of space)
• I did NOT mount the EFI partition and check it for free space - I meant to when I was onsite, but forgot. Not sure this matters since I would be hesitant to just delete stuff from there.
• Searched Lenovo for evidence they know about the problem. I found no exact matches, burt found THIS article, whose workaround is rolling back 4 or 5 BIOS versions until they found one that worked. Maybe that's where I am, but I hope not.
• Searched generally for others in this boat. I found no exact matches, but did find some near-misses. Those didn't give me anything new to try, though.
• I went onsite and tried resetting the Lenovo factory-default secure boot keys in the BIOS - didn't help
• While onsite, I thought about rewriting the boot files with bcdedit, but worried that might give me a permanently non-bootable computer and the client doesn't need that level of downtime during the work week. I'll try that once I get the machine back in the shop where I have more time & control

If re-writing the boot files doesn't help, I think I'm looking at a nuke & pave - unbelievably. What worries me more is that this is a ticking time bomb for the other hundred or so of these things we have in the field.

 

[Computer Bloke]

If you can confirm that the problem really is that the EFI partition is running out of space, would you feel comfortable booting from a live Linux USB and using Gparted to shuffle the partitions around until you can make it bigger?

It's certainly faster than a nuke and pave, and you'd still have that option available if you needed it.

 

[ThatPlace928]

Try this. I came across it, when my reserve wouldn't expand on its own. It walks you through the process and worked perfectly for me. Good luck!

We couldn’t update the system reserved partition”.

This error message is very common, and is very easy to fix. The reason why this error message is displayed, is because Windows can’t store the boot/update files it needs in the small, hidden partition that controls your Windows startup.

To fix this issue:

1. Simply go into the Window start bar, and type in “Command Prompt” and right click on the command prompt application, and click on the “Run as administrator” option.

2. Now, from command prompt, type in the following command “mountvol y: /s” and hit the enter key on your keyboard.

3. Now type in “cd /d y:\EFI\Microsoft\Boot\Fonts” and hit the enter key on your keyboard.

4. Now type in “del *. *” and hit enter on your keyboard.

5. Now type in “Y”, and hit enter on your keyboard.

6. Now that the unnecessary files have been deleted, close the Windows installer and re-run it.

7. And as you can see, when I re-run the installer, it no longer gets stuck on the “We couldn’t update the system reserved partition” error screen, and you’ll be able to install Windows 11 successfully.

 

[HCHTech]

The 0xc0430001 stop code is NOT because the EFI partition is running out of space. I checked and confirmed 200MB free. It is "Secure Boot detected that rollback of protected data has been attempted." I do not know what causes this issue (I suspect it is related to the computer getting the new UEFI certificate but couldn't update it automatically because of something to do with how the EFI partition was created initially or its content), but I now know how to proceed:

1. Confirm computer boots with SecureBoot disabled in the BIOS
2. Suspend Bitlocker if enabled (only if you have the key, otherwise decript the drive)
3. Backup whatever you don't want to risk losing
4. Mount EFI partition (mountvol Z: /s)
5. Rewrite the Windows UEFI boot files (Run: bcdboot C:\Windows /s Z: /f UEFI)
6. Unmount the EFI partition
7. Reboot (with SecureBoot stil disabled) to confirm you didn't kill it
8. Re-enable Secureboot in the BIOS
9. Reboot
10. Re-enable or unsuspend Bitlocker
11. Profit!

 

[ThatPlace928]

The 0xc0430001 stop code is NOT because the EFI partition is running out of space. I checked and confirmed 200MB free. It is "Secure Boot detected that rollback of protected data has been attempted." I do not know what causes this issue (I suspect it is related to the computer getting the new UEFI certificate but couldn't update it automatically because of something to do with how the EFI partition was created initially or its content), but I now know how to proceed:

1. Confirm computer boots with SecureBoot disabled in the BIOS
2. Suspend Bitlocker if enabled (only if you have the key, otherwise decript the drive)
3. Backup whatever you don't want to risk losing
4. Mount EFI partition (mountvol Z: /s)
5. Rewrite the Windows UEFI boot files (Run: bcdboot C:\Windows /s Z: /f UEFI)
6. Unmount the EFI partition
7. Reboot (with SecureBoot stil disabled) to confirm you didn't kill it
8. Re-enable Secureboot in the BIOS
9. Reboot
10. Re-enable or unsuspend Bitlocker
11. Profit!

Sounds like you got it covered. Good deal.

 

[HCHTech]

Sounds like you got it covered. Good deal.

Except for the amount of time it took me to find and apply the solution. Stuff like this is frustrating for sure. You can't really troubleshoot well remotely on BIOS-related stuff, and anything in this category, I always prefer to be on my bench where I have more time & control. It's more stressful for me as I watch the (mostly non-billable) hours tick by without progress,.

It wasn't a good week for feeling like I even knew what I was doing, haha. I also ran into a sharing problem that turned out to be the problem I discovered last year about have two computers on the same network with the same SID. I'm embarassed how long it took me to remember that issue and test for it. If I was my boss, I'd NOT be happy with my performances this week, haha.

 

[Metanis]

...Except I'm embarassed how long it took me to remember that issue and test for it.

Don't feel like the...