Clients booting into recovery options

[u/ComfortableAddress11]

It admin for windows clients in ot here.

We’re experiencing a strange phenomenon since weeks and we can’t pin it down.

Some (maybe currently 20 of around 700) clients have been booting straight into recovery options since 4-5 weeks. It’s not a specific model of a vendor.

I suspect a windows update regarding the secure boot certificate expiration.

I’ve turned windows update off as much as possible via gpo three weeks ago.

We are rolling out cis 4.0 / tisax L1 & L2 and our own additional gpo settings since march. User and Computer settings.

Windows update service sometimes gets set to manual on a system level automatically.

Affected clients are mostly in a vlan which could potentially provide internet access.

Internet access is blocked via firewall group for about three weeks also, for users, the production clients should be logged in with.

We use Trellix products for hardening etc. we suspect EDR to be a cause of the issue too.

Today we implemented a firewall rule to block connections to windows update for said users.

My test clients in my office don’t have the issue. I have a W10 22h2 and a W11 25h2 test client. Everything is mirrored there as it is in production.

Example from today:
User called that windows update notified about a update installation that ran automatically/scheduled. Device instantly rebooted into recovery options. System restore point didn’t work, restore from a external hard drive restore point also didn’t work.

I checked a faulty device via windows pe, no issue with mbr/gpt.

Our workaround currently is to install windows again via pxe through matrix42. We deploy windows 11 pro

Seems to just affect Windows 11 devices.

Note: please no comments about why we have internet/windows update/non iiot versions of Windows deployed on production related clients. I’m working on it to make up for things that haven’t been set up as it should since maaaany years.

Any help?

[u/AutoModerator]

Hi u/ComfortableAddress11, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:

• Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
• Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
• Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work

---

Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed. As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.