Windows 11 24H2: Setup and Safe-OS Dynamic Update for 2025

Microsoft quietly published two targeted Dynamic Update packages for Windows 11, version 24H2 (and Windows Server 2025) — KB5065378 (a Setup Dynamic Update) and KB5064097 (a Safe OS / WinRE Dynamic Update) — on August 29, 2025, delivering refreshed setup binaries and a new Windows Recovery Environment (WinRE) image to address installation and recovery reliability during feature updates and image deployments. (support.microsoft.com) (support.microsoft.com) (neowin.net)

Background / Overview​

Dynamic Updates are a class of servicing packages Windows Setup fetches during in-place upgrades or when installing from media; they let Microsoft refresh the small set of setup and recovery binaries used during installation without rebuilding ISOs or WIMs. That means an offline image created weeks or months earlier can still benefit from fixes published after the ISO was built — a crucial capability for IT teams that maintain image repositories. (learn.microsoft.com)
WinRE (the Windows Recovery Environment, sometimes called “Safe OS”) and Setup binaries are small but mission-critical: they run before the full operating system boots and are used by Reset, Automatic Repair, cloud reinstall, and installation flows. Problems in these components manifest as failed upgrades, broken recovery, or devices stuck in partial upgrade states. The two KBs address exactly that narrow, high-impact surface. (support.microsoft.com)

---

What Microsoft shipped: quick summary​

• KB5065378 — Setup Dynamic Update for Windows 11, version 24H2 and Windows Server 2025. Refreshes Setup.exe and the files Setup consumes during feature updates; intended for image hardening and smoother in-place upgrades. This package is not distributed via the consumer Windows Update channel and must be retrieved from the Microsoft Update Catalog or synchronized through WSUS. (support.microsoft.com)
• KB5064097 — Safe OS (WinRE) Dynamic Update for Windows 11, version 24H2 and Windows Server 2025. Installs a refreshed WinRE image (expected WinRE build 10.0.26100.5059) and updates Safe‑OS binaries and drivers used during recovery and setup operations. Microsoft lists this one as available via Windows Update and the Update Catalog. (support.microsoft.com)

Both updates replace previously published Dynamic Update packages (KB5065378 replaces KB5062839; KB5064097 replaces KB5063689) and are explicitly scoped to the 24H2 servicing stream and Windows Server 2025. Administrators should treat them as image/media hardening packages rather than conventional cumulative fixes. (support.microsoft.com)

---

KB5065378 (Setup Dynamic Update): what’s inside and why it matters​

What the KB says​

KB5065378 “makes improvements to Windows setup binaries or any files that setup uses for feature updates.” The KB lists dozens of Setup-related files — Appraiser.dll, SetupPlatform binaries, MediaSetup resources, and associated UI and platform helpers — many carrying August 12, 2025 file dates, indicating alignment with the August servicing cadence. The update replaces the prior Setup Dynamic Update for 24H2 and must be pulled from the Microsoft Update Catalog or synced via WSUS. (support.microsoft.com)

Why a Setup DU matters in practice​

Setup uses a focused set of binaries during a feature upgrade. If any of those are mismatched with recently shipped cumulative updates or drivers, the installation can fail early, leaving the device partially upgraded or non-functional. A Setup Dynamic Update reduces those mismatches by refreshing the exact files Setup uses — a lower-risk, surgical fix compared with rebuilding whole images. Learn.Microsoft explains the role of Dynamic Updates in ensuring media and in-place upgrades remain resilient. (learn.microsoft.com, support.microsoft.com)

Distribution and operational notes​

• Not available directly through consumer Windows Update; obtain from the Microsoft Update Catalog or WSUS catalog sync. (support.microsoft.com)
• No prerequisites and no restart required when the update is applied to an image. (support.microsoft.com)
• The KB explicitly flags Windows Secure Boot certificate expiration as an operational concern (see the next section on certificate timelines). (support.microsoft.com)

---

KB5064097 (Safe OS Dynamic Update / WinRE): the recovery refresh​

What the KB says​

KB5064097 refreshes the Windows Recovery Environment (WinRE) and Safe‑OS components used across reset, cloud-installs, and setup-time recovery. After the update, Microsoft expects WinRE to report version 10.0.26100.5059. This update is available via Windows Update, the Update Catalog, and WSUS (when synchronized) and replaces an earlier Safe OS DU (KB5063689). (support.microsoft.com)

Practical impact​

A modern, patched WinRE reduces the chance that Reset or cloud reinstall flows will fail when the full OS is compromised. It also improves compatibility with newer drivers and firmware during pre‑boot operations (for example, TPM and BitLocker interactions). Because the recovery image runs outside the main OS, patching WinRE independently is an effective way to close pre‑boot gaps without altering running images. (support.microsoft.com)

Verification and tools​

Microsoft provides verification guidance, including a sample PowerShell script “GetWinReVersion.ps1” and DISM-based methods to mount winre.wim and inspect file versions. Administrators should confirm the WinRE version after applying the update; the KB shows the script and DISM commands. (support.microsoft.com, learn.microsoft.com)

---

Why Microsoft pushed these now: August 2025 servicing context​

August 2025’s servicing cycle produced a cluster of high-visibility issues that increased the operational risk for imaging and update pipelines — notably WSUS delivery failures and installation errors (for example, error 0x80240069 when KB5063878 failed to install via WSUS). Microsoft issued fixes, Known Issue Rollbacks (KIR), and targeted servicing measures in response. Dynamic Updates like KB5065378 and KB5064097 are the precise mechanism for hardening images and recovery flows against that class of setup-time regressions. (bleepingcomputer.com, support.microsoft.com)
Community and field reports have repeatedly shown that when recovery or setup components are out of sync with cumulative updates, upgrade failures and recovery regressions spike. For administrators who maintain frozen images or rely on media-based deployment, refreshing Setup and WinRE with the latest DU packages is a low-friction mitigation step. (windowsforum.com, learn.microsoft.com)

---

Security note: Secure Boot certificates and long-term readiness​

KB5065378’s release notes explicitly call attention to Secure Boot certificate expirations starting in June 2026 — an ecosystem-level change that can disrupt pre‑boot security and updateability if devices are not prepared. Microsoft has published guidance and a rollout plan for replacing the expiring 2011-era CAs with 2023-era certificates; IT teams should factor firmware updates and certificate readiness into their rollout plans. This is a cross-cutting operational dependency because WinRE and Setup interact with Secure Boot and TPM during pre-boot workflows. (support.microsoft.com)
Put plainly: while these Dynamic Updates harden setup and recovery, they do not eliminate the broader requirement to update firmware and Secure Boot trust elements before the 2026 certificate expirations. Administrators should coordinate with OEMs and validate firmware update availability before large-scale media refreshes. (techcommunity.microsoft.com)

---

Deployment and verification: a practical checklist for admins​

Below is a concise, actionable checklist that consolidates official guidance and operational best practices.

• Download and catalog the packages
• KB5065378 (Setup DU) — download the CAB/MSU from Microsoft Update Catalog (or let WSUS sync it). (support.microsoft.com)
• KB5064097 (Safe OS DU) — available via Windows Update and the Update Catalog; confirm whether automatic delivery is acceptable for your fleet. (support.microsoft.com)
• Prepare a test image
• Make a copy of your source media or WIM.
• Use the Microsoft-provided PowerShell media-refresh script or DISM/Add-WindowsPackage sequence to inject the Setup DU and the Safe OS DU into the install.wim and WinRE (winre.wim). The Microsoft Learn article includes fully worked scripts and the recommended sequence (SSU/LCU last, language/FOD ordering). (learn.microsoft.com)
• Verify WinRE and Setup versions
• Run reagentc /info to find WinRE location.
• Mount winre.wim and inspect file versions with DISM or with the provided GetWinReVersion.ps1; confirm WinRE reports 10.0.26100.5059 after KB5064097. (support.microsoft.com, learn.microsoft.com)
• Pilot and expand
• Pilot on a representative cross-section of hardware (OEM workstation models, Copilot+ systems, and any machines with vendor recovery tools).
• Test Reset this PC, cloud reinstall, and an in-place upgrade using the refreshed media.
• Monitor event logs for WinREAgent and Setup errors during flows. (learn.microsoft.com)
• Coordinate firmware and Secure Boot
• Check OEM firmware levels and whether Secure Boot certificate updates are provided; schedule firmware rollouts if needed. The Secure Boot CA refresh is an independent item that can obstruct imaging if ignored. (techcommunity.microsoft.com)
• Rollout guidance
• For organizations using WSUS/Configuration Manager: ensure the Update Catalog entries synchronization is successful and that the packages are approved to the appropriate rings. For air‑gapped media, inject the DU packages into images prior to deployment. (support.microsoft.com, learn.microsoft.com)

---

Command snippets (operationally useful)​

• Check WinRE status:
• reagentc /info
• Mount WinRE and inspect a key binary (example):
• dism /mount-image /ImageFile:"C:\Windows\System32\Recovery\Winre.wim" /Index:1 /MountDir:C:\mnt
• Get-Item C:\mnt\Windows\System32\winpeshl.exe | Select-Object -ExpandProperty VersionInfo
• dism /unmount-image /MountDir:C:\mnt /Discard
• Use the Microsoft-provided GetWinReVersion.ps1 (shown in the KB) to automate version verification. (support.microsoft.com, learn.microsoft.com)

---

Strengths of these releases​

• Surgical scope. Both KBs target a narrow but critical area — setup and pre-boot recovery — which means a high operational benefit relative to their footprint. This reduces the blast radius compared to broad cumulative updates. (support.microsoft.com)
• Image-first design. The Setup DU is expressly designed to be injected into offline media and WIMs, making these updates effective for organizations that rely on frozen media or air-gapped deployment processes. The Microsoft Learn guidance provides robust scripts to automate this. (learn.microsoft.com)
• Direct remediation for recent servicing problems. These updates are a logical and low-risk response to the August servicing frictions — they help prevent setup-time failures caused by file-version mismatches without forcing a wholesale reimage. (bleepingcomputer.com, learn.microsoft.com)

---

Risks and limitations (what to watch out for)​

• Not a silver bullet. Dynamic Updates reduce certain classes of setup and recovery failures but do not guarantee every upgrade or recovery scenario will succeed. Complex driver or firmware mismatches, failing storage hardware, or corrupted user data remain separate failure modes. Administrators should still pilot thoroughly. (learn.microsoft.com)
• Delivery differences between the two KBs. KB5065378 is catalog/WSUS-only by design; if you expect consumer-style automatic deployment you will be surprised. KB5064097, by contrast, may arrive automatically on endpoints. Understand each channel before assuming uniform delivery. (support.microsoft.com)
• Removal and rollback constraints. At least one DU (KB5064097) is documented as not removable once applied to a Windows image. That makes validation before image circulation essential. (support.microsoft.com)
• Secure Boot certificate timing. The Secure Boot CA refresh is a separate but related operational dependency. If firmware and certificate updates aren’t coordinated, imaging or pre-boot operations could face trust issues as certificates expire in 2026. This risk is outside the scope of the DU itself but materially affects recovery and boot flows. (support.microsoft.com, techcommunity.microsoft.com)
• WSUS and delivery fragility. Recent WSUS delivery problems (the 0x80240069 scenario) show enterprise update channels can be brittle; verify WSUS synchronization and test Known Issue Rollback artifacts if you rely on on-prem update distribution. (bleepingcomputer.com)

---

Quick rollout checklist (at-a-glance)​

• Download KB5065378 and KB5064097 from the Update Catalog or verify WSUS sync. (support.microsoft.com)
• Inject into a copied install.wim and winre.wim following Microsoft’s media-refresh script sequence. (learn.microsoft.com)
• Validate WinRE version (10.0.26100.5059) and test Reset/Cloud Reinstall flows on pilot devices. (support.microsoft.com)
• Confirm firmware and Secure Boot certificate readiness with OEM partners. (techcommunity.microsoft.com)
• Expand rollout incrementally; monitor event logs and Windows Release Health dashboard. (support.microsoft.com)

---

Final assessment​

KB5065378 and KB5064097 are targeted, pragmatic updates that address exactly the fragile pieces of the Windows servicing pipeline that break imaging and recovery workflows. Applied correctly, they lower upgrade risk for media-based and in-place feature updates without forcing disruptive reimage cycles. That makes them high-value, low-friction fixes for imaging teams and admins who maintain offline media or large fleets. (support.microsoft.com)
However, these packages are one piece of a broader operational mosaic. Secure Boot certificate renewal, firmware updates, and reliable WSUS/CM delivery remain essential prerequisites to a smooth rollout. Organizations that skip firmware coordination or presume a DU will solve all upgrade headaches risk encountering edge-case failures. Test, verify, and deploy incrementally — and treat these Dynamic Updates as essential preventive maintenance for setup and recovery rather than a cure-all. (support.microsoft.com, bleepingcomputer.com)
Community and forum reporting mirrored the official guidance and reinforced the operational advice above; the Windows admin community has already started circulating pilot guidance and scripts to help teams automate media refreshes. (neowin.net)
These two KBs are small, backstage updates that deserve a place in any responsible imaging and deployment plan for Windows 11 24H2 and Windows Server 2025 — apply them carefully, verify WinRE and Setup behavior, and make firmware/certificate readiness part of the rollout timeline.

---

Source: Neowin Microsoft released Windows 11 KB5065378, KB5064097 Setup and Recovery updates

 

[ChatGPT]

Microsoft has quietly published two targeted Windows 11 dynamic updates — KB5065378 (a Setup Dynamic Update) and KB5064097 (a Safe OS / WinRE Dynamic Update) — to refresh the setup binaries and the Windows Recovery Environment used during feature updates, media-based installs, and recovery flows.

Background​

Dynamic Updates are a focused class of servicing packages Windows Setup pulls during an in-place upgrade or when booting from installation media; they let Microsoft refresh the small set of setup and pre-boot binaries without rebuilding ISOs or WIMs. That design makes them extremely valuable for teams that maintain frozen images or air‑gapped deployment media, because an image created weeks or months earlier can still benefit from fixes released after the ISO was built.
The two packages released on August 29, 2025, are narrow in scope but high in operational impact: KB5065378 updates files Setup consumes during feature updates, while KB5064097 refreshes the Windows Recovery Environment (WinRE), the minimal "safe OS" that runs for Reset, cloud reinstall, and Automatic Repair. Administrators should treat these as image hardening updates rather than conventional cumulative rollups.

---

What Microsoft shipped​

KB5065378 — Setup Dynamic Update (Windows 11, version 24H2 / Windows Server 2025)​

• Purpose: Refresh Setup.exe and the small set of files Setup uses to perform feature updates, reducing file-version mismatches that can cause setup failures.
• Distribution: Published to the Microsoft Update Catalog and intended to be synchronized by WSUS; not distributed via the standard consumer Windows Update channel. Administrators must download the CAB/MSU for injection into images or let WSUS sync it into their environment.
• Relationship to prior packages: KB5065378 replaces an earlier Setup Dynamic Update (previously published under a different KB), so image builders must consume the latest replacement package rather than an older DU.
• Operational note: When applied to a captured image, the update requires no prerequisites and no restart as part of image servicing.

KB5064097 — Safe OS / WinRE Dynamic Update (Windows 11, version 24H2 / Windows Server 2025)​

• Purpose: Installs a refreshed WinRE image with updated Safe‑OS binaries and drivers used during recovery and pre‑boot operations. This is the package that touches the environment used by Reset this PC, cloud reinstall, and other recovery flows.
• Expected WinRE version: After application, WinRE should report version 10.0.26100.5059 (verifyable via reagentc /info and DISM inspection).
• Distribution: Available through the Microsoft Update Catalog, synchronized to WSUS when configured, and may be delivered through Windows Update depending on the channel; administrators should confirm the delivery path that matches their deployment model.
• Replacement behavior: KB5064097 replaces an earlier Safe OS DU and, in some cases, cannot be removed once applied to a mounted image — making pre-deployment validation essential.

---

Why these updates matter now​

August 2025’s servicing cycle produced several high‑visibility operational problems that increased the risk of setup-time regressions for organizations that rely on image-based deployment or on-prem update distribution. Reports surfaced of WSUS delivery failures, installation errors, and other transient issues that raised the likelihood of upgrade or recovery failures in the field. Microsoft’s targeted Dynamic Updates are the appropriate mechanism to surgically harden setup and recovery flows without forcing a full image rebuild.
In practical terms, updating Setup and WinRE lowers the chance that a device will enter a partially-upgraded or unrecoverable state during a feature update. For fleets that do not rebuild media frequently, injected Dynamic Updates are a low-risk, high-reward mitigation. That said, Dynamic Updates are not a panacea — they address file and binary mismatches inside setup and WinRE but cannot resolve all firmware, storage hardware, or driver interoperability problems.

---

Technical analysis — what the file lists imply​

The file tables included in the KB notes are revealing: Microsoft updated a mixture of kernel-level pre-boot components, hypervisor helpers, and recovery agents — a combination suggesting the release targets both platform trust and serviceability.

Secure kernel and TPM interaction​

The inclusion of files such as securekernel.exe and tpm.sys in the WinRE package shows Microsoft focused on pre‑boot trust elements and TPM interaction. That work reduces the risk of BitLocker/TPM-related failures during recovery and cloud reinstall flows by ensuring WinRE can correctly interpret TPM state, handle recovery keys, and interact with firmware attestation primitives. For managed devices that rely on BitLocker, this is a meaningful stabilizer.

Virtualization and hypervisor helpers​

References to hvloader, hvix64, and related hypervisor helper binaries indicate fixes for pre‑boot virtualization helpers used by diagnostics or OEM recovery tools that rely on lightweight virtualization. Systems that launch diagnostics inside WinRE or expect certain virtualization primitives to be available should benefit from reduced failures.

Recovery agent and UI improvements​

Updates to Facilitator.dll and WinREAgent servicing logic imply Microsoft also tuned the user-facing recovery flows and the logic that applies updates to the recovery image itself. These changes reduce the risk of servicing errors when mounting and updating winre.wim during image servicing operations.

Setup components and appraiser adjustments​

KB5065378’s file list includes items like Appraiser.dll, SetupPlatform binaries, and several MediaSetup UI resources. Appraiser is used to assess device compatibility for feature updates; refreshing these components can prevent compatibility misclassification or early failures during upgrade. File timestamps align with the August servicing cadence, showing these binaries were updated in direct response to the most recent cumulative servicing.

---

Risks, limitations, and items to watch​

• Not a silver bullet. Dynamic Updates reduce a specific class of setup and pre‑boot failures, but firmware mismatches, storage device hardware faults, third‑party drivers, and corrupted system data remain separate failure vectors. Administrators should not treat DUs as a replacement for full validation.
• Delivery channel differences. KB5065378 is intended for the Update Catalog/WSUS path and is not pushed through the consumer Windows Update channel; KB5064097 is published broadly but may arrive differently across rings. This mismatch can lead to surprising behaviors if teams expect uniform automatic delivery. Confirm how each package will land in your environment.
• Removal constraints. At least one Safe OS Dynamic Update is documented as not removable once applied to an image; that makes pre‑deployment verification non-negotiable. If an injected winre.wim is later found to be incompatible with vendor recovery tools, rolling back may require rebuilding the recovery image.
• WSUS fragility and known issue rollbacks (KIR). Recent WSUS delivery problems have shown enterprise update channels can be brittle; ensure WSUS catalog sync is clean and monitor for Known Issue Rollbacks that Microsoft may publish in response to regression reports.
• Secure Boot certificate timeline. The KB notes explicitly call out Secure Boot certificate expiry and CA migration timelines that begin in mid‑2026; failing to coordinate firmware updates and OEM-signed certificate rollouts can cause pre‑boot trust problems later. Dynamic Updates do not eliminate the need for firmware and certificate readiness planning.

If any claim in your environment cannot be independently verified (for example, an OEM-supplied firmware update schedule), flag that as an operational risk and escalate to the hardware vendor. Where a claim is based on public KB file listings, it is verifiable; where it rests on in-field behavior, treat it as an empirical hypothesis to be validated in your own test lab.

---

Deployment and verification — a practical playbook​

The following checklist consolidates official guidance and community best practice into an actionable rollout plan for imaging teams.

• Inventory and download
• Confirm the required DU packages exist in the Microsoft Update Catalog and approve/sync them in WSUS if you use on‑prem distribution. KB5065378 is catalog/WSUS-only by design.
• Keep a clear copy of the CAB/MSU with a change log for your image pipeline.
• Prepare a test image
• Work on a copied install.wim and winre.wim, not on production media. Use DISM/Add-WindowsPackage or the Microsoft-provided media-refresh scripts to inject Setup and Safe OS DUs into install.wim and winre.wim in the recommended order. The Learn guidance contains example scripts and the suggested sequence.
• Verify WinRE and Setup versions
• Use reagentc /info to find WinRE location and confirm the active winre.wim.
• Mount winre.wim with DISM and inspect key file versions. Example:
• dism /mount-image /ImageFile:"C:\Windows\System32\Recovery\Winre.wim" /Index:1 /MountDir:C:\mnt
• Get-Item C:\mnt\Windows\System32\winpeshl.exe | Select-Object -ExpandProperty VersionInfo
• dism /unmount-image /MountDir:C:\mnt /Discard
  These snippets are supplied in Microsoft guidance and the KB notes.
• Or use the Microsoft-provided GetWinReVersion.ps1 to automate version checks — after applying KB5064097, WinRE should report 10.0.26100.5059.
• Pilot on representative hardware
• Test on a cross-section of models: OEM workstations, Copilot+ systems, devices with vendor recovery tooling, and machines with TPM/BitLocker enabled.
• Test the full set of recovery flows: Reset this PC, cloud reinstall, and an in-place feature update using refreshed media. Monitor the Event Log for WinREAgent and Setup‑related errors.
• Approve and roll out in rings
• Use a ringed deployment model: pilot → broader pilot → broad deployment. Coordinate firmware and driver timelines with OEM vendors to avoid surprises related to Secure Boot or certificate trust changes.
• Post-deployment monitoring
• Watch Windows Release Health and any Known Issue Rollbacks that Microsoft publishes, and maintain a short window for hot-fixes or roll-forwards if regression signals appear.

---

Enterprise and OEM considerations​

• Coordinate with OEMs: The Secure Boot CA refresh and related firmware updates are an ecosystem-level dependency that OEMs must support. Large fleets should verify firmware availability and schedule OEM coordination well ahead of any CA expirations.
• WSUS / SCCM admins: Confirm catalog synchronization and test client behavior end-to-end. Recent WSUS issues demonstrate that catalog approval alone is not sufficient — monitor client download behaviors and test the full servicing pipeline.
• Image pipeline hygiene: Teams that manage offline images should commit to a media-refresh cadence that includes Dynamic Updates as an expected step whenever a major servicing cycle causes broad binary changes. Automate the injection and verification steps to reduce human error.

---

Security implications​

Updating WinRE and Setup helps close gaps in the pre‑boot attack surface, reducing the chance that compromised recovery components can aid an attacker or that recovery flows will fail when needed. However, pre‑boot security also depends on firmware and Secure Boot certificates; administrators must treat DU updates as one piece in a broader security posture that includes firmware updates, certificate rollouts, and proper BitLocker recovery key management.

---

Quick reference: what to expect after applying the updates​

• Setup behavior: Reduced risk of early setup failures due to mismatched setup binaries; feature updates should encounter fewer file-version mismatches when DUs are injected into the install media.
• Recovery behavior: WinRE will present updated drivers and binaries, improving compatibility with TPM, BitLocker, and vendor recovery tools. Confirm WinRE version is 10.0.26100.5059 to ensure the DU is present.
• Rollback: KB5064097 (Safe OS DU) may not be removable once applied to an image. Plan validation accordingly.
• Delivery: Expect KB5065378 to be catalog/WSUS-distributed, while KB5064097 may propagate more broadly depending on channel configuration. Verify how both packages will reach your endpoints.

---

Final assessment and recommendations​

Microsoft’s release of KB5065378 and KB5064097 is a textbook example of targeted, low-blast-radius servicing that materially improves the reliability of setup and recovery flows without forcing teams to rebuild entire images. The strengths are clear: surgical scope, image-first design, and direct remediation for the setup/regression class of problems that surfaced during the August 2025 servicing window. For organizations that rely on frozen media, these packages are an essential, low-effort mitigation.
At the same time, the updates come with important operational caveats: differences in delivery channels, non-removability of some Safe OS updates once applied to an image, WSUS synchronization fragility, and an ecosystem-level dependency around Secure Boot certificate migration that begins in 2026. These are not reasons to avoid the packages; they are reasons to test thoroughly, pilot broadly, and coordinate with OEMs and firmware teams.
Recommended immediate actions for teams:

• Download and catalog KB5065378 and KB5064097 from the Microsoft Update Catalog or confirm WSUS sync.
• Inject the DUs into copies of install.wim and winre.wim in a test lab, following Microsoft’s media-refresh guidance.
• Verify WinRE reports 10.0.26100.5059 after applying KB5064097 and test Reset, cloud reinstall, and in-place upgrade flows on representative hardware.
• Coordinate Secure Boot/firmware plans with OEM partners to avoid certificate-related pre‑boot failures in 2026.

These two Dynamic Updates are not flashy, but they are precisely the kind of behind‑the‑scenes fixes that prevent visible outages and recovery failures at scale. Apply them strategically, validate thoroughly, and keep an eye on distribution behavior as you move from pilot to broad deployment.

---

Source: Neowin Microsoft released Windows 11 KB5065378, KB5064097 Setup and Recovery updates

 

[ChatGPT]

Microsoft pushed two targeted Dynamic Updates over the weekend — KB5065378 and KB5064097 — aimed at hardening setup and recovery for Windows 11, version 24H2, and Windows Server 2025, refreshing the small but critical set of setup binaries and the Windows Recovery Environment (WinRE) used during feature updates, media-based installs, and recovery flows.

Background / Overview​

Dynamic Updates are a focused servicing mechanism Microsoft uses to refresh only the files Setup and pre-boot recovery environments need at install or recovery time. Instead of rebuilding ISOs or WIM images, Setup can fetch these small packages during a feature update or when booting from installation media, reducing the likelihood of file-version mismatches that cause upgrade failures. This behavior is central to image hardening strategies for teams that maintain offline or "frozen" images.
There are two flavors important here:

• Setup Dynamic Updates refresh the files Setup.exe and supporting binaries uses during an in-place upgrade or media-based installation.
• Safe OS / WinRE Dynamic Updates refresh the recovery image (WinRE), which runs outside the full OS and is responsible for Reset, Automatic Repair, and cloud reinstall operations.

Both update types are intentionally narrow in scope but high in operational impact: they reduce upgrade and recovery surface area without requiring full image rebuilds.

---

What Microsoft shipped (quick summary)​

KB5065378 — Setup Dynamic Update (Windows 11 24H2 / Windows Server 2025)​

• Purpose: Refresh Setup binaries and files Setup consumes during feature updates to reduce file-version mismatch failures during upgrades.
• Delivery: Published to the Microsoft Update Catalog and intended to be synchronized by WSUS; administrators must download the package for manual image injection or let WSUS sync it for internal distribution.
• Replacement behavior: This package replaces a prior Setup Dynamic Update; image builders should consume the latest DU rather than older replacements.

KB5064097 — Safe OS / WinRE Dynamic Update (Windows 11 24H2 / Windows Server 2025)​

• Purpose: Refreshes the Windows Recovery Environment (WinRE) and Safe‑OS components used for Reset, cloud reinstall, and pre‑boot recovery flows.
• Expected WinRE version after applying: 10.0.26100.5059 (administrators can verify with reagentc /info or by mounting winre.wim with DISM).
• Delivery: Published to the Microsoft Update Catalog and will sync to WSUS when configured; Microsoft may also deliver Safe OS DUs through Windows Update depending on channel and configuration, so delivery behavior can differ between the two packages.

Both packages were published in late August 2025 as targeted, behind‑the‑scenes fixes to the setup/recovery pipeline. They are not conventional cumulative updates and should be treated as image hardening or media refresh updates.

---

Why these Dynamic Updates matter now​

August 2025’s servicing window produced a cluster of operational issues — including WSUS sync/delivery problems and setup-time regressions — that raised the risk of upgrade and recovery failures for organizations that rely on image-based deployment or on-prem update distribution. Dynamic Updates are the surgical tool Microsoft uses to harden that narrow surface without forcing a full image rebuild. Applying the DU is typically much lower risk than rebuilding and re‑qualifying an entire install.wim or deployment image.
Key operational patterns that make these DUs valuable:

• Frozen or air‑gapped images created weeks or months earlier can still receive critical fixes through DUs.
• WinRE runs outside the full OS; patching WinRE independently reduces the chance that recovery flows fail when the running OS is compromised.
• Setup DUs reduce mismatches between setup-time binaries and newly shipped cumulative updates and drivers, directly lowering the incidence of early setup failures.

---

Deep dive: KB5065378 (Setup DU)​

What it changes​

KB5065378 focuses on the small set of files Setup consumes during feature updates — items such as Appraiser.* components, SetupPlatform binaries, MediaSetup UI resources, and associated platform helpers. The KB enumerates file-level changes and file versions (many aligned with the August servicing cadence), which helps administrators audit and compare file versions before and after injection into images.

Distribution and operational notes​

• Not typically pushed via the consumer Windows Update channel: Setup Dynamic Updates are normally published to the Microsoft Update Catalog and intended for WSUS synchronization; administrators who expect automatic consumer-style delivery should confirm their delivery path.
• No prerequisites for image injection: When applied to a captured image, the DU generally requires no additional prerequisites or a restart as part of image servicing, but validation remains essential.

Practical effect​

By refreshing the exact binaries Setup uses, organizations reduce the chance of early setup failures caused by mismatched file versions or missing setup-time fixes. This is a narrower, lower‑risk remediation compared with rebuilding the entire install image.

---

Deep dive: KB5064097 (Safe OS / WinRE DU)​

What it changes​

KB5064097 refreshes the Windows Recovery Environment (WinRE) image and Safe‑OS drivers/binaries used during pre‑boot and recovery operations. This improves compatibility with newer hardware, TPM/BitLocker interactions, firmware, and vendor recovery tools. Microsoft expects WinRE to report 10.0.26100.5059 after the update is applied. Administrators can verify the presence of the DU by mounting winre.wim and inspecting file versions or running reagentc /info.

Removal and rollback constraints​

Some Safe OS Dynamic Updates are documented as non‑removable once applied to a mounted image. That means pre‑deployment validation is essential: apply the update to test images and confirm behavior before broad circulation. Treat KB5064097 as potentially irreversible on the image and plan accordingly.

---

How these packages are delivered and how to get them​

• Microsoft Update Catalog: Both KB5065378 and KB5064097 are published to the Microsoft Update Catalog and can be manually downloaded as CAB/MSU packages for image injection or offline distribution.
• WSUS / SCCM: When WSUS catalog sync is configured to include these classifications/products, the DU packages will be available for synchronization and downstream distribution. Confirm WSUS synchronization and package visibility before expecting broad availability.
• Windows Update channel: Delivery behavior differs between the two DUs. KB5065378 is typically catalog/WSUS-only by design; KB5064097 may propagate more broadly depending on channel settings. Do not assume identical distribution for both packages.

---

Verification and validation (practical commands and checks)​

After applying or injecting a Safe OS DU (KB5064097), verify the WinRE version and validate recovery flows:

• Check WinRE status and version:
  1. Open an elevated Command Prompt or PowerShell and run:
     reagentc /info
     The command returns the currently registered WinRE image and version information.
• Inspect a mounted winre.wim with DISM:
  1. Mount the WIM:
     dism /Mount-Wim /WimFile:C:\path\to\winre.wim /index:1 /MountDir:C:\mount
  2. Inspect files and versions in C:\mount\Windows\System32 (or wherever the Safe OS binaries reside), then unmount:
     dism /Unmount-Wim /MountDir:C:\mount /Discard
     Microsoft provides sample scripts and DISM-based guidance for mounting and inspecting WinRE images.
• Use sample PowerShell helpers:
  Microsoft and community contributors publish short scripts (for example, a GetWinReVersion.ps1 sample) to enumerate embedded WinRE versions across images. Run these in a lab prior to rolling out.

When applying KB5065378 to an install.wim, follow Microsoft’s guidance for media refresh (copy/install.wim → inject DU → recompress image) and validate an in-place upgrade on pilot hardware.

---

Recommended deployment checklist for administrators​

• Inventory and prioritize pilot devices that represent your hardware and firmware diversity.
• Download KB5065378 and KB5064097 from the Microsoft Update Catalog or confirm WSUS synchronization.
• Apply DUs to a copied install.wim and winre.wim in an isolated lab; do not alter production images directly.
• Verify WinRE reports 10.0.26100.5059 (or the expected post‑DU version) after applying KB5064097, and confirm Reset/Cloud Reinstall/Automatic Repair flows on pilot devices.
• Coordinate with OEM/firmware teams about Secure Boot certificates and planned certificate refresh timelines; mismatched firmware trust chains can cause pre‑boot failures independent of the DU.
• Expand rollout incrementally; monitor logs, Windows Release Health telemetry, and user reports for regressions.

---

Risks, caveats, and things to watch​

• Non-removability of some Safe OS DUs: At least one Safe OS DU variant is documented as non-removable once applied to a mounted image. If you rely on the ability to roll back an image, validate this behavior before broadly applying KB5064097.
• Delivery channel mismatch: KB5065378 is catalog/WSUS-only in many cases, while KB5064097 may be more broadly delivered. Failing to confirm distribution paths can lead to inconsistent results across your fleet.
• WSUS / on‑prem fragility: Recent servicing cycles exposed delivery issues via WSUS (including known error codes like 0x80240069) — validate WSUS sync behavior and ensure any known issue rollbacks (KIRs) are accounted for.
• Firmware / Secure Boot certificate dependencies: WinRE and pre‑boot operations depend on firmware trust chains; if OEMs are performing Secure Boot certificate transitions (documented to impact some flows in 2026), coordinate updates to avoid certificate-related pre‑boot failures. This is an ecosystem dependency outside the DU itself but materially affects recovery and boot flows.
• Not a universal cure: Dynamic Updates reduce certain classes of setup/recovery failures but cannot fix hardware faults, corrupted user data, or complex driver/firmware incompatibilities. Continue to use standard troubleshooting and hardware validation practices.

---

Validation strategy: Minimal test matrix​

1. Apply the DU to a copy of your production install.wim and winre.wim.
2. Boot a VM or test device using refreshed media and perform a feature update scenario representing your most common path (in-place upgrade, media-based install, or cloud reinstall).
3. Execute Reset / Automatic Repair / cloud reinstall flows and confirm success end-to-end.
4. Run reagentc /info and DISM inspection to confirm WinRE version and file timestamps.
5. Monitor event logs, Setup logs (setuperr.log/setuplog.txt), and Update Health telemetry for anomalies.
6. If you use WSUS/SCCM, validate synchronization and deployment targeting in a staging ring before broad rollout.

---

Operational examples and community feedback​

Reporting from the field and independent outlets indicates that Microsoft’s patching approach with these DUs is a pragmatic response to August 2025 servicing friction. Outlets and community posts have reinforced the practical advice to treat DUs as image hardening tools and to validate non-removability and firmware interactions before broad deployment. Administrators who maintain offline media or rely heavily on WSUS have found this targeted approach quicker and less disruptive than full image rebuilds.

---

Final assessment — strengths and potential risks​

• Strengths
  • Surgical scope: These DUs target the exact files that create the highest risk during upgrades and recovery, which minimizes blast radius.
  • Operational efficiency: Applying a DU is far faster and less disruptive than rebuilding and re‑qualifying an entire image.
  • Recovery resilience: Patching WinRE independently reduces the chance that a damaged running OS prevents recovery.
• Potential risks
  • Distribution complexity: Different delivery channels for the two packages can create inconsistent fleet states if not managed.
  • Non‑removability: Some Safe OS DUs could be irreversible on images, making pre‑deployment validation crucial.
  • Ecosystem dependencies: Firmware updates, OEM Secure Boot certificate transitions, and driver/agent compatibility remain outside what the DU can fix. Skipping coordination can produce pre‑boot or recovery failures that appear unrelated to the DU.

In short, KB5065378 and KB5064097 are high-value, low-friction mitigations for the setup- and recovery-class problems that surfaced recently. They are not glamorous but are precisely the kind of changes that stop outages and reduce failed upgrades at scale. The sensible operational approach is straightforward: test, validate, coordinate with OEMs for firmware/certificates, and roll these updates out in controlled stages.

---

Quick reference: What to do this week (concise)​

• Download KB5065378 and KB5064097 from the Microsoft Update Catalog or confirm WSUS sync.
• Inject both packages into copied install.wim and winre.wim images in a lab.
• Verify WinRE reports 10.0.26100.5059 after applying KB5064097 and test Reset / cloud reinstall flows.
• Coordinate Secure Boot firmware plans with OEM partners.
• Stage rollout starting with small pilot rings; watch setup and recovery logs closely.

---

KB5065378 and KB5064097 are examples of Microsoft using targeted servicing to protect upgrade and recovery pipelines without forcing organizations down the costly path of full image rebuilds. For administrators who manage offline images or large device fleets, these updates should be considered essential preventive maintenance — applied thoughtfully, validated carefully, and rolled out in measured stages to capture the benefits while avoiding the well-documented pitfalls of delivery and firmware coordination.

---

Source: Windows Report Microsoft rolls out new Dynamic Updates (KB5065378 & KB5064097) for Windows 11 24H2 and Server 2025