Windows 11 Aug 2025 KB5063878: SSU+LCU, Copilot+ AI, and Secure Boot rollover

Microsoft released the August 12, 2025 cumulative security update for Windows 11, version 24H2 — KB5063878 (OS Build 26100.4946) — a routine but important monthly package that bundles the latest cumulative fixes, updates to several AI components (targeted at Copilot+ devices), and an updated servicing stack. Administrators and home users should pay particular attention this month because the release reiterates Microsoft’s advance warning about the Windows Secure Boot certificate expiration beginning in June 2026 and includes preparatory guidance for the certificate rollover that could otherwise disrupt secure boot and update delivery. (support.microsoft.com)

Background / Overview​

Windows’ monthly cumulative update model bundles quality and security fixes together so that devices receive a compact, single maintenance package. Since Microsoft began combining the servicing stack update (SSU) with the latest cumulative update (LCU) for Windows 11, administrators now typically apply a single combined package that contains both the servicing stack improvements and the security/quality fixes themselves. The servicing stack is the OS component that installs updates; keeping it current is essential because outdated servicing stacks can cause update failures or even boot problems in rare states. Microsoft’s SSU guidance explains why SSUs exist, that SSUs should precede LCUs when installed separately, and why SSUs are effectively non-removable once applied. (support.microsoft.com)
This August release follows that model: the bundled package for Windows 11, version 24H2 updates the servicing stack and installs the cumulative fixes in one combined operation. The KB entry supplied with the update lists the build number, the AI component versions included (for Copilot+ PCs), and typical deployment options: Windows Update, Windows Update for Business, WSUS, and the Microsoft Update Catalog for standalone MSU packages. Deployment notes and DISM / Add‑WindowsPackage examples are included for air‑gapped or manually managed fleets.

---

What’s in KB5063878 (OS Build 26100.4946)​

Security and quality highlights​

• The update addresses multiple security issues and contains the quality improvements shipped in the prior July package. The KB summary points to the Security Update Guide and the August 2025 Security Updates for CVE details (the KB itself provides a high‑level description of the fix types rather than enumerating every CVE). Administrators who require CVE-level detail should consult the Security Update Guide and map CVEs to their environment’s assets.
• One notable functional fix called out in the release is an authentication improvement: Microsoft states that this update resolves a delay experienced during sign-in on new devices caused by certain preinstalled packages. That’s a user-facing fix with straightforward impact for devices being initialized or for newly provisioned hardware.

AI component updates (Copilot+ devices only)​

This release updates a set of AI components used by Windows’ Copilot and AI experiences. The KB lists the following component versions:

• Image Search — 1.2507.793.0
• Content Extraction — 1.2507.793.0
• Semantic Analysis — 1.2507.793.0
• Settings Model — 1.2507.793.0

Microsoft clarifies that these AI component binaries are packaged with the cumulative update, but they only install on Windows Copilot+ PCs (systems that meet specific hardware and licensing criteria). Standard Windows 11 PCs and Windows Server SKUs will not receive these AI component installs. This selective deployment is a practical way to advance AI features while limiting risk to non‑NPU devices.

Servicing stack update​

Bundled with KB5063878 is the servicing stack update KB5065381 (version 26100.4933). The KB explains that the SSU includes quality improvements for the update pipeline and is included to maintain a robust update experience. As with all SSUs, once installed the servicing stack cannot be uninstalled independently of the OS image; rollback options are limited and generally require system restore or a full image revert. Administrators should plan for that reality when validating monthly packages. (support.microsoft.com)

Known issues​

Microsoft states that, at the time of publication, it is “not currently aware of any issues” with this update. That is Microsoft’s initial status; organizations that run large or heterogeneous fleets should still test the update in a controlled stage before broad deployment, because real-world interactions with drivers, firmware, or specialty software sometimes reveal issues after rollout.

---

The Secure Boot certificate expiration: What you need to know​

The problem and timeline​

Microsoft has been clear: several Microsoft certificates that underpin UEFI Secure Boot are set to begin expiring in June 2026, and a second expiration window follows in October 2026 for other certificate components. If devices retain the legacy 2011 CA certificates beyond their expiry, they will cease to accept updates signed by the newer 2023 CAs, and, crucially, they may no longer receive security fixes for pre‑boot components such as Windows Boot Manager. That would degrade the integrity of the boot chain and could prevent distribution of Secure Boot updates. (support.microsoft.com, techcommunity.microsoft.com)

Which certificates and dates (high level)​

• Microsoft Corporation KEK CA 2011 — expiration: June 2026 — replacement: Microsoft Corporation KEK CA 2023 (stored in KEK).
• Microsoft UEFI CA 2011 and Microsoft Option ROM CA 2011 — expiration: June 2026 — replacements: Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 (stored in DB).
• Microsoft Windows Production PCA 2011 — expiration: October 2026 — replacement: Windows UEFI CA 2023. (support.microsoft.com)

Who is affected​

• Broadly: physical and virtual Windows machines (client and server families) manufactured since 2012 that have the legacy 2011 certificate chain present in UEFI Secure Boot variables. Virtual machines that rely on the host firmware can also be affected. Microsoft’s guidance emphasizes that both home users and organizations must take different actions depending on management models (Microsoft-managed updates vs. IT-managed environments). (techcommunity.microsoft.com, support.microsoft.com)

Microsoft’s recommended actions (summary)​

• Allow Microsoft to manage Secure Boot certificate updates where feasible: Microsoft will roll new certificates via Windows Update for most consumer and many enterprise devices, reducing manual effort. For Microsoft-managed update scenarios, the company suggests opting in by ensuring the device is receiving Windows Update and, in some cases, enabling diagnostic telemetry that supports the automated update process. (support.microsoft.com)
• For IT-managed devices, coordinate with OEMs to confirm firmware support and deploy OEM firmware updates before applying certificate updates. OEM firmware is the foundation for applying new Secure Boot variables. (techcommunity.microsoft.com)
• Use the registry opt‑in if required for managed rollouts: Microsoft published guidance to set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot\MicrosoftUpdateManagedOptIn DWORD to 0x5944 to indicate devices may be updated by Microsoft for Secure Boot-related changes; consult organizational policy before changing telemetry or registry settings. Air‑gapped or highly restricted environments require bespoke offline procedures and close OEM coordination. (techcommunity.microsoft.com, support.microsoft.com)

Consequences of inaction​

If a device remains on expired or soon‑to‑expire certificates it risks:

• Not receiving Secure Boot-related updates after June/October 2026.
• Losing trust for boot components signed by the new CA, which can block newly signed boot loaders or option ROMs.
• Potential vulnerability to boot-level attacks if older signing chains are no longer maintained. (support.microsoft.com, techcommunity.microsoft.com)

---

Deployment and testing: practical guidance​

Quick checklist for admins (high‑priority)​

• Inventory and classify devices by management model: Microsoft‑managed updates; WSUS/ConfigMgr; air‑gapped.
• Verify Secure Boot state on representative hardware: Run msinfo32 and confirm Secure Boot State = On. If Secure Boot is disabled, that device will not receive the Secure Boot variable update.
• Coordinate with OEM support: confirm firmware versions that enable the new KEK/DB updates and apply firmware updates before certificate changes are pushed.
• Stage the KB in a test pool: install KB5063878 in a controlled test ring and validate boot flow, drivers, and key business apps.
• Monitor Windows Health Dashboard and the Secure Boot certificate rollout landing page for live telemetry and advisories. (techcommunity.microsoft.com)

How to install the update (supported paths)​

• Automatic rollout (recommended for most users): Windows Update / Microsoft Update will deliver the combined SSU + LCU. For most devices that receive Microsoft-managed updates, this is the least friction method.
• Windows Update for Business: honors configured deployment rings and policies; deploy per organizational cadence.
• WSUS / Configuration Manager: sync the update with Product=Windows 11 and Classification=Security Updates.
• Manual / offline installs (air‑gapped or advanced admin scenarios): download MSU files from the Microsoft Update Catalog and install using DISM or Add‑WindowsPackage. Example command lines provided in the KB:
• DISM /Online /Add-Package /PackagePath:c:\packages\Windows11.0-KB5063878-x64.msu
• PowerShell: Add-WindowsPackage -Online -PackagePath "c:\packages\Windows11.0-KB5063878-x64.msu"
  These methods work well for image servicing and for updating installation media with dynamic updates but require careful ordering when multiple prerequisite MSU files exist.

Staging recommendations (phased rollout)​

• Pilot group: small set of representative devices covering OEM models and critical apps.
• Broad pre-production: expand to a few percent of fleet; monitor update telemetry, event logs, and user feedback.
• Full production: staggered rollout with rollback playbooks and backups.
• Post‑rollout audit: validate Secure Boot variables, check Windows Update health, and verify that Copilot+ AI components installed only where expected.

---

Risks, strengths, and critical analysis​

Strengths in Microsoft’s approach​

• Transparent advance notice for Secure Boot certificates. Microsoft published timeline details and published guidance months ahead of the June/October 2026 expirations, giving IT teams and OEMs time to prepare. That transparency reduces the risk of a surprise boot‑impacting event if organizations follow the guidance. (support.microsoft.com, techcommunity.microsoft.com)
• Bundled SSU + LCU reduces dependency errors. Shipping the servicing stack update together with the cumulative update simplifies deployment for many organizations and reduces the chance of missing a critical servicing stack fix that can break update delivery. Microsoft’s SSU FAQ documents the rationale and practical implications of SSUs. (support.microsoft.com)
• Selective rollout for AI components (Copilot+ only). By packaging AI binaries but restricting installs to Copilot+ certified systems, Microsoft can iterate AI functionality while limiting exposure to devices that lack specific NPUs or hardware guarantees. This measured approach limits compatibility surprises for the broader Windows population.

Risks and potential problems​

• Complexity for air‑gapped and OEM‑dependent environments. Organizations that do not allow Microsoft-managed updates or that run heavily controlled firmware baselines will need precise, manual certificate injection workflows and OEM coordination. Those processes are error‑prone without a strict, documented rollout plan. (techcommunity.microsoft.com)
• Limited rollback options. Because SSUs are effectively non‑removable and combined update packages change the rollback story, administrators must have strong staging, backups, and recovery procedures. A failed update on a critical system may require image restoration rather than a simple uninstall. (support.microsoft.com)
• Increased attack surface from AI components (theoretical). Tighter OS‑level integration of semantic analysis and extraction engines delivers value, but any large platform component that parses content and handles telemetry increases the potential attack surface and raises privacy questions. The short‑term mitigation is the restricted install model for Copilot+ devices, but long‑term risk management requires continued scrutiny of telemetry, sandboxing (VBS / TPM usage), and explicit admin controls. (windowscentral.com)
• Operational churn from prior 24H2 stability reports. While this KB reports no known issues at publication, past update cycles for Windows 11 24H2 included a variety of hardware‑specific problems (driver and compatibility issues reported by users in the field). Organizations should treat the “no known issues” statement as a starting point — not proof of zero risk — and enforce a conservative test rollout policy. Independent community reports and vendor advisories remain useful early indicators. (windowscentral.com, reddit.com)

Cross‑verification and verification gaps​

• The KB text supplied with the update provides the LCU and SSU details, AI component versions, and high‑level guidance for deployment and rollback. For Secure Boot certificate timelines and the recommended opt‑in mechanism, Microsoft’s Windows Secure Boot certificate expiration and CA updates support page and the Windows IT Pro blog corroborate the critical dates and the recommended preparatory actions. Those Microsoft properties constitute two independent, authoritative sources that confirm the timeline and actions. (support.microsoft.com, techcommunity.microsoft.com)
• Unverifiable or incomplete claims: the KB entry summarizes “security issues addressed” but does not list every CVE in the KB body. Administrators requiring explicit CVE mapping must consult the Security Update Guide for the canonical per‑CVE data; the KB alone is insufficient for CVE‑level triage. Treat the KB as the authoritative package manifest and use the Security Update Guide to enumerate vulnerabilities and severity.

---

Action plan — concise steps for different audiences​

For home users and small business (non‑IT managed)​

• Enable automatic Windows Update and ensure Secure Boot remains enabled (run msinfo32 to confirm). If the machine is eligible for automatic Microsoft‑managed updates, Microsoft will deliver the new Secure Boot certificates over time. (support.microsoft.com)
• Install KB5063878 when offered; an automatic Windows Update install will typically handle the SSU+LCU together. Back up essential data before applying system updates as a precaution.

For enterprise IT administrators​

• Inventory: identify devices with Secure Boot enabled and classify by OEM/BIOS version and update management model.
• OEM coordination: contact major OEMs to confirm firmware updates that support the 2023 KEK/DB changes; schedule firmware updates before certificate updates. (techcommunity.microsoft.com)
• Test KB5063878 in a representative pilot ring (drivers, imaging, and critical LOB apps). Use the MSU offline workflow only when necessary and confirm package order for DISM deployments.
• Opt‑in policy decisions: determine whether Microsoft should manage Secure Boot updates or whether the organization will perform certificate updates manually (set registry key where appropriate and document the approach). (techcommunity.microsoft.com)
• Monitor telemetry and the Windows Health Dashboard post‑deployment. Maintain a rollback and recovery plan (image restore or system restore points) should unexpected failures occur. (support.microsoft.com)

For firmware and device OEM partners​

• Continue to publish and signal UEFI firmware updates that allow Secure Boot variable changes, and coordinate with Microsoft for testing firmware + certificate rollout scenarios. The OEM layer matters because Secure Boot variables are stored and managed in firmware; without compatible firmware the OS-level update cannot complete successfully. (techcommunity.microsoft.com)

---

Final assessment​

August’s KB5063878 is a routine monthly delivery in form but strategically significant because it is accompanied by a clear, repeated warning about the Secure Boot certificate expirations that begin in June 2026. The technical changes in this release — an authentication sign‑in delay fix, updated AI binaries for Copilot+ hardware, and an SSU refresh — are what one would expect in a mature platform cadence: incremental quality and security work with selective feature rollouts.
The update’s strengths lie in Microsoft’s early notice and documented deployment options: the company has published actionable guidance that, if followed, should let most organizations and consumers transition without disruption. The major operational hazard is not the KB itself but the certificate rollover timeline: mismanaged fleets, unpatched firmware, or air‑gapped systems could see real impacts to secure boot trust and future boot‑time updateability if they do not act. In short: apply testing discipline now, coordinate with OEMs, and treat the June/October 2026 Secure Boot deadlines as immovable milestones in your update calendar. (support.microsoft.com, techcommunity.microsoft.com)

---

Conclusion
KB5063878 (OS Build 26100.4946) is available now through the usual channels; it bundles a servicing stack refresh, fixes, and AI component bits for Copilot+ devices while re‑emphasizing Microsoft’s critical Secure Boot certificate rollover timeline. Organizations and individual users should prioritize staged testing, OEM firmware validation, and adoption of Microsoft’s recommended readiness steps — especially for Secure Boot — to ensure a seamless, secure transition ahead of the June 2026 certificate expirations. (support.microsoft.com, techcommunity.microsoft.com)

---

Source: Microsoft - Message Center August 12, 2025—KB5063878 (OS Build 26100.4946) - Microsoft Support

 

[ChatGPT]

Microsoft released the August 12, 2025 cumulative update for Windows 11, version 24H2 — KB5063878 — published as a combined Servicing Stack Update (SSU) plus Latest Cumulative Update (LCU) that installs as OS Build 26100.4946, delivers a set of security and quality fixes, and bundles targeted AI component updates for Copilot+ devices while reiterating a high‑priority operational advisory about impending Secure Boot certificate expirations that begin in June 2026. rview
Microsoft’s August 12, 2025 package follows the consolidated SSU+LCU model used to simplify patching and reduce installation failures by shipping the servicing stack refresh together with the monthly cumulative fixes. The August package identifies as KB5063878 (OS Build 26100.4946) and includes an SSU component published as KB5065381 (OS Build 26100.4933) bundled inside the combined installer.
The update’s publicbroad areas:

• Security fixes and vulnerability mitigations included in the monthly roll-up.
• Quality and reliability improvements, including fixes for sign‑in delays observed on new devices.
• AI component refreshes packaged with the LCU that apply only to eligible Copilot+ hardware.

Microsoft states it is not currently awar at the time of publication; nonetheless, the company explicitly uses this release to reemphasize the Secure Boot certificate lifecycle timetable and urges administrators to begin multi‑quarter readiness work.

---

What’s in KB5063878 (quick technical summary)​

Core​

• KB article: KB5063878.
• OS Build after install: 26100.4946.
• Applies to: Windows 11, version 24H2 (all editions).
• Release date: August 12, 2025.

Servicing stack​

• Bundled SSU: KB5065381 (build 26100.4933) to ensure tht applies updates is current and robust. Administrators should note SSUs are effectively permanent once applied and complicate rollback.

AI component payload (Copilot+ devices only)​

The LCU contains updated AI component binaries that willws Copilot+ PCs. The KB lists the following component versions:

• Image Search — 1.2507.793.0
• Content Extraction — 1.2507.793.0
• Semantic Analysis — 1.2507.793.0
• Settings Model — 1.2507.793.0.

These files are included with the cumulative update but will not be added to standard Windows client or Windows Server SKUs; adreat the AI payload as conditional by hardware and licensing.

Notable user‑facing fixes​

One specifically called‑out quality improvement addresses a sign‑in delay that could affect newly provisioned devices led packages were present. That fix is user‑facing and should reduce first‑logon latency in affected scenarios.

---

Deep dive: Secure Boot certificate expiration — why this matters​

Microsoft used the KB publication to restate an ecosystem‑wide timetable for Secure Boot certifiministrators must prioritize now. Several Microsoft CA certificates that underpin UEFI Secure Boot trust chains (issued around 2011) are scheduled to begin expiring in June 2026, with a second expiration window for other certificate components in October 2026. If devices retain the legacy 2011 certificates beyond their expiration windows, they may stop accepting updates signed by the newer 2023 CA family and could lose the ability to receive pre‑boot security fixes — with the potential for degraded boot‑chain integrity and even failure to boot under certain configurations.
Why this isn’t just an OS update:

• Secure Boot trust anchors live in firmware and NVRAM variables (PK, KEK, DB/DBX). OS‑level updates can deliver new certificates to the EFI variables onlimplementations accept them. If firmware doesn’t permit or if OEMs fail to distribute compatible firmware, the OS-level certificate updates may not fully complete, leaving devices in a partially compatible state.
• The rollout design assumes a staged delivery: Microsoft is distributing 2023‑series certificates via Windows Update for many consumer devices, but managed or air‑gapped fleets will need a manual workflow, oftee OEM.

Which certificate expirations are most relevant (high level):

• Microsoft Corporation KEK CA 2011 — expiration: June 2026 — replacement: Microsoft Corporation KEK CA 2023.
• Microsoft UEFI CA 2011 and Microsoft Option ROM CA 2011 2026** — replacements in the 2023 family stored in DB.
• Windows Production PCA 2011 — expiration: October 2026 — replacement: Windows UEFI CA 2023.

This creates an unavoidable operational program: inventory, OEM coordination, firmware updates, and staged validation — not merely a one‑click Windows Update.

---

Deployment paths and admin guidance​

Microsoft documents multiple installation methods trators should pick the method that fits their environment but must plan around SSU permanence and Secure Boot dependencies.
Deployment options:

• Windows Updaor Business: automatic distribution per policy.
• WSUS: the update will sync when Products = "Windows 11" and Classification = "Security Updates".
• Microsoft Update Catalog: download MSU files for offline/manual installation.
• Offline serviciPackage for offline images or to update gold images.

Representative commands cited in the KB:

• DISM (online): DISM /Online /Add-Package /PackagePath:c:\packages\Windows11.0-KB5063878-x64.msu
• PowerShell: Add-WindowsPackage -Online -PackagePath "c:\packages\Windows11.0-KB5063878-x64.msu"
• Offline image: `DISM /Image:mountdir /Add-Package /PackagePath:"Windows11.

Operational notes:

• When the SSU is bundled, it is applied as part of the combined package and cannot be uninstalled independently. Rolling back the LCU after applying a combined package requires DISM and careful package identification; wusa.exe uninstall on the combined package will not remove the SSU. Plan rollback procedures accordin, staging, and rollback: recommended sequence

A disciplined rollout reduces risk. At a minimum, adopt this sequence:

• Inventory and classify devices by Secure Boot status, firmware version, and Copilot+ capability.
• Pilot the combined SSU+LCU on a small, representative ring (imaging, drivers, critical LOB apps) for 72–120 hours, monitoring Update logs, and health telemetry.
• Validate OEM firmware availability for devices that must accept the 2023 KEK/DB updates. Coordinate with OEMs for UEFI updates where required.
• Expand to broader rings only after no regressrollback paths (system restore points, image restore, DISM remove package) in advance.

Key checklist items for enterprise deployments:

• Confirm WSUS/SCCM synchronization settings (Produc to ensure automatic visibility.
• Ensure test images include the SSU (KB5065381) and understand that uninstall options are limited.
• Script aine servicing workflows for gold images and WinRE updates.

---

Risks, edge cases, and things to watch​

The KB lists no known issues at publication, but seds merit attention:

• Firmware lag and OEM readiness: The single biggest variable is OEM firmware. If OEMs do not publish firmware that permits the new es may remain partially compatible or fail to accept the certificate updates. This is an OEM coordinati, not solely an OS patch problem.
• Air‑gapped and specialized systems: Systems that caate will require manual certificate updates and an audited workflow to avoid missing the deadline. The operational cost of manually updating Secure Boot variables at scale is nontrivial.
• Dual‑boot and Linux compatibility: Many Linux distributions use Microsoft‑signed shims. If firmware refuses the new 2023 certs, or if shims rely on a signing path altered by the CA rollover, dual‑boot configurations could experience boot regressions. Validate repretups.
• Telemetry and policy tradeoffs: The Microsoft‑managed rollout for consumer devices implies telemetry settings and opt‑in behavior; organizations with strict privacy/regulatory constraints need to map that to their policies before opting into Microsoft-mates.
• Unlisted CVE detail: The KB provides high‑level descriptions of security fixes but does not enumerate every CVE. Administrators requiring per‑CVE triage must consult the Security Update Guide for canonical CVE mappings — do not rely on the KB text alone for CVE‑level decisions. Flag thisfication step.

When Microsoft says “no known issues,” treat that as a starting point for testing, not a guarantee of environment‑specific compatibility. Historical update cycles have repeatedly shown that unique driver, firmware, or third‑party software interactions can surface after br# Copilot+ devices and AI component considerations
KB5063878’s AI component updates are deliberately scoped to Copilot+ hardware. That selective installation strategy:

• Minimizes risk to the broader installed base by limiting aggressive AI binaries to qualifying devices.
• Requires admins to inventory which endpoints are Copilopliance, software inventory, and telemetry reporting remain accurate.
• Raises privacy and telemetry governance questions for organizations that opt to enable Copilot features at scale; review internal policies and vendor contracts before broad enablement.

For non‑Copilot devices, ex and quality fixes from the LCU — absence of AI binaries on a device is not an update failure.

---

Practical action plan (by audience)​

Home users and small businesses​

• Keep Windows Update enabled and apply KB5063878 when offered; Microsoft is staging the Secure Bo for many consumer devices.
• Install OEM firmware updates when published. Check msinfo32 to verify Secure Boot is enabled and note firmware versiocal data before applying system updates as a precaution.

IT administrators (SMB to enterprise)​

• Inventory devices by Secure Boot state, firmware age, and Copilot+ status.
• CooUEFI/firmware updates required to accept 2023 CA entries.
• Stage KB5063878 as a combined SSU+LCU in pilot rings and monitor for regressions foralidate WSUS/SCCM sync settings and offline DISM workflows for gold images.
• Prepare an exception register and compensating controls for devices that cannot be updated before the certificate expiry windows.

OEMs and firmwareare + certificate rollout scenarios and coordinate signals with Microsoft to ensure OS‑level updates can write KEK/DB entriesirmware readiness is the gating factor for the certificate transition.​

-- unresolved items
The KB provides the combined package manifest and high‑level guidance, but it does not enumerate everate body — use the Security Update Guide for per‑CVE detail and severity mapping. Adminisverify device‑specific firmware readiness with OEM advisories; those schedules are outside Microsoft’s difore environment‑specific. If any claim in vendor communications about firmware avatly verifiable from the OEM or Microsoft documentation for your specific model, treat it as unverifiable and escalate to your vendor con assessment — strengths and risks
Strengths:

• The combined SSU+LCU model reduces a common class of update failures and simplifies deployment; packaging the servicing stack refresh with the cumulative fixes is operationally prudent.
• Microsoft’s repeated,Secure Boot certificate expirations provides actionable lead time to plan cross‑vendor remediation, which is preferable to a compressed scramble.
• Targeted AI updates limit exposure to qualifying Copilot+ devices rather than the entire Windows footprint, a conservative engineering choice.

Risks and cautions:

• Firmware readiness remains the single largest operational unknown — OEM delays or unsupported devices create the most likely failure modes for Secure Boot transition.
• Air‑gapped, regulated, or dual‑boot environments face higher operational overhead and must plan manual certificate and firmware workflows.
• The KB’s “no knuld not replace rigorous lab testing; historical precedent shows edge cases and interactions with third‑party drivers or management agents can surface after broad rollouts.

---

Conclusion​

KB5063878 (OS Build 26100.4946) is a routine‑appearing Augthat bundles security and quality fixes, an SSU refresh (KB5065381), and conditional AI component updates for Copilot+ hardware. What elevates the update’s strategic importance is Microsoft’s he Secure Boot certificate lifecycle: several 2011‑era certificates will start expiring in June 2026 (with additional expirations in October 202le imposes a multi‑quarter, cross‑vendor readiness program for managed fleets. Administrators should treat the Secure Boot certificate transition as a project: inventory, test, coordinate with OE SSU+LCU, and maintain rollback and exception procedures. Home users should keep automatic updates enabled and apply OEM firmware updates when avaises must build and execute a tested deployment plan to avoid a disruptive and preventable outage as the certificate deadlines approach.

---

---

Source:** Microsoft Support August 12, 2025—KB5063878 (OS Build 26100.4946) - Microsoft Support

 

[ChatGPT]

Microsoft’s August Patch Tuesday delivers fresh cumulative updates for Windows 11 — KB5063878 for the 24H2 channel and KB5063875 for the 22621/22631 families — packaged as combined Servicing Stack Updates (SSU) plus Latest Cumulative Updates (LCU), with security fixes, reliability patches, and targeted AI component refreshes, while renewing a platform‑wide warning about impending Secure Boot certificate expirations in 2026.

Background / Overview​

Microsoft continues the consolidated SSU+LCU model that bundles the servicing stack (the component that applies patches) with the monthly cumulative rollup, reducing installation failures and simplifying deployment sequencing. The August 12, 2025 releases update Windows 11 24H2 systems to OS Build 26100.4946 (KB5063878) and update 22H2/23H2 build families to OS Builds 22621.5768 / 22631.5768 (KB5063875).
These releases follow the standard Patch Tuesday pattern: the LCU carries monthly security mitigations and quality fixes, while the bundled SSU ensures the servicing pipeline itself is current. Microsoft’s public guidance frames these updates as routine security + quality rollups but uses this month’s notes to reiterate a high‑priority operational advisory: several Microsoft Secure Boot certificates issued in 2011 begin expiring in mid‑2026, and IT teams must plan for a multi‑quarter remediation program.

---

What’s contained in the August 2025 updates​

High‑level summary (24H2: KB5063878)​

• Target: Windows 11, version 24H2 (all editions).
• Release date: August 12, 2025.
• Combined package: LCU + SSU (bundled SSU reported as KB5065381 in the combined payload).
• OS Build after install: 26100.4946.
• Primary content: monthly security mitigations, quality/reliability fixes (including rolled‑forward July previews), and conditional AI component updates for Copilot+ hardware.

High‑level summary (22621/22631: KB5063875)​

• Target: Windows 11 devices on the 22621/22631 build families (22H2/23H2 stabilization paths).
• Release date: August 12, 2025.
• OS Builds after install: 22621.5768 / 22631.5768.
• Primary content: security rollup, servicing‑stack refresh, and targeted reliability fixes (notably a Copilot hardware‑key restart reliability fix).

Notable functional and component updates​

• AI component refresh (Copilot+) — KB5063878 packages updated AI binaries (Image Search, Content Extraction, Semantic Analysis, Settings Model) to version 1.2507.793.0. These binaries are included in the cumulative package but will only install on eligible Copilot+ PCs that meet specific hardware, firmware and licensing criteria. Non‑Copilot devices and server SKUs will not receive these AI payloads. (thewincentral.com)
• Servicing Stack Update (SSU) — included SSUs in combined packages harden the update pipeline and reduce common installation errors; note that SSUs are effectively non‑removable once applied, which affects rollback planning.
• User‑facing fixes — Microsoft highlights targeted fixes such as resolving a sign‑in delay on newly provisioned devices (tied to preinstalled packages) and improving Copilot key restart reliability on some SKUs. These fixes are narrow but materially beneficial in provisioning and daily UX scenarios.

---

The Secure Boot certificate story — why this matters beyond a normal Patch Tuesday​

Microsoft’s August notes reiterate the much larger operational program to update Secure Boot trust anchors: several Microsoft CA certificates issued in 2011 are scheduled to start expiring in June 2026, with additional expirations in October 2026 for other components. If devices do not acquire the replacement 2023 CA chain before expiration, affected systems may lose the ability to receive pre‑boot security updates and in some configurations could experience Secure Boot trust failures. (support.microsoft.com, techcommunity.microsoft.com)

• The expiring certificates and their replacement timeline are explicit: the Microsoft Corporation KEK CA 2011 and the Microsoft UEFI CA 2011 (and related 2011 certificates) have replacements in the 2023 family, with June 2026 listed as the first expiration window. Failure to update the DB/KEK variables in firmware/NVRAM can result in loss of pre‑boot updateability or trust mismatches. (support.microsoft.com)
• Microsoft’s recommended approach: let Microsoft manage certificate updates via normal Windows Update channels for the majority of consumer devices; coordinate with OEMs on firmware updates (OEM firmware often needs to accept and persist the new keys); for air‑gapped or highly restricted systems, adopt a documented offline workflow because Microsoft cannot push updates automatically in those environments. (techcommunity.microsoft.com, support.microsoft.com)

Why this is operationally consequential:

• Secure Boot trust anchors live partly in firmware and partly in UEFI variables; updating them can require OEM firmware patches plus OS‑level variable writes that firmware will accept. That cross‑vendor coordination — firmware vendors, OEMs, IT management tooling — is the core of the complexity. (techcommunity.microsoft.com)

Cautionary note: Microsoft’s rollout is staged and aims to automate the bulk of updates for devices that report diagnostic telemetry. Organizations that block telemetry, run air‑gapped fleets, or use custom firmware channels must proactively prepare manual deployment plans. The registry opt‑in mechanism and diagnostic data considerations described by Microsoft are part of the orchestration approach; admins should validate readiness now rather than wait. (techcommunity.microsoft.com)

---

Deployment, testing, and rollback considerations​

Recommended deployment strategy (practical)​

• Inventory first — enumerate devices by OEM, model, firmware version, and Secure Boot state; map which endpoints are Copilot+ candidates. This inventory drives rollout sequencing and firmware coordination.
• Pilot ring (small, representative) — deploy to a small set of devices that cover major OEMs, drivers, and roles; include devices with and without Copilot hardware to validate conditional payload behavior.
• Phased expansion — widen deployment in controlled waves using Windows Update for Business, WSUS, or Microsoft Endpoint Configuration Manager to monitor telemetry and rollback signals.
• Firmware coordination — patch firmware for devices that require OEM KEK/DB updates before or in concert with OS‑side certificate updates. Engage OEM support channels and schedule maintenance windows when firmware updates are required. (techcommunity.microsoft.com)

Testing checklist (minimum)​

• Confirm Secure Boot State = On and collect Platform Key (PK), KEK, DB, and DBX versions (where supported) before updates.
• Verify that any imaging/PXE/WDS deployment images boot correctly after updates; test boot‑time signed components (bootloader, shim, option ROMs).
• Validate Copilot features on Copilot+ devices and ensure the conditional AI components do not produce unexplained failures on standard clients.

Rollback and removal realities​

• Because SSUs are often effectively permanent once installed in the combined package, rollback options are limited. IT plans must include offline images and known‑good backups; removal of an LCU inside a combined package can require DISM and package‑level removal steps rather than wusa uninstall. Document and rehearse recovery steps.

---

Known issues, early reports, and risk analysis​

• Microsoft reported no known issues at the time of publication for these August releases. That initial status reduces immediate alarm, but historical precedent shows that edge cases — particularly on systems with older firmware or niche drivers — can surface after broad rollouts. Administrators should remain vigilant during the first 72 hours of deployment and have log collection and feedback procedures ready.
• Independent outlets and community testing occasionally report platform‑specific behavior (performance and UI changes) as features roll out gradually. Consumer‑site testing has highlighted performance improvements in some scenarios after this update, but such results vary by hardware and are situational; treat vendor or publication performance claims as specific to their test environments, not universal guarantees. (windowslatest.com, windowscentral.com)
• The Secure Boot certificate transition is the single largest strategic risk in the near term. If organizations defer or inadequately plan for the KEK/DB updates, they risk losing pre‑boot updateability and the ability to trust newly signed boot components after the 2026 expirations. This could create availability and security consequences for managed fleets, especially appliances, VMs that emulate Secure Boot, and air‑gapped endpoints. (support.microsoft.com, techcommunity.microsoft.com)

Risk mitigation summary:

• Prioritize inventory and OEM firmware testing, enable Microsoft‑managed update channels where feasible, and treat the Secure Boot update program as a project — not a single patch.

---

Technical verification and cross‑checks​

To validate the key technical claims in public reporting:

• Microsoft’s Secure Boot certificate guidance and explicit June/October 2026 expiration timeline are documented in the Microsoft Support article and TechCommunity advisory. These authoritative notes establish the deadlines and recommended mitigation paths. (support.microsoft.com, techcommunity.microsoft.com)
• The KB identifiers and build numbers for the August 12, 2025 releases (KB5063878 → OS Build 26100.4946; KB5063875 → OS Builds 22621.5768 / 22631.5768) are reflected in Microsoft’s cumulative update messaging and were cross‑checked against independent reporting from Windows‑focused outlets; all sources converge on the same build IDs and dates.
• The conditional nature of Copilot+ AI component updates (they ship in the LCU but install only on eligible Copilot+ hardware) is called out in the KB notes and reconfirmed by secondary coverage and community testing. Administrators should therefore not interpret the absence of those AI binaries on a standard device as an installation failure.

Caveat: Some vendor or enthusiast test coverage references additional UI or feature changes (for example, Settings search repositioning or Quick Machine Recovery features). Those changes are typically delivered via staged feature rollout and may be gated by telemetry, region, or hardware — verify feature availability through controlled testing rather than assuming immediate presence on all devices. (windowscentral.com, windowslatest.com)

---

Actionable checklist for administrators and power users​

• Enable a minimum inventory pass: OEM model, firmware version, Secure Boot state, and management channel (Windows Update, WSUS, ConfigMgr, Intune).
• For managed fleets: opt into Microsoft‑managed Secure Boot updates where policy and compliance allow; coordinate with OEMs for firmware updates. (techcommunity.microsoft.com)
• Create a pilot ring that includes representative Copilot+ hardware, legacy OEMs, and air‑gapped systems to validate both OS updates and any firmware key enrollment steps.
• Prepare recovery paths: system image backups, offline repair media, and documented DISM package removal steps for LCUs, understanding SSU permanence.
• Monitor telemetry and community channels closely for 72 hours after rollout for OEM‑specific regressions or driver interactions. Log and escalate reproducible failures to OEM support and Microsoft as appropriate.

Numbered quick start for an emergency patch window:

• Validate inventory and Secure Boot states across critical systems.
• Pilot KB deployment to 1–5% of fleet (covering OEM variety).
• Confirm firmware updates apply cleanly on pilot devices.
• Expand to production rings if telemetry is clean; hold off if any Secure Boot variable failures or boot issues appear.
• Escalate to OEM / Microsoft support immediately for any unexplained variable writes or boot regressions.

---

Strengths, limitations, and final assessment​

Strengths:

• The combined SSU+LCU model continues to reduce common update sequencing errors and simplifies patch pipelines for administrators. That reduces the incidence of failed updates caused by outdated servicing components.
• Microsoft’s public, widely communicated Secure Boot certificate timeline gives organizations months to prepare and coordinate with OEMs, reducing the risk of late surprises. The guidance includes explicit opt‑in mechanisms and technical guidance for managed and air‑gapped fleets. (support.microsoft.com, techcommunity.microsoft.com)
• Conditional AI updates allow Microsoft to advance Copilot features on qualifying hardware without exposing non‑eligible devices to unnecessary change, lowering upgrade surface area for standard clients.

Limitations and risks:

• The Secure Boot certificate program is cross‑vendor by nature and therefore operationally complex. Firmware updates or manual key enrollments are required in many cases — a nontrivial undertaking for large or heterogeneous fleets. Failure to plan will create serviceability and security gaps by mid‑2026. (techcommunity.microsoft.com)
• SSU permanence complicates rollback strategies. Environments that require reversible patching should validate offline recovery images and accept that full rollbacks may require image restores rather than simple uninstallation.
• Staged feature rollouts, telemetry gating, and hardware‑gated AI components mean that user‑visible benefits reported in press testing may not be universal; treat performance or UX claims as environment‑dependent until validated internally. (windowslatest.com, windowscentral.com)

---

Conclusion​

The August 12, 2025 Patch Tuesday updates — KB5063878 (24H2) and KB5063875 (22621/22631 families) — are routine in structure but strategically important in timing. They deliver the expected monthly security and quality fixes while bundling servicing stack improvements and conditional AI component updates, and they serve as a timely reminder that the Secure Boot certificate lifecycle requires immediate operational planning for June/October 2026 expirations. Administrators should treat the Secure Boot transition as a multi‑quarter program of work: inventory devices, coordinate firmware updates with OEMs, validate pilot deployments, and ensure recovery plans accommodate the realities of SSU permanence. Applying the August packages as part of a staged, measured rollout — with prioritized attention on firmware and pre‑boot trust state — will best position organizations to avoid preventable outages and maintain updateability in the years ahead.

---

Source: Neowin Windows 11 (KB5063878, KB5063875) August 2025 Patch Tuesday out