Windows 11 KB5062693 Update Enhances Recovery Environment & Addresses Secure Boot Expiration

Summary​

• Purpose: This update makes improvements to the Windows Recovery Environment (WinRE) in Windows 11, versions 22H2 and 23H2.

Secure Boot Certificate Expiration​

• Important: Secure Boot certificates on most Windows devices will start to expire in June 2026, which could prevent secure booting if not addressed.
• Action: Review guidance and update certificates ahead of time. See Windows Secure Boot certificate expiration and CA updates for steps.

How to Get This Update​

• The update is available via Windows Update. It will be downloaded and installed automatically.

• Download the standalone package from the Microsoft Update Catalog.
• For manual installation, see the Add an update package to Windows RE documentation.

• For Windows 11, version 23H2: The update is part of the monthly security update and is synced automatically if the proper Products and Classifications are set.
• For Windows 11, version 22H2: Refer to other release channels.

Additional Information​

• Restart Required: No.
• Can It Be Removed? No, this update cannot be removed once applied.
• Replaces: KB5061090.
• After Installation: WinRE version should be 10.0.22621.5624.

How to Verify WinRE Version​

• PowerShell script: Use GetWinReVersion.ps1 to check the installed WinRE version.
• Event Viewer: Look for WinREAgent event IDs for servicing completion.
• DISM Command: Use Dism /Get-ImageInfo /ImageFile:<path-to-winre.wim> /index:1 to get WinRE details.

File Information​

• The update installs several files, such as skci.dll, securekernel.exe, and others with version 10.0.22621.5624.
• See the full KB article for the detailed file list.