Overview

This knowledge base article describes a boot failure that may occur after installing Windows Update KB5101650 on systems with Matrix42 Full Disk Encryption (FDE) installed. After the update is applied, affected systems may fail to boot into Windows and remain in a pre-boot or recovery state. The issue occurs because the update replaces the FDE boot loader with the standard Windows Boot Manager. This article provides instructions for diagnosing the issue and restoring the EFI boot environment to recover affected systems.

Affected Environment

• Windows Update: KB5101650
• FDE: Any version with FDE installed
• Hardware: Not hardware-specific

Symptoms

Affected systems show one or more of the following symptoms after installing Windows Update KB5101650:

• Windows fails to boot after system restart
• System remains in a pre-boot or recovery state
• No successful transition from EFI boot phase to Windows
• Reboot loops or inability to reach the Windows login screen

Known Conditions and Scope

• The issue occurs after installing Windows Update KB5101650
• Full Disk Encryption (FDE) is installed on the affected system
• The issue is not specific to any hardware model or manufacturer

Prepare the Media for Recovery

Prerequisites

• USB stick (FAT32 formatted)
• Custom Shell.efi downloaded from GitHub that enables execution of EFI-level commands
• Download Link: GitHub 

Steps

• Format the USB stick as FAT32.
• On the USB stick, create the following directory: EFI\Boot\
• Copy the downloaded Shell.efi into that folder and rename it to bootx64.efi.

The USB stick is now ready to boot directly into the UEFI Shell.

EFI Boot Restoration (Recovery Procedure)

This procedure restores the Microsoft bootloader in the EFI system partition. It should only be performed by experienced administrators.

Accessing the UEFI Shell

• Enter the BIOS on the affected system.
• Disable Secure Boot. The UEFI Shell is not signed and will not load while Secure Boot is enabled.
• Configure the USB stick as the first boot device.
• Save and restart the system to load the UEFI Shell.

Identifying the EFI System Partition

• Identify the correct file system mapping (fs0, fs1, fs2, …).
• Enter a file system and list its contents:

fs0:
ls

If \EFI\Microsoft\Boot exists, this is the EFI system partition. Note the filesystem label (e.g. fs0:) for use in the steps below.

Diagnosing the Issue

List the contents of the boot directory:

ls \EFI\Microsoft\Boot\

The update has overwritten the FDE boot chain if bootmgfw.efi is approximately the same size as ebootmgfw.efi and significantly larger than esbootmg.efi. Under a healthy FDE installation, bootmgfw.efi and esbootmg.efi are the same size.

Restoring the FDE Boot Chain

Run the following commands, replacing fs0: with the filesystem label identified above:

cp fs0:\EFI\Microsoft\Boot\bootmgfw.efi fs0:\EFI\Microsoft\Boot\ebootmgfw.efi
fs0:\EFI\Microsoft\Boot\esbootmg.efi fs0:\EFI\Microsoft\Boot\bootmgfw.efi

The first command preserves the Windows Boot Manager placed by the update as the FDE chain-load target. The second restores the FDE loader as the active boot entry — the same state as after a clean FDE installation.

• Remove the USB stick and restart the system. The FDE Pre-Boot Authentication screen should appear.

Post-Recovery Notes

• Re-enable Secure Boot in the BIOS after successful recovery
• Verify that Windows boots normally
• Ensure FDE functionality is fully operational
• Apply any additional updates only after validation

Summary

• A boot failure may occur after installing Windows Update KB5101650 on systems with FDE enabled
• The issue is not limited to specific hardware models or manufacturers
• A FAT32 USB stick containing the UEFI Shell is sufficient to perform the recovery — no WinPE or FDE package is required
• Secure Boot must be temporarily disabled to allow the unsigned UEFI Shell to run
• EFI boot restoration using the UEFI Shell allows affected systems to recover