This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
I received the Patch Tuesday releases today. KB4532693, KB4537759 and KB4538674 dropped in the first wave and all installed successfully. On a subsequent "Check for Updates" KB4524244 downloaded and installed but on the reboot, it rebooted the first time but froze hard on the second re-boot with Step 2 information and a frozen spinner on my screen, no keyboard or any access. After about 15 mins I finally forced the system down. On the reboot, my Secure Boot flagged me that the keys were corrupted. I was able to get those repaired and reboot into the system. I rebooted a couple more times but no updates attempted to install. On a third "Check for updates, the same (KB4524244) update attempted to download but freezes the system at 94% on the download. Again freezes hard requiring a hard re-set. I tried flushing the Software Distribution cache but get the same results.
FYI: I am running Windows defender with VBS (Credential Guard and Hypervisor enforced Code Integrity on an HP EliteDesk 705 G4 MT with a AMD Ryzen 5 PRO 2400G with Radeon Vega Graphics. I also have a similar set up running on an HP laptop (Intel i5), but the update installed fine on it.
Help
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
So glad to hear it, bjia34. Thanks for the update. Right, someone else indeed may be helped. Good going.
I've got a pinhole on this Dell Inspiron 3542 to open the CD-ROM when stuck. I presume yours was stuck which indeed does sound like it could mess with BIOS. BIOS might want to try to boot from it depending on the boot order menu.
Glad you worked it all out. I really thought you were done for. I have to keep this in mind for the next guy.
Well based on all the quick responses sounds like I am not alone.
For me I think it best to wait this out and see if it gets resolved upstream. I am blocking the update. I would caution anyone reading this about trying to turn off Sure Start and trying if you have already failed the initial install, unless maybe all you have dabbled with in the BIOS settings is turning Sure Start on and off.
Thanks for all of the feedback.
Hi, Xipit.
Your approach is the correct approach.
This is one of those cases where efforts placed in using Windows Troubleshooting tools, resetting/repairing Windows Updates, renaming SoftwareDistribution, and/or manual KB installation has little value.
Blocking it at this time is the best route.
....winston natoli
Hi Guys. I'm an old guy but I know just enough to usually fix my two computers. The laptop after this series of faulty updates will usually boot after 3-5 attempts. Otherwise just the bios is displayed and it shows my combo drive missing. Neither the SSD or HDD is shown connected. When it does boot up properly its prone to lock up mostly if in any browser and searching. I uninstalled two of the KB updates and things were stable for 3-4 day however somehow automatic updates reinstalled KB4532693 and the problems started all over. Why doesn't Microsoft pull that update? It obvious that its causing a world of issues. I'll just continue killing updates or blocking them or if my laptop bricks I will finally buy an Apple product.
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
thanks
In our environment, this is happening on all HP AMD based machines with Sure Start Secure Boot Key Protection enabled. If we turn that off before the initial attempt to install the KB then the KB will install. After restart we can renable the Sure Start protection. Each machine we've done this to also has to be rebooted two more times after the patch install for the NIC to be come active properly again. During the time the NIC isn't working properly an "ipconfig /all" command won't show the NIC adapters, but they appear in Device Manager and in Control Panel/Network Connections. On PCs where the Sure Start protections are in force at the time of patch install we get the same error Mikael Sillman
did. Sure Start then resets the keys and the system will boot up. Subsequent attempts to install the patch fail. Most often the error code is 0x80242FFF.
