How can i add the 2023 boot CA to the LiteTouchPE_x64.wim?

[Crabertes]

Hi,
how can i add the 2023 boot CA to the LiteTouchPE_x64.wim?

I tried to follow these instructions, but it did not work out.

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive?view=windows-11#update-the-windows-pe-add-on-for-the-windows-adk

[UlfMitHand]

A combination of these guides did it for me.

https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-servicing#download-and-install-the-windows-adk-patches-1

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive?view=windows-11#update-the-windows-pe-add-on-for-the-windows-adk

https://lenovopress.lenovo.com/lp2353-updating-windows-boot-manager-and-winpe-windows-uefi-ca-2023-certificate#create-winpe-bootable-media-with-ca-2023

https://techdirectarchive.com/2026/05/15/pxe-boot-failure-access-denied-or-aborted-with-secure-boot-on/

https://techdirectarchive.com/2026/04/27/update-winpe-boot-images-with-windows-uefi-ca-certificates-part-2/

https://techdirectarchive.com/2026/05/15/pxe-boot-failure-access-denied-or-aborted-with-secure-boot-on/

[jimbeam128]

I am also trying to get it to work, but I fail at pxe-booting the device. I added wdsmgfw.efi and bootmgfw.efi to the remoteinstall folder.
But when I boot my Notebook (Lenovo) I get Error 0xc0000704.

I should get the Selection menu to select my boot environment, but I do not get there.

Strange is, on a vmware VM where I have the CA 2023 Certificates in the Firmware AND revoked the CA 2011 Certificate, I can fully boot into my boot environment....

Does anyone have a clue?

[UlfMitHand]

Try using the file you took for "bootmgfw.efi" also as the file for "wdsmgfw.efi" this way or the other way round worked for me. (I used the same file twice)

[jimbeam128]

Hi @UlfMitHand ,

I tried both files from Win 11 ADK 2025 winpe.wim. When using bootmgfw.efi as wdsmgfw.efi I get a different error.

Then there comes this one:

On Wireshark I can see this here on the server-side:

Do you have any more suggestion / hint for me?

Curious is, on vmware virtual machine it is working when using the "Standard" wdsmgfw.efi file with CA 2023 Certificate signed. On that VM there are the CA 2023 Certificates available and I also revoked the CA 2011 Certificates on the VM to test.
But on a physical laptop I get the 0xc0000704 error...

Here are the file versions I used:

wdsmgfw.efi: 10.0.27954.300 (WinBuild.160101.0800)
bootmgfw.efi: 10.0.27954.300 (WinBuild.160101.0800)

taken from the winpe.wim ADK 2025

I checked the version with the command

get-item | select versioninfo | fl

[jimbeam128]

So I could isolate the Problem in my environment. We have different VLANs for Clients and Servers.
The setup with CA 2011 Efi files works fine. When replacing with CA 2023 Files I get 0xc0000704 error.

I created a test-setup where the server and the physical client are on the same network (broadcast domain), then it works...
I´m pretty sure that IP-Helper addresses should be correct. Will check it on the switches. But for now I can say it is working in general.