AB#8375: Windows 10 to Windows 1123H2 Upgrade Failure (0x80092003 CRYPT_E_FILE_ERROR)

New article for [CI 8375](https://dev.azure.com/KMOps/ContentExperience/_queries/edit/8375)

Author: v-tappelgate

support/windows-client/setup-upgrade-and-drivers/windows-10-to-windows-1123h2-upgrade-fails-0x000000c1-0x80092003.md

@@ -0,0 +1,54 @@
+---
+title: Error 0x000000c1 or 0x80092003 CRYPT_E_FILE_ERROR Stops In-place Upgrade from Windows 10 to Windows 11
+description: discusses an issue in which an in-place upgrade to Windows 11, version 23H2 fails and rolls back on a Windows 10 device that has the UEFI CA 2023 signed bootloader installed.
+ms.date: 12/18/2025
+manager: dcscontentpm
+audience: itpro
+ai-usage: ai-assisted
+ms.topic: troubleshooting
+ms.reviewer: warrenw, kaushika, v-appelgatet
+ms.custom:
+- sap:windows setup,upgrade and deployment\installing or upgrading windows
+- pcy:WinComm Devices Deploy
+appliesto:
+- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Supported versions of Windows Client</a>
+---
+# Error 0x000000c1 or 0x80092003 CRYPT_E_FILE_ERROR stops in-place upgrade from Windows 10 to Windows 11
+
+This article discusses an issue in which an in-place upgrade to Windows 11, version 23H2 fails and rolls back on a Windows 10 device that has the UEFI CA 2023 signed bootloader installed.
+
+## Symptoms
+
+Consider the following scenario:
+
+- You have a Windows 10 device that uses the UEFI CA 2023 signed bootloader that was installed by Windows Update  after July 9, 2024.
+- Using Windows Update (or media that's downloaded from Windows Update), you perform and in-place upgrade to upgrade the device from Windows 10 to Windows 11, version 23H2.
+
+After the upgrade reaches the OOBE restart phase, the upgrade fails, rolls back to Windows 10, and generates one of the following error codes:
+
+- 0x80092003 (CRYPT_E_FILE_ERROR)
+- 0x000000c1
+
+If you upgrade the device by using the latest Windows 11 23H2 ISO image for source media, the upgrade succeeds. Similarly, if you upgrade the device to Windows 11 24H2 by using the [Windows 11 Installation Assistant](https://www.microsoft.com/en-us/software-download/windows11), the upgrade succeeds.
+
+## Cause
+
+Windows updates that were released on and after July 9, 2024 contain protections for a publicly disclosed Secure Boot security feature bypass. These updates install %systemdrive%\bootmgfw_2023.efi, which is a UEFI CA 2023-signed bootloader. For more information about the vulnerability and the fix, see the following articles:
+
+- [Secure Boot Security Feature Bypass Vulnerability, CVE-2023-24932](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932
+- [How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d)
+
+The issue occurs because this file wasn't part of the original Windows 11 23H2 upgrade media or Safe OS Dynamic Update (SafeOS DU) media. The upgrade process uses the Windows Recovery Environment (WinRE) while it validates or updates boot files. Because the bootloader on the device is newer than the bootloader in the Windows 11 upgrade media, the upgrade process can't update boot information on the WinRE image under %systemroot%\~BT\Sources\Rollback\EFI\Microsoft\Recovery. As a result, the upgrade fails and rolls back.
+
+This issue doesn't affect the latest version of the Windows 11, version 23H2 media, the Windows 11, version 24H2 media, or media for later versions.
+
+## Resolution
+
+The fix for this issue was released in February 11, 2025. To use this fix during your in-place upgrade, use one of the following methods
+
+- Upgrade directly to Windows 11, version 24H2 or a later version. Use either Windows Update or media that was created after February 11, 2025.
+- Upgrade to the latest release of Windows 11, version 23H2. Use either Windows Update or media that was created after February 11, 2025.
+- If you have to upgrade to an earlier version of Windows 11, use one of the following methods:
+
+  - During the upgrade process, allow the device to connect to Windows Update and automatically download and install [KB5052424: Safe OS Dynamic Update for Windows 11, version 22H2 and 23H2: February 11, 2025 - Microsoft Support](https://support.microsoft.com/topic/kb5052424-safe-os-dynamic-update-for-windows-11-version-22h2-and-23h2-february-11-2025-09aa3ccd-7eb0-4009-af9e-5e01c7492279).
+  - Modify the installation media image to slipstream the KB5052424 update.