Microsoft Resolves Group Policy Issue Blocking Windows 11 24H2 Installation

Microsoft has resolved a critical enterprise-focused bug that blocked organizations from deploying Windows 11 24H2 through Windows Server Update Services (WSUS), alongside addressing a separate dual-boot Linux compatibility issue tied to older security updates.

These fixes come as part of broader efforts to stabilize the 2024 Update rollout, which introduces AI-driven Copilot+ PC features and security enhancements.

A significant technical hurdle emerged in late April 2025 when organizations using WSUS-a tool for managing centralized Windows updates-found themselves unable to download or install Windows 11 24H2 on devices running versions 22H2 or 23H2.

- Advertisement -

The issue, linked to the April 2025 security update (KB5055528), caused download failures with error code 0x80240069 and abrupt termination of the Windows Update service (wuauserv).

Microsoft traced the problem to a conflict between the update’s metadata and WSUS’s approval mechanisms, which incorrectly flagged the 24H2 upgrade as incompatible.

While home users remained unaffected, enterprise IT teams faced operational delays, particularly in sectors requiring phased deployments.

The company deployed a Known Issue Rollback (KIR) via a specialized Group Policy patch (Windows 11 22H2 KB5055528 250426_03001 Known Issue Rollback.msi) to reverse the faulty update checks.

Administrators must apply this policy under Computer Configuration > Administrative Templates to restore WSUS functionality, though Microsoft continues to investigate a permanent resolution.

August 2024 Security Updates

In a separate but equally critical development, Microsoft mitigated a 2024 Secure Boot Advanced Targeting (SBAT) conflict that rendered Linux partitions unbootable on dual-boot systems.

The August 2024 security update (KB5041585) introduced SBAT revocations to block vulnerable bootloaders but erroneously applied them to devices with custom Linux configurations, triggering “Security Policy Violation” errors during boot.

The fix, implemented in the September 2024 update (KB5043076), exempts dual-boot systems from SBAT enforcement.

Affected users must temporarily disable Secure Boot, purge SBAT revocations using Linux terminal commands like sudo mokutil --set-sbat-policy delete, and apply a Windows registry edit (reg add HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\SBAT /v OptOut) to prevent recurrence.

Microsoft emphasizes that single-boot Windows systems should retain SBAT protections to guard against firmware-level exploits.

Businesses’ Mitigation Strategies and User Advice

For organizations grappling with the WSUS bug, Microsoft advises immediate deployment of the KIR Group Policy alongside rigorous testing of 24H2 compatibility in staging environments.

IT teams should prioritize updating WSUS servers and client devices to Build 22621.5189 or later to avoid metadata mismatches.

Dual-boot users, meanwhile, should install the September 2024 update or later to bypass SBAT conflicts.

Those unable to update immediately can follow Microsoft’s recovery protocol but must re-enable Secure Boot afterward to maintain system integrity.

According to the Report, The company also recommends updating Linux distributions to ensure bootloader compatibility with modern SBAT standards.

Looking ahead, Microsoft reaffirms its commitment to the Windows 11 24H2 rollout, citing improved AI integration and security frameworks.

Enterprises and home users alike are encouraged to adopt the update before the November 2025 end-of-support deadline for Windows 11 23H2 Home and Pro editions.

Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download