Might be one of the reasons they pulled that build. I saw the initial post by CrazyKats and went to download it and there was no update. Came back here and the post about the update was gone. Couple hours later the post was back so I updated, then the post was gone again. Checked the flight builds and it doesn't show the .1611 build.
Canary Build 28020.1611 fails to boot WinRe, because winload.efi cannot verify signature.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 31%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFG%3C/text%3E%3C/svg%3E)
F G
271
Reputation points
Build 28020.1611 fails to boot WinRE with this error showing in the screenshot below.
The digital signature for this file couldn't be verified.
File: \windows\system32\winload.efi
Error code: 0xc0000428
The problem was already happening on previous Canary build 28020.1546 and carried on on current build.
I compared the WinRE winload.efi on Dev that does not have this problem versus Canary that fails loading WinRE, you can see below that in Canary build the Catalog signature is completely missing and for that reason the signature cannot be verified by Dell XPS 8930 and Dell XPS 8940 firmware.
Why is the Catalog signature missing on WinRE winload.efi on Canary Builds?
Note that the winload.efi for the normal OS boot has the Catalog signature present on both builds and it has no problem booting.
Windows Insider program | Windows Insider preview | Repair and recovery
{count} votes
-
F G 271 Reputation points
2026-02-17T03:33:18.7066667+00:00 This is the FBH report submitted for the problem:
-
F G 271 Reputation points
2026-02-17T03:55:47.93+00:00 This is the normal OS winload.efi in Canary Build 28020.1611. You can see that it has both an embedded signature and a Catalog signature and it has no problem booting.
Embedded signature certificate "Microsoft Development PCA 2014"
Catalog signature, certificate "Microsoft Windows Production PCA 2011"
The winload.efi in WinRE for this same Canary build is missing the Catalog signature completely and fails to boot WinRE with the error below.
The digital signature for this file couldn't be verified.
File: \windows\system32\winload.efi
Error code: 0xc0000428
-
F G 271 Reputation points
2026-02-17T08:16:12.2433333+00:00 Further clarification after checking the WinRE winload.efi across different builds.
Copilot suggested the OEM firmware validation chain for the trust behavior.
It helped clearing the picture and why Canary fails the WinRE boot while it passes the normal OS boot.
A)
• 26200.7840
• Embedded signature: Microsoft Windows Production PCA 2011
• Catalog signature: Missing
• Result: WinRE boots
• Reason: Production PCA is trusted directly by OEM firmware.
B)
• 26300.7760
• Embedded signature: Microsoft Development PCA 2014
• Catalog signature: Present
• Result: WinRE boots
• Reason: Catalog signature provides a production‑signed trust path.
C)
• 28020.1611 (problem build)
• Embedded signature: Microsoft Development PCA 2014
• Catalog signature: Missing
• Result: WinRE fails to boot on Dell systems
Conclusion:
The correct trust behavior observed across builds is:
• Production PCA 2011 embedded signature → trusted directly → catalog optional
• Development PCA 2014 embedded signature → not trusted → requires catalog signature
• Dev PCA + missing catalog → Secure Boot failure (28020.1611)
-
F G 271 Reputation points
2026-02-19T01:03:19.8133333+00:00 Tried installing 29531.1000 on Feb 18, 2026, on the same Dell XPS 8930 and Dell XPS 8940 and cannot even boot the normal OS it gets the same Error code: 0xc0000428.
The problem is no longer just limited to WinRE, it gets the same error on the main OS.
Sign in to comment
1 answer
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 5%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDV%3C/text%3E%3C/svg%3E)
DAVID V 15 Reputation points2026-02-17T05:20:13.7333333+00:00 -
F G 271 Reputation points
2026-02-17T05:29:44.85+00:00 That Canary build 28020.1611 was not pulled. Also, the problem already existed in previous build 28020.1546. 😂🤷♂️
Microsoft is just screwing up and causing this problem in WinRE winload.efi signature validation.
28020.1611 was released on Feb 12 as showing on the blog.
I added another comment to my original post that helps clarify the chain of OEM validation and why Canary fails when booting WinRE.
-
DAVID V 15 Reputation points
2026-02-17T17:04:43.84+00:00 It's not listed on the flight hub, that's why I thought it was pulled. I do remember that there were posts in the past about WinRE problems.
Sign in to comment -