Performing OS updates

Cumulative updates

This type of updates can be installed as you would on your computer. Nothing special here.

Feature (or full OS) updates

These are currently problematic on the Raspberry Pi. Microsoft doesn't expect users to use Windows with test signing mode always enabled, because drivers are supposed to be production-signed. Certificates are costly, so this is simply not worth doing for a completely free and community-driven project. Now you also know why there's a little watermark in the lower right corner of the desktop interface.

One of the issues is that the test-signing mode doesn't persist across such updates if the SafeOS phase is required (which is often the case, especially when booting from USB). The other issue is that Windows has certain requirements for drivers to get integrated into the SafeOS image. Our drivers don't meet those requirements (we're investigating this), so the image ends up with no boot drivers at all. Great, isn't it?

Working around the issues

Fortunately it is possible to interrupt the update process and give it a little help.

These are the steps:

1) If you're booting from USB, the Setup wizard will complain that "You can't install Windows on an USB drive". To bypass this, download and apply this .reg file on your RPi.

2) Start the update process either through Windows Update or setup.exe from a newer ISO image.

3) If you're updating to a newer build of Windows 11, you'll run into a message telling you that some requirements are not met. To bypass this:

  • Go to C:\$Windows.~BT\Sources and rename appraiserres.dll to appraiserres1.dll.
  • Press Back in the Windows Setup window and try again. It should let you continue now.
  • Rename appraiserres1.dll back to appraiserres.dll.

4) Wait for it to download and begin installing. You'll be staring at the "Installing Windows 10" screen for a while (depending on the speed of your boot drive), but you must check it from time to time, and most importantly, don't let it fully reboot!

5) When it wants to reboot for the first time, wait for it to gracefully shut down then power off the Raspberry Pi and unplug the boot drive.

6) Plug the boot drive into your PC.

7) Download the latest drivers package and the Boot Partition Mounter utility from the Downloads page, then extract them somewhere convenient.

8) Run the Boot Partition Mounter utility, select the boot drive (SD card or USB drive), then click on the Mount button.

9) Open a Command prompt (NOT PowerShell) window as Administrator.

10) Execute the commands below. We'll refer to R:\ and W:\ as the Windows and Boot partition letters respectively. They'll likely be different for you, so replace them accordingly. D\DirectoryWhereIHaveExtractedTheDrivers obviously needs to be replaced as well.

  1. dism /image:"R:\$WINDOWS.~BT\NewOS" /add-driver /driver:"D:\DirectoryWhereIHaveExtractedTheDrivers" /recurse /forceunsigned
  2. mkdir "R:\$WINDOWS.~BT\Sources\SafeOS\safeosmount"
  3. dism /mount-image /imagefile:"R:\$WINDOWS.~BT\Sources\SafeOS\winre.wim" /index:1 /mountdir:"R:\$WINDOWS.~BT\Sources\SafeOS\safeosmount"
  4. dism /image:"R:\$WINDOWS.~BT\Sources\SafeOS\safeosmount" /add-driver /driver:"D:\DirectoryWhereIHaveExtractedTheDrivers" /recurse /forceunsigned
  5. dism /unmount-image /mountdir:"R:\$WINDOWS.~BT\Sources\SafeOS\safeosmount" /commit
  6. rmdir "R:\$WINDOWS.~BT\Sources\SafeOS\safeosmount"
  7. bcdedit /store W:\EFI\Microsoft\Boot\BCD /set {bootloadersettings} nointegritychecks on
  8. bcdedit /store W:\EFI\Microsoft\Boot\BCD /set {bootloadersettings} testsigning on

11) Click on the Unmount button in the Boot Partition Mounter utility, and close it.

12) Unplug the boot drive from your PC, connect it to your Raspberry Pi and boot it up.

13) If everything went right in the previous steps, it should continue the update process and boot normally. That's all!