Knowledge Base

Scenario

Administrators and end users are missing their certificates after a recent update on their local system.

The issue has been recognized and acknowledged by Microsoft: Devices in a managed environment using update management tools or ISO images might lose certificates when updating.

System and user certificates might be lost when updating a device from Windows 10, version 1809, or later to a later version of Windows 10. Devices will only be impacted if they have already installed any Latest cumulative update (LCU) released September 16, 2020, or later and then proceed to update to a later version of Windows 10 from media or an installation source that does not have an LCU released October 13, 2020, or later integrated. This primarily happens when managed devices are updated using outdated bundles or media through an update management tool such as Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager. This might also happen when using outdated physical media or ISO images that do not have the latest updates integrated.

See: Microsoft Technical Note

Affected platforms:

• Client: Windows 10, version 20H2; Windows 10, version 2004; Windows 10, version 1909; Windows 10, version 1903
• Server: Windows Server, version 20H2; Windows Server, version 2004; Windows Server, version 1909; Windows Server, version 1903

Solution

This issue is now resolved when using the latest feature update bundles and refreshed media. 

Feature update bundles were released on November 9, 2020, for Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. Refreshed media was released on November 3, 2020, on Volume Licensing Service Center (VLSC) and Visual Studio Subscriptions (VSS, formerly MSDN Subscriptions). 

For information on verifying you're using the refreshed media, see How to address feature update refreshes in your environment. If you are using or creating custom media, you will need to include an update released on October 13, 2020, or later.

See: How to contact DigiCert Support
See: How to export certificates stored in the DigiCert PKI client

It is highly recommended to back up your certificates.