Windows 10 KB5063159 fixes bug that wouldn't let some Microsoft Surface devices boot

Microsoft released Windows 10 Patch Tuesday updates for the month last week. The one for Windows 10 under KB5060533 / KB5060531 / KB5061010 / KB5060998 introduced a bug that would not let Surface Hub v1 devices start due to a Secure Boot validation issue. As such, Microsoft had paused the update similar to the compatibility blocks or safeguard holds it applies for major feature updates as well.

This bug was uncovered after the update went live, as Microsoft later added it to the list of known issues for that update and it also put up a big notice in bold. It wrote:

Notice for Surface Hub v1 users

DO NOT install this update. Instead, install update KB5063159.

...

After installing this update for Windows 10, version 22H2, Surface Hub v1 devices might fail to start with error: “Secure Boot Violation: Invalid signature detected. Check Secure Boot Policy in Setup.” Surface Hub 2S and Surface Hub 3 are not impacted by this issue.

Earlier today, the company released an out-of-band (OOB) update to address the issue. It has been published under KB5063159 and is only being offered to Surface Hub v1 devices instead of the buggy KB5060533 Patch Tuesday one.

In the description of the new OOB update, Microsoft writes:

This update includes fixes and quality improvements that were a part of update KB5060533 (released June 10, 2025).

This update prevents Surface Hub v1 devices from encountering a start failure issue. The start failure issue was observed when some Surface Hub v1 devices installed the update KB5060533. On June 11, 2025, we paused the update KB5060533 offering for Surface Hub v1 to prevent new devices from experiencing the failure.

You can find the support article for KB5063159 here on Microsoft's website. It is downloaded and installed automatically but users can also manually download it from the Microsoft Update Catalog website.