HP Pulls Software Update After It Deletes Microsoft Certificates for Windows 11 Devices

Strategic Insights -

HP's AI PCs were unexpectedly disconnected from their companies' cloud environments after a software update deleted Microsoft certificates required for login authentication. The error was discovered by Rudy Ooms, a security expert, who found the issue was caused by a script that was designed to remove remnants of HP's 1E Performance Assist software but instead targeted certificates containing the "1E" substring. The incident highlights the potential risks of silent, background updates and the importance of thoroughly testing software before deployment.

Key Takeaways:

  • The HP OneAgent software update version 1.2.50.9581 for Windows 11 mistakenly deleted Microsoft certificates required for Microsoft Entra ID login authentication, disconnecting devices from their company's cloud environments.
  • The error was caused by a script that searched for and deleted any certificate containing the "1E" substring in its subject, issuer, or friendly name, despite being designed to remove remnants of HP's 1E Performance Assist software.
  • The incident highlights the potential risks of silent, background updates and the importance of thoroughly testing software before deployment.
  • Only a 9.3% chance that certificates contain the "1E" chain in the Subject field, limiting the scope of the issue.
  • The faulty script may have also removed other legitimate certificates used by different platforms.
  • HP has pulled the problematic update and is assisting impacted customers.
  • Devices that were impacted require a manual recovery process to be able to rejoin the domain, involving steps such as running a cleanup script created by Rudy Ooms and rejoining the device to Entra ID.

Statistics:

  • 9.3% chance that certificates contain the "1E" chain in the Subject field (Patch My PC)
  • The update was deployed to HP AI PCs via HP's AWS IoT infrastructure (Rudy Ooms)
  • Devices that were impacted require running a cleanup script created by Rudy Ooms and rejoining the device to Entra ID (Rudy Ooms)

Sources:

  • Rudy Ooms, "HP AI PC update deletes Microsoft certificates, leaves devices disconnected from Entra ID"
  • Patch My PC
  • HP statement to BleepingComputer