As of Drive Encryption 7.2.9.5, an issue is seen where the UEFI bootcode is upgraded on every service start. The upgrade occurs even if the bootcode did not require an upgrade. The issue is documented in the known Issues article under reference MDE-5028. The solution was delivered in 7.2.9 Hotfix 2 and later. The defect by itself, does not cause the issue pertaining to this KB, but increases the chance of it occurring.
When a Windows Update is applied that requires multiple reboots, a race condition might occur between the DE service that performs a bootcode upgrade and the system shutting down. In this scenario, because the service control manager is unavailable, a DE bootcode upgrade might be rendered unbootable.
On an affected system that is booting, preboot authentication (PBA) appears. After authentication, instead of loading the original Microsoft bootloader, MDE tries to load another copy of itself. But, on systems with SecureBoot enabled, a black screen occurs. On systems with SecureBoot disabled, you might see that PBA appears to ask for authentication again.
