HP has pulled an HP OneAgent software update for Windows 11 that mistakenly deleted Microsoft certificates required for some organizations to log in to Microsoft Entra ID, disconnecting them from their company's cloud environments.
The bug was discovered by Patch My PC's Rudy Ooms, who traced it to a silent, background update deployed by HP to its AI PC devices.
According to Ooms, systems that installed the HP OneAgent version 1.2.50.9581 automatically executed a cleanup package named SP161710. The package included an install.cmd script that was designed to remove any remnants of HP's 1E Performance Assist software.
One of the subroutines in this script would search for and delete any certificate containing the "1E" substring in its subject, issuer, or friendly name. However, a script like this is risky as it could lead to false positives and delete certificates it was not designed to target.
Subroutine removes all certificates whose properties contain "1E"
Source: BleepingComputer
When a device joins Microsoft Entra ID (Azure AD) or Intune, Microsoft issues a "MS-Organization-Access" certificate specific to an organization's tenant. This certificate is stored in the Windows certificate store and is now required to properly authenticate against Entra ID.
For a subset of users, Ooms said their "MS-Organization-Access" certificate had a thumbprint containing the "1E" substring, which caused HP's cleanup script to delete the certificate.
MS-Organization-Access with a Subject containing "1E"
Source: Patch My Pc
... continue reading