The January Patch Tuesday updates for Windows refresh the expiring certificates for Secure Boot, which protects your computer against bootkit malware.

If a few files stay locked, Safe Mode usually makes cleanup easier because update components aren’t running there. I didn’t need it, but it’s a useful fallback. After the cleanup, Windows behaved ...