|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
ISSUE 21.04 • 2024-01-22 PATCH WATCH By Susan Bradley What’s with this Windows recovery partition thing? If you’ve been following along, you know we’v
[See the full post at: KB5034441 has led us astray, in a horrible way]
Susan Bradley Patch Lady/Prudent patcher
In my experience, each ‘install’ puts a new Recovery Volume in place, which supercedes existing ones leaving them isolated and of no use. [That is, that can be deleted without issue].
Having looked at what went on a year ago, I now only install new or updated versions booted from USB and use the option that allows me to clear all the partitions so that the install starts with a blank drive.
I’ve just tested Win10 and Win11 ‘blank installs’ this morning on my new mini PC and found that Win10 22H2 creates a 530MB Recovery Volume and Win11 23H2 creates a 775GB Recovery Volume. In each case, the WINRE.WIM is different size.
Microsoft assume you want to fill the Disk, so they allocate the Recovery Volume at the end, and fill the rest with the C: Volume. After install, I immediately shrink the C: Volume and ‘move’ the Recovery Volume ‘to the left’ with a third party partition manager to allow growth in the future.
Resizing a partition should be relatively easy.
Not when recovery partition is preceding C partition.
What do I do if reagentc /info returns “Disabled” for Win RE ??
That’s actually perfectly normal behavior.
No. WindowsRE must be enabled in order to run Settings > Windows Update > Advanced options > Recovery > Advanced startup > Restart now (or click Start, hold the Shift key down and select Restart). By default, WindowsRE should be enabled.
@MartyHs screenshot shows Windows RE location as blank. Marty does not have a functioning Windows Recovery Environment. Safe Boot won’t do anything for that condition. For more information visit WinRE.
The partition is disabled unless you have invoked troubleshooting options like Safe Mode. You should test the functions of the WinRE partition from time to time. Just boot into Windows Safe Mode. That will prove whether or not you have a functional WinRE partition and Recovery WIM.
Safe Mode doesn’t use WinRE.
Toward that end, wouldn’t the solution be to run the “reagentc /enable” command to re-enable the Recovery Environment or are there other steps to perform first before re-enabling the Recovery Environment in MartyHs’s case?
The /enable switch won’t work because the location of the partition is unknown. It should look something like this:
Windows Recovery Environment (Windows RE) and system reset configuration
Information:
Windows RE status: Enabled
Windows RE location: \\?\GLOBALROOT\device\harddisk5\partition5\Recovery\WindowsRE
Boot Configuration Data (BCD) identifier: 215ceeaa-7c2d-11ee-ade0-cfc79b94deb9
Recovery image location:
Recovery image index: 0
Custom image location:
Custom image index: 0
REAGENTC.EXE: Operation Successful.
The important pieces of information are:
Windows RE location: \\?\GLOBALROOT\device\harddisk5\partition5\Recovery\WindowsRE
Boot Configuration Data (BCD) identifier: 215ceeaa-7c2d-11ee-ade0-cfc79b94deb9
This can be a bit confusing, as the location as noted by Reagentc does not necessarily jibe with the actual physical location of the partition. It can, but often doesn’t.
As you can see, the Recovery Environment partition is actually harddisk5\partition1. Nevertheless, everything works as it should. To find the location of WindowsRE open an elevated Command Prompt and then DISKPART (type diskpart and hit Enter). Then type “list vol” (without the quotes) and hit Enter. The volumes are partitions for all drives. In the resulting display, if there is a WindowsRE partition, it will have no drive letter and in the Info column it will be Hidden. Diskpart will likely also have it in a different location. For me, it’s Volume 19.
Three different Windows tools, three different ways of looking at the same thing. And yet, it works.
For more information, see WinRE.
What is the difference between a volume and a partition?
In DISKPART, the “list vol” command displays a list of basic and dynamic volumes on all disks, e.g. partitions. To list partitions, one must first select a particular disk.
The volumes and partitions are for all intents and purposes the same thing, but DISKPART enumerates them from different sources, and provides different properties in its display of each.
When I did the ‘list vol’ and the ‘list partition’ commands, the order of the items was not the same in both.
Which tells me you have only one disk. If you had more than one disk, the “list partition” command would have given you, “There is no disk selected to list partitions.
Select a disk and try again.” Followed by a listing of all switches and their functions. Having only one disk, it is, by default, selected.
The ‘list partition’ order matches the Disk Management map, where the ESP is 1st, a small reserved partition is 2nd, the OS (C:) is 3rd, and WinRE is 4th.
I’m not absolutely certain, but I believe that the partition order for a selected disk (if you have only one disk, it is the default disk selection) is enumerated by Disk Management. In all my systems, that is the order. The volume order, on the other hand, may come from the registry. For example, I have 7 SSD’s and 20 volumes. Volumes 1, 2, 3 and 4 are on disk 0, but not in that order. The partition order for disk 0 is volume 4, 1, 2, 3. Similarly, on disk 5 are volumes 15, 16, 17, 18 and 19, but the partition order is 19, 15, 16, 17, and 18. It may have something to do with volume 4 and volume 19 are System partitions, and that’s why they are listed last on the disk in volume order. The other volumes actually line up with Disk Management. List partition doesn’t display much, but list volume displays a lot more information.
DISKPART is a very old part of Windows. I don’t think it has been changed much since GPT was introduced. It’s difficult to find any definitive information on its intricacies, but it remains a powerful tool.
So far Dell Windows 10 systems I’ve checked don’t have an issue with KB5034441. Windows 10 systems loaded off an official Microsoft ISOs only have a recovery partition in the 500-522MB range and fail. Those I’ve blocked with wushowhide.
My Windows 11 laptop with Bitlocker enabled was loaded from the Microsoft 21H1 ISO. It installed the January update without error. It’s recovery partition was about 1GB.
I agree with Alex5723… KB5034441 should have been pulled.
I have two systems that didn’t have WINRE partitions. They both failed with the vague Windows Update error message. I base my recovery on Macrium Reflect images, so I’d deleted the WINRE partitions.
I ‘fixed’ the EFI/GPT system by restoring the WINRE partition from the Macrium image I took prior to deleting it and the successfully ran WU; the BIOS/MBR system I had didn’t have an Image, so I allocated a 1GB one but the WU still failed on that one so I hid the update.
When I entered in reagentc /info I get this:
Hi Susan,
Thanks for the info.
I do have a question though: If I understand correctly from your posts and from information on the internet this update only applies to Windows 10 (21H2 and 22H2), not to Windows 11. Is that correct?
If so, maybe the defcon should be different for Windows 10 and Windows 11? I mainly use Windows 11, so that is a valuable distinction for me 😊Thanks,
Frank
KB5034441 is a separate security update for Windows 10. It’s included in the January 2024 cumulative update for Windows 11. If the recovery partition is too small then the entire cumulative update will fail.
Yes, apparently. (2024-01 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5034123) failure, tried multiple suggestions..)
No mention of recovery partition there, only component store corruption (which was resolved).
This may help you with the question of why you have two recovery partitions:
https://forum.macrium.com/64481/Warning-Windows-11-22H2-update-ADDS-a-second-recovery-partition
Physical attacks against consumer PCs are highly unlikely, whether BitLocker is enabled or not.
I don’t understand why you choose to ignore the fact that millions of laptops are stolen each year (thousands each day), and that 57% of identity theft starts with a stolen laptop.
Is theft of a consumer laptop less likely than theft of a business laptop?
Yes.
Am I wrong to assume that because I’m using Windows 10 Home 22H2 and don’t have BitLocker that this update will not affect my PC?
Yes.
Why is Ronald L Vanover wrong to assume that? Haven’t I read that it will fail, but will not no effect.
What about Susan’s statement in the Newsletter?
Don’t worry if you can’t stop the update before it attempts to install. It will do no damage. It will merely attempt to install and fail.
Why is Ronald L Vanover wrong to assume that? Haven’t I read that it will fail, but
will notno effect.
No bad effect. But unless blocked it will attempt to install. So the update will affect his PC.
What about Susan’s statement in the Newsletter?
Don’t worry if you can’t stop the update before it attempts to install. It will do no damage. It will merely attempt to install and fail.
It’s not failing on every Windows 10 computer. Susan also said, “If that space is available, and even if your machine does not have BitLocker enabled, the update should install without error.”
My Recommend Options:
Option 1. Wait. Microsoft said they will fix the issue – probably next month.
Option 2. Apply the Microsoft Patch that fixes the vulnerability (this is NOT resizing the partition): https://support.microsoft.com/en-us/topic/kb5034957-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2024-20666-0190331b-1ca3-42d8-8a55-7fc406910c10
Option 3. If you have Bitlocker on your laptop or other mobile device, you should have your Bitlocker setup so that you must type in a PIN before it will boot. This is the best and safest way to use Bitlocker. This vulnerability does not apply if you are setup with a Pre-Boot PIN. In other words, it will prevent this exploit.
If TPM+PIN BitLocker protectors are being used, can the vulnerability be exploited if the attacker does not know the TPM PIN?
No. To exploit the vulnerability the attacker needs to know the TPM PIN if the user is protected by the BitLocker TPM+PIN. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20666
Here is how to add a Pre-boot PIN: https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/
Critical: You must keep a copy of your Recovery Key. This is mandatory!! if you don’t, you risk losing everything on your drive permanently. https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d
Remember; when you copy a file with the same name as an existing file, what actually happens is that it copies the new one and only deletes the old one if the copy works. The new WIM is over 400MB and therefore needs over that in free space for the copy to be viable.
Note that BitLocker is unrelated to this update really; this update is a WINRE WIM update CAUSED by known BitLocker issues in the code.
Thank you Susan for all that you do! And you are blessed to have the patience to deal with all of this AND be able to clearly describe what Microsoft mucks up all too often. You describe things in paragraphs. Microsoft describes the same thing in PAGES with links to loads of other bloated pages.
Add this to the list of other ‘WTF was microsoft thinking?’
How are they as big as they are? Any other company that pulls stunts like they do would have folded long ago. I’m NOT taking issue with them wanting to make $$. But maybe focus on making quality products, not just doing mindless changes, complications, and changes that break so much else.
First, a big thank you to Susan for posting this very helpful discussion which nicely lays out the nature of why this patch fails and the options for dealing with KB5034441. I am capable of reducing the size C:/ primary partition and deleting the Winre partition / recreating a new larger Winre partition to install this patch. My issue is that I do not need this patch on my home desktop which has never had bitlocker enabled and never will as it is near end of life and will be replaced sometime next year. Why should I take the uncompensated risk of resizing/deleting partitions just because MS decided to push this patch? My Winre partion is 538mb and will not have sufficient available space for the update to install. Even though I can address the issue, I will hide this update after it fails out because altering the partions on a fully patched, perfectly functioning system forces me to underwrite an uncompensated risk because MS was arrogant enough to push a patch that they had to know would cause widespread installation fails on W10 systems. At this point, they should pull KB5034441 and make it available as an optional download for systems that truly have a need. I just cannot fathom the things that come out of Redmond sometimes.
Windows Update and wushowhide both use the Windows Update Service to scan for updates. If you Pause Windows Update so that it doesn’t scan for updates, you have also blocked wushowhide from scanning for updates.
InControl only controls Feature (21H2 -> 22H2) and Version (Win10 -> Win11) updates. It does NOT control or block monthly Cumulative Security updates.
Windows Update, wushowhide, and Windows Update Mini Tool ALL use the Windows Update Service to scan for updates. If you use Pause to block updates, it disables the Windows Update Service. Then none of the other tools you have will work either.
Use only Windows Update Mini Tool to control your updates, choosing the updates you want and hiding the ones you don’t. Do not use Pause on top of it because you block it’s control. And, WUMT basically takes over control from Windows Update.
Same problem for me as noted: Windows 10, updates paused, run WUMT, KB5034441 not found because I paused the updates per Susan. If I unpause the updates, they run right away and all of the January updates will be installed. So how can I tell Windows 10 to NOT use the Windows Update Service so WUMT can take over control from Windows Update. I would like to hide KB5034441 in Windows 10 before it tries to install. Step by Step instructions would be very helpful. Thanks!
When you unpause it will show up. Even if it fails to install, no worries just use wushowhide.
Additionally I was able to do it fast enough to hide it as typically the main Windows 10 update is wanting to come down and install first.
Susan Bradley Patch Lady/Prudent patcher
Turn ON Metered Connections.
Resume updates. Some of the smaller updates may download/install in spite of Metered Connections, but it should stop the bigger ones like the CU. You should see an error about this in Windows Update.
Open WUMT. Now WUMT should be able to scan for updates and you can block/hide the ones you don’t want. If you h1de ALL of them it finds, now you have control to unhide only the ones you want when there is DEFCON approval.
After Window Update rescans on it’s own, note that the hidden updates won’t show in the Windows Update queue. Do not use Pause again. Use only WUMT to control updates.
So for Windows 11 is the only option to block the entire cumulative update?
There’s no reason to do so, as there are no known issues with January 2024 updates for Windows 11 versions 22H2/23H2.
That sounds right.
Use WUMT to hide updates you don’t want and download/install the ones you want.
She also said, “While I’ve not seen issues with Windows 11, I have seen issues with Windows 10.”
There should be no confusion. Do NOTHING. If the update fails it’s no big deal. Microsoft will fix it next month. Let it be already. Millions of users will have the same update fail. It will be resolved with a future automatic update.
If you have a laptop with Bitlocker and you’re concerned about the vulnerability and can’t wait 30 days, see my comment here:
https://www.askwoody.com/forums/topic/kb5034441-has-led-us-astray-in-a-horrible-way/#post-2629980
She also said, “While I’ve not seen issues with Windows 11, I have seen issues with Windows 10.”
Yes, but just because she hasn’t seen any issues doesn’t mean there might not be issues. The recovery partition on my Win11 laptop doesn’t have 250 MB free space. I just want to make sure the cumulative update won’t fail. Has anyone with a Win 11 machine with less than 250 MB free space been successful in installing the January cumulative update?
Bill
If you have upgraded to Win11 from Windows 10 your Recovery partition is probably 4GB+
With W11 clean OEM/install it is probably > 500MB
If you have upgraded to Win11 from Windows 10 your Recovery partition is probably 4GB+
With W11 clean OEM/install it is probably > 500MB
Mine is a new Win 11 laptop that has never been updated. I used the instructions Susan gave to determine how much free space the recovery drive has. It shows it has 89 MB of free space out of about 732 MB total.
Bill
Haven’t seen any mention yet of KB5034439: Windows Recovery Environment update for Windows Server 2022: January 9, 2024. This is failing on a four-month old install of Server 2022, both on Hyper-V Host and a Server 2022 guest. In other words, a default install of the latest OS, which created a 523MB recovery partition, will not install KB5034439.
Susan used MiniTool to get the actual free space of the recovery partition. It looks like PowerShell get-volume also works, though I’m just eyeballing based on size; I see no simple way to confirm which is the recovery partition.
If I decide to extend the recovery partition, can I do so using the logical partition or should I use the C: one ?
Shrink the C drive
Ok, here’s the why of there possibly being two recovery partitions.
Older versions of Windows were setup to place the recovery partition before the OS partition on the main drive during initial installation.
Newer versions of Windows are setup to place it after the OS partition on the main drive during initial installation.
Microsoft made this change because they finally realized the recovery partition “might” need to be increased in size at some future date (well, duh) and it’s much easier to do that, without requiring a “fresh install” of Windows, if it’s located after the OS partition.
The issue of having two recovery partitions occurs if you’ve done an “in place” upgrade from an older version of Windows where it was located before the OS partition to a newer version where it needs to be located after the OS partition.
It happens because, in order to “move” the existing recovery partition after the OS, the install would have to reformat the drive but, an “in-place” install is intended to keep all your existing S/W & personal settings and reformatting the drive would erase all that so it can’t be done.
Instead, the install “shrinks” the existing OS partition enough to create a new recovery partition that’s located after the OS partition; leaving the old recovery partition “as is” but no longer marked as an in use recovery partition in the BCD.
A fresh install avoids the whole drama of two different recovery partitions because it does reformat the drive during the installation process but you’ll have to reinstall any 3rd party S/W & recreate your personal settings.
BTW, while it’s possible to reclaim the old recovery partition space for use by another partition on the drive, it’s a complicate process requiring the correct S/W (as mentioned by several posters here on AskWoody) and should not be undertaken without making a “full image backup” of the main drive first since, if done wrong, it can make your OS unbootable!
FYI
According to the following articles, Windows Setup only started in Windows 10 version 2004 to use Microsoft’s own recommended partition layout on a clean install by placing the Windows Recovery Environment (WinRE) partition immediately after the Windows partition.
1) Ghacks – Microsoft appears to have fixed the Recovery Partition hell in Windows 10
2) WindowsLatest – Windows 10 update addresses a fundamental flaw in Windows Setup
HTH.
I am using Win. 10 22H2 and Bitlocker has never been enabled. If I don’t have sufficient space in my recovery partition, the update will fail – but I don’t need it anyway (see attached snip). If it installs, I can leave well alone. I seem to be missing something: where is the problem?
Further to The Surfing Pensioner’s question, if you use Windows Update on your Win 10 machine and the Windows Recovery Environment (WinRE) update KB5034441 fails while you are installing your Jan 2024 Patch Tuesday updates ***, what harm does it do if you simply pause Windows Update and wait for Microsoft to release a fix for the 0x80070643 – ERROR_INSTALL_FAILURE installation error? Susan Bradley noted in her newsletter article KB5034441 has led us astray, in a horrible way: “Don’t worry if you can’t stop the update before it attempts to install. It will do no damage. It will merely attempt to install and fail” so even if you don’t pause your Windows Updates all you’re doing is wasting bandwidth each time Windows Update downloads and fails to install KB5034441.
If you do pause your Windows Updates and reach the maximum 35 days of pausing before Microsoft releases a fix for the 0x80070643 installation error (in Win 10 Home you can pause updates for 7 days up to five times as instructed in the PCMag article How to Delay Windows Updates and Tell Microsoft to Leave You Alone; for Win 10 Pro you can pause Windows Update up to a maximum of 35 days in your Advanced Settings) then you will be required to run a Windows Update before you can pause again. If this happens and KB5034441 fails again (and wastes some bandwidth doing so) you can start a new 35-day cycle of pausing your updates and can resume your updates any time you wish. Note: If you use Microsoft Defender as your antivirus then your daily virus definitions will continue to update while Windows Update is paused.
If you have a Win 10 Home OS then it might make sense to use one of the blockapatch.com utilities like WUshowhide or WUMgr to hide KB5034441 until a fix for the 0x80070643 installation error is released so you don’t have to fuss with pausing Windows Update every 7 days. If you do use BitLocker encryption then just remember that you will eventually have to unhide and apply this KB5034441 update once Microsoft has fixed the 0x80070643 installation error to ensure you’ve patched the CVE-2024-20666 vulnerability that could allow attackers to bypass your BitLocker encryption using an unpatched WinRE.
*** Note that KB5034441 installed successfully on my Win 10 Pro v22H2 laptop with less than 250 MB of free disk space on my WinRE partition. See my post # 2628138 in Susan Bradley’s 09-Jan-2024 Ready for the new patching year?.
————
Dell Inspiron 5584 * 64-bit Win 10 Pro v22H2 build 19045.3930 * Firefox v121.0.1 * Microsoft Defender v4.18.23110.3-1.1.23110.2 * Malwarebytes Premium v4.6.8.311-1.0.2242 * Macrium Reflect Free v8.0.7783
No kb5034441 re-issue (yet?) alongside the week C Previews..
https://www.catalog.update.microsoft.com/Search.aspx?q=%222024-01%22
Aside from all the shaming Suan rightfully heaped on Microsoft for KB5034441, I’d like to add one more bullet.
Microsoft knew or should have known that a lot of machines would have recovery partitions that could not handle this update.
I have two Windows 11 Pro machines in front of me. One was upgraded from Windows 10 Pro; the other was a fresh install on brand-new hardware about 4 months ago. The Recovery partition on both machines is 625 MB with 536.06 MB used. The upgraded machine was originally a clean install of Windows 10 Pro on a 1 TB SSD, i.e., what’s a few hundred MB among friends, yet the installer set the recovery partition to 625 MB. The same thing happened on the machine with the clean Windows 11 Pro installation.
I’ve installed various versions of Windows hundreds of times and I’ve always let the installer partition a blank disc as it sees fit. I don’t know if other folks tweak the partition sizes when installing Windows, but Microsoft darn well should have known how big a recovery partition to expect on a lot of machines.
Why did you elect to remove this software, may I ask?
Hi MHCLV941:
Dell SupportAssist OS Recovery Tools v5.5.x (a.k.a. Dell SA Remediation) has a reputation for buggy behaviour. The worst I recall is that users who had their personal data stored on a alternate partition or drive (i.e., other than the main C:\ drive) had all their data wiped while updating to Dell SA OS Recovery Tools v5.4.1 – see balji’s 09-May-2021 SupportAssist deleted my partitions while installing OS Recovery for one example.
If you are currently using Dell SA OS Recovery Tools v5.5.7 then I’m guessing you are affected by a long-standing (but relatively harmless) bug where Event Viewer and Reliability Monitor log hundreds of “Successful Application Reconfiguration” events” approx. 30 min after boot-up while Dell A OS Recovery is creating a Dell system repair point in the hidden folder at C:\ProgramData\Dell\SARemediation\SystemRepair\, resulting in high CPU usage. This bug is caused by sloppy programming (see my 01-Jul-2021 post on page 6 of DELLKaren’s “Successful Application Reconfiguration” and SupportAssist and the attached image I captured in Nov 2021) and Dell has acknowledged the problem but doesn’t seem inclined to fix it.
I finally decided to ditch Dell SA OS Recovery in 2021 after my relatively new Inspiron laptop would not boot up and the Dell SA OS Recovery failed to launch and perform an emergency recovery. After spending over an hour on the phone with a Dell support tech trying to launch this Dell software I was able to boot into my Windows Recovery Environment and perform a reset to factory condition (luckily, all my personal data had been backed up to an external backup drive). I now use Macrium Reflect Free v8.0.x (out of support as of Jan 2024) to create emergency recovery media and the occasional full disk image of my hard drive that I save to my external backup drive in case I ever have to perform another emergency recovery.
Apologies to other readers for the somewhat off-topic reply.
————
Dell Inspiron 5584 * 64-bit Win 10 Pro v22H2 build 19045.3930 * Firefox v122.0.0 * Microsoft Defender v4.18.23110.3-1.1.23110.2 * Malwarebytes Premium v4.6.8.311-1.0.2242 * Macrium Reflect Free v8.0.7783 * Dell Update for Windows Universal v5.1.0 * My Dell v2.2.6
Also, please address what happens if the update does install successfully. Would we even notice any difference? Does it help – or hurt – anything?
I’ve installed the Windows 11 cumulative update with no noticeable effects. The WindowsRE portion of the cumulative update simply updates Windows Recovery Environment. For my systems it was an increase in size of ~105MB; for others it was different in size.
I’ve tested WindowsRE and it works just like it did before; no issues, no hiccups. I have Image For Windows incorporated into WindowsRE and it didn’t have any effect on that, either.
That’s fine but what I asked was what noticeable change would I or any of my users notice?
Quite likely, none. If your WindowsRE worked before, it should continue to work with no noticeable changes.
If it didn’t work before, it likely still won’t work.
No AI, just a human making a call. When we approve posts that come from spammy IP addresses we train our akismet spam filter that they are okay. So we’d rather not approve it. The issue is that you are re-using an IP address that has been used by malicious users. VPNs don’t always help those of us that are trying to keep bad guys away.
Susan Bradley Patch Lady/Prudent patcher
OK, enough of this as it’s quite off-topic for this thread.
I think this was supposed to be funny. If not, I agree it was uncalled for.
@bookman –
My sincerest apologies for the last sentence. It wasn’t meant to be condescending or humorous, or as a mini lecture for you. It was meant for others reading this thread to let them know that these last few posts were off topic and that no more posts about any VPN-related issues should be placed here.
I have seen threads get unintentionally “hijacked” by such postings here on AskWoody in the past and did not want this one to start going down the same path due to others (not yourself) posting additional questions related to your individual issue simply because they’d been experiencing the same issue.
Again, my sincerest apologies for the last sentence of my prior post.
Thank you for your response. What you write is helpful because, as you can see from the low number of posts I have made over many years here, I lack the time to fully study the complex protocols of this site. Nonetheless, I do appreciate those who offer their time to share their bountiful experience and laud all the writers for their insights.
Windows 10 Home. HP 12GB RAM 256GB SSD 4year old desktop.
My latest observations with client workstations with update KB5034441:
If you’re confused on what to do, see my post here (most people should do nothing):
https://www.askwoody.com/forums/topic/kb5034441-has-led-us-astray-in-a-horrible-way/#post-2629980
FWIW, I ran the PowerShell script on a test machine (after I figured out how to get it to run). I needed to change the execution policy on the computer first. The WinRE partition size is 530 MB. Prior to running the script, there was 88.5 MB free space, and the WinRE version service pack build was 1. After the update, the partition showed 53.16 MB free space, and the version service pack build is now now 3920. I tried re-running the script, and PowerShell reported that the script had already been run successfully on the machine. It wouldn’t re-run the script. AFAICT, there were no adverse effects, even if the script failed to complete the update. I had a couple of unsuccessful runs prior to it succeeding. I then hid KB5034441 from WU. I’m still holding off from running the update on my main computer.
johnb3030, I was successful in the past by clicking on “Resume Updates”, then immediately clicking on “Pause Updates”. It stopped the update process in its tracks, but reset the clock for pausing, and let me set it to pause for 5 weeks. You might consider trying this to give yourself the extra 5 weeks.
Hello,
so, to add myself to this thread, this
is my current situation. Disk 4 is the boot drive. The dell installation image created, a bit ago, that schema :
Recovery partition of 529mb ( 75mb free only) , then a 100mb fat32 partition, then a 16mb (other) partition, then the boot. Any tool would let me resize the boot , the 100mb and the recovery. but the 16mb (other) is marked as not resizable. I’m quite unsure how I could free 600mb from the boot and move it to the start of the ssd if those 16mb are an immovable and immutable object.
And no, no way I reinstall the system ( that works flawlessly ) for this.
I could maybe install the dell supportassist feature ( I avoided until now ) and let it maybe do its own magic at the start of the drive ( but somehow i guess it would create its partition at the end…. ?)
Having briefly scanned responses, I’ve decided I’d rather juggle rattle snakes than deal with this so I’m going to resume updates, immediately stop them and pause for another month and repeat until Microsoft fixes this.
Thanks, Alex. Confusing. Too much discussion on this one item 🙂
Microsoft quietly changed the status of the known issue with KB5034441 (Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: January 9, 2024) to “Resolved” yesterday on 30-Apr-2024 without actually fixing anything.
The issue titled The January 2024 Windows RE update might fail to install on the Windows Release Health dashboard for my Win 10 v22H2 OS now states that Microsoft has no plans to automatically fix this problem and that users with a Win RE partition who require KB5034441 and see a “0x80070643 – ERROR_INSTALL_FAILURE” during installation should manually increase the size of their Win RE partition. From that updated issue report:
Resolution: Automatic resolution of this issue won’t be available in a future Windows update. Manual steps are necessary to complete the installation of this update on devices which are experiencing this error.
The WinRE partition requires 250 megabytes of free space. Devices which do not have sufficient free space will need to increase the size of the partition via manual action. For guidance on making this change, review the following resources …
Affected platforms:
Client: Windows 11, version 21H2; Windows 10, version 22H2; Windows 10, version 21H2
Server: Windows Server 2022
———
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.4291 * Firefox v125.0.3 * Microsoft Defender v4.18.24030.9-1.1.24030.4 * Malwarebytes Premium v5.1.3.110-1.0.1219 * Macrium Reflect Free v8.0.7783
Today I finally got fed up with kb4034441 failing to install on my Win10 Pro 22H2 desktop every month when I ran Windows Update and used wushowide for the first time. I ran it after I had installed the April updates and it was so blindingly easy to use, I was embarrassed to have hesitated for so long. Just to encourage anybody else who is putting it off: three clicks, less than three minutes, and kb4034441 was ‘fixed’! Simples!
Corporations that feel that an attacker getting control of a laptop and then wanting to take the time to crack bitlocker/secure boot.
It is WAY easier to phish your way into a corporation versus use this threat vector. Thus why I felt from day one that pushing this out widely was a big mistake.
Susan Bradley Patch Lady/Prudent patcher
… What users require the installation of KB5034441??
Hi Kathy Stevens:
The summary for the KB5034441 release notes state that …
“This update automatically applies Safe OS Dynamic Update (KB5034232) to the Windows Recovery Environment (WinRE) on a running PC to address a security vulnerability that could allow attackers to bypass BitLocker encryption by using WinRE. For more information, see CVE-2024-20666…”
… and goes on to say that :
“NOTE If your running PC does not have a WinRE recovery partition, you do not need this update. To verify if you have WinRE enabled, you can run the following command in an elevated command prompt: reagentc /info. If WinRE is enabled you will see Windows RE status in the output with a value of Enabled.”
I might be wrong, but I assume that means that KB5034441 only needs to be installed if BitLocker encryption is enabled AND a WinRE recovery partition is enabled on your computer. Otherwise, it should be safe to use a utility like wushowhide, WUMgr, or one of the other tools mentioned in EP’s post # 2666646 to hide this update.
————
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.4291 * Firefox v125.0.3 * Microsoft Defender v4.18.24030.9-1.1.24030.4 * Malwarebytes Premium v5.1.3.110-1.0.1219 * Macrium Reflect Free v8.0.7783
I don’t believe 509MB is not big enough.
Mod edit to make sense
750mb to 1Gb in my experience 🙂
Q: Does the Recovery Partition need to be located immediately after C: ?
No. The “preferred” location is as last partition.
Correction : Recovery Partition should be after C: partition (usually the largest partition) or any other partition (data partition) that can be shrunk in order to add the free space to the Recovery Partition.
So, I can easily “shrink” E: by 1.0 GB.
That will create UNALLOCATED space to the left of my Recovery Partition.
Then, using Partition Wizard, I can easily ENLARGE that Recovery Partition.
Finally, I can try Windows Update again, to see if that sequence fixes the “problem”.
I’ll try later, and report back here.
THANKS AGAIN!
I shrunk E: by 1.0GB, and enlarged the Recovery Partition by the same amount.
Now, Recovery Partition is ~1,509 MB .
I switched WindowsUpdateBlocker OFF, and tried Windows Update again.
Same error!
So, I switched WindowsUpdateBlocker back ON.
p.s. Our ASUS P5Q Deluxe motherboard is getting old, but it works great as a backup storage server with Intel Q6600 CPU, overclocked to 3.2 GHz.
I would really rather NOT do any more trial-and-error.
Please take no offense / I’m just tired of so many problems with Windows Update.
I honestly do not know how Susan Bradley does not go stark raving mad, keeping on top of the “latest” WU WU FUBAR.
“Disabled”
There’s your problem.
WinRE from my website might be of some use to you if you want to pursue the necessary steps.
Chris Waite’s YT video has this link in the description:
I printed a hard copy of the latter, and watched his video while highlighting the essential commands.
Then I executed the sequence for MBR partitions:
GOOD NEWS: it worked perfectly, and Windows Update KB5034441 also installed AOK.
(Well, I learned something new, and this time my curiosity did not cause another PC cat-astrophe 🙂
GOOD NEWS: it worked perfectly
Microsoft doesn’t explain that the recovery partition should be following a partition that can be resized.
Users where the recovery partition is for example the first partition or following a none-resizable partition will trash their Windows PC.
I have bitlocker disabled, but I resized the recovery partition, which is in the right place, and I have this: …
Windows RE status: Enabled
Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE…It appears not to exist. How is that fixable?
Hi CynicalSnail:
I’m not sure if I understand your comment that your Windows Recovery Environment (WinRE) does not exist. Your reagentc /info command shows your WinRE partition is located in Partition3 (\\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE).
Try running the following commands in an elevated command prompt with Administrator rights to see if they display further details about your WinRE partition. Note to other users: If the reagentc /info command shows your WinRE partition is not in Partition3 the commands below must be modified to reflect your partition number.
fsutil volume diskfree \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE
Dism /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE\winre.wim /index:1
My own WinRE partition is located in Partition4, and output from the Dism command (before and after I installed the January 2024 KB5034441 WinRE update) is shown in my 27-Jan-2024 post # 2631957 in Susan Bradley’s PowerShell script to test partition sizes.
Here’s my output for one of the PowerShell scripts n0ads attached to post # 2634098 in that same topic. I unzipped the .zip file attached to n0ads’ post and chose to run the .ps1 file that displays both the date and time when the WinRE partition was last modified (which, for me, is currently the date/time I installed KB5034441).
Note: If you have problems launching n0ads’ scripts when you double-click the .ps1 file(s) then open a Windows PowerShell console with Administrator rights, copy and paste the entire contents of the .ps1 file into your PowerShell console, and hit Enter to run the script.
————
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.4529 * Firefox v127.0.2 * Microsoft Defender v4.18.24050.7-1.1.24050.5 * Malwarebytes Premium v5.1.6.117-1.0.1270 * Macrium Reflect Free v8.0.7783
Many thanks for the detailed reply.
My concern was that “Recovery image location:” is blank, which suggests to me that there is not one. The zero also looked odd, but non-existent Custom image is not a surprise not having done anything like that.
The 1st command gets:
Total free bytes : 305,832,525,824 (284.8 GB)
Total bytes : 498,909,310,976 (464.6 GB)
Total quota free bytes : 305,832,525,824 (284.8 GB)
Unavailable pool bytes : 0 ( 0.0 KB)
Quota unavailable pool bytes : 0 ( 0.0 KB)
Used bytes : 187,023,790,080 (174.2 GB)
Total Reserved bytes : 6,052,995,072 ( 5.6 GB)
Volume storage reserved bytes : 6,007,111,680 ( 5.6 GB)
Available committed bytes : 0 ( 0.0 KB)
Pool available bytes : 0 ( 0.0 KB)
There is something in there – 174 GB.
The second gets:
Name : Microsoft Windows Recovery Environment (amd64)
Description : Microsoft Windows Recover Environment (amd64)
Size : 3,001,646,561 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.22621
ServicePack Build : 3518
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 5246
Files : 21135
Created : 2022-05-07 – 06:53:32
Modified : 2024-05-28 – 09:16:43
Languages :
en-US (Default)
The operation completed successfully.
The script gave this:
The date and time correspond to the cumulative update KB503771 installation.
Can I assume then that all is well?
If so, thanks for the reassuring guidance.
My concern was that “Recovery image location:” is blank, which suggests to me that there is not one…
Hi CynicalSnail:
… and just FYI, I see the same empty field when I run the reagentc /info command on my Win 10 computer. I wouldn’t be concerned.
————
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.4529 * Firefox v127.0.2 * Microsoft Defender v4.18.24050.7-1.1.24050.5 * Malwarebytes Premium v5.1.6.117-1.0.1270 * Macrium Reflect Free v8.0.7783
I must be missing something very subtle and still very important:
If the core problem is a Recovery Environment partition that is too small, I honestly do not understand why MS cannot code a simple utility with logic like this:
if a RE partition is to the left of C:, abandon it completely, so as to leave the starting address of C: INTACT;
shrink C: by the amount of space required for an adequate RE partition;
if there is no existing RE partition to the right of shrunk C:, create a new one;
if there is an existing RE partition to the right of C: enlarge it after shrinking C:;
if the latter is not possible, abandon the existing RE partition and use the space made available after shrinking C: to create an enlarged RE partition;
when the new partition layout is completed, write all necessary files to the newly enlarged RE partition.
All together, maybe one 40-hour week of a competent systems programmer, allowing for proper Beta testing.
What is all the fuss about KB5034441?
Back on May 2, 2024, in this Topic, Susan Bradley stated, “It is WAY easier to phish your way into a corporation versus use this threat vector. Thus why I felt from day one that pushing this out widely was a big mistake.”
And on the same day Imacri quoted a portion of the KB5034441 release notes that stated, “If your running PC does not have a WinRE recovery partition, you do not need this update.”
We are ignoring the error messages associated with Windows KB5034441 updates and moving on in the update process. So far no problems.
“If your running PC does not have a WinRE recovery partition, you do not need this update.”
If your PC doesn’t use BitLocker encryption you don’t need this update.
SupremeLaW
KB5034441 is only a problem if you allow it to be one.
We operate a fleet of Windows computers and there is the cost/benefit consideration associated with adjusting the partition layouts of each machine to accommodate an update that shortly after its release Susan Bradley indicated was not needed.
Our approach to managing our systems is if it ain’t broke don’t fix it.
And adjusting a system to accommodate KB5034441 runs the risk of breaking a system. If it is not a risk there would be no need to backup a system prior to adjusting its partition layout to accommodate a nonessential update.
This past week, I did a fresh install of that Windows 10 disc
What is recovery partition, if there is one, placement after your clean install ?
Our retail Windows 10 21H2 was installed on a RAID-0 array of 4 x Samsung 840 SSDs, for speed.
After that fresh install, I shrunk C: to 100GB, and formatted the empty space as data partition E:
(Our philosophy is to keep the OS and our various databases entirely separate. That way, if I need to restore a drive image, that restore task should have no effects on those databases.)
That sequence left the RE partition where the fresh Windows install had created it — to the right of E:
When I found that helpful YT video, demonstrating simple steps, I shrunk E: by 1,000 MB using Partition Wizard. [EDIT: was “100 MB” in error]
The latter step resulted in creating a RE partition with 1,509 MB of space (1000 + 509).
At this point I followed that YT video, and after completing those steps Windows Update completed correctly.
I discovered another annoying discrepancy.
If one uses the “Shrink Volume” feature in Windows Disk Management, it designates the newly unused space as “Free Space”. But then, the Chris Waite procedure at YT does NOT work properly i.e. DISKPART command in Command Prompt.
If one uses the “Move/Resize” feature in Partition Wizard, it designates the newly unused space as “UNALLOCATED”. And then the Chris Waite procedure at YT does work properly: the WinRE partition is enlarged and restored correctly.
I hope I’m simply missing something here:
NEVERTHELESS, the Windows DISKPART command in Command Prompt should function identically to the “Shrink Volume” feature in Windows Disk Management.
What I experienced today is a very odd discrepancy between the two “shrink” options.
Bottom Line: Partition Wizard did it correctly; Windows Disk Management did NOT do it correctly.
That is due to an MBR peculiarity called extended container. When the fourth primary partition is created on an MBR disk, it’s an extended container which Windows cannot resize. It’s one of many cases KB5028997 does not cover, but being specific to MBR it’s practically too rare to mention.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
