KB5034957 : New script to fix KB5034441/KB5034440

Topic

New Reply

https://support.microsoft.com/en-us/topic/kb5034957-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2024-20666-0190331b-1ca3-42d8-8a55-7fc406910c10

Microsoft has developed a sample PowerShell script that can help you automate updating the Windows Recovery Environment (WinRE) on deployed devices to address the security vulnerabilities in CVE-2024-20666.

The sample PowerShell script was developed by the Microsoft product team to help automate the updating of WinRE images on supported Windows 10 and Windows 11 devices. Run the script with Administrator credentials in PowerShell on the affected devices. There are two scripts available—which script you should use depends on the version of Windows you are running. Please use the appropriate version for your environment.

PatchWinREScript_2004plus.ps1 (Recommended)
This script is for Windows 10, version 2004 and later versions, including Windows 11.

PatchWinREScript_General.ps1
This script is for Windows 10, version 1909 and earlier versions, but executes on all versions of Windows 10 and Windows 11…

5 users thanked author for this post.

gsandruck3, jburk07, Fred, NaNoNyMouse, Tex265

Reply | Quote

Replies

@Alex5723 Thanks for the heads up.

@SB Susan Bradley, have you tested this? Opinion? Does this replace KB5034441?

Also, since this change involves WinRE, would this change (if it works) affect existing Backup Program Rescue Disks such as Macrium Reflect?

Windows 10 Pro x64 v22H2 and Windows 7 Pro SP1 x64 (RIP)

Reply | Quote

PowerShell and Windows home users should not be used in the same sentence.

You breaka my machine via windows update, you fixa my machine via windows update.

I still stand by my opinion that this update is NOT needed for home users.  Aunt Mildred will hit any physical attacker over the head with a baseball bat first before he has a chance of attacker her nonexistent bitlocker protected pc.

Susan Bradley Patch Lady/Prudent patcher

4 users thanked author for this post.

WSBirdLady, Chester Peake, jburk07, Alex5723

Reply | Quote

Alex5723 wrote:

Run the script with Administrator credentials in PowerShell

What a crock of ordure! How many users know how to do this, or even where to get such a script? It should be fixed in the patch and delivered to Windows per the usual update method.

cheers, Paul

9 users thanked author for this post.

samak, DKThompson, opti1, DrBonzo, CADesertRat, Alex5723, jburk07, Fred, NaNoNyMouse

Reply | Quote

Paul T wrote:

Alex5723 wrote:

Run the script with Administrator credentials in PowerShell

What a crock of ordure! How many users know how to do this, or even where to get such a script? It should be fixed in the patch and delivered to Windows per the usual update method.

cheers, Paul

So very right you are !
How to tell the lords of microsoft this?

* _ ... _ *

Reply | Quote

This is not a new topic!

The availability of this script was mentioned by @Intrepid back on Jan 11 in post# 2623212 and the Jan 23 thread KB5034441 – I ran MS’s script also covers it.

Just FYI, I can personally vouch for the fact that it does work “if you follow all the instructions at the MS link“.

And while it doesn’t actually “replace” KB5034441 (i.e. it’ll keep showing up as a required update unless you hide it), it does update WinRE to the new version without needing to change anything about the current size of your Recovery Partition.

1 user thanked author for this post.

jburk07

Reply | Quote

n0ads wrote:

The availability of this script was mentioned by @Intrepid back on Jan 11 in post# 2623212 and the Jan 23 thread KB5034441 – I ran MS’s script also covers it.

These are new updated scripts. For example : replaces “BootMenuUx.dll ” with “winload.efi” and some more changes.

1 user thanked author for this post.

jburk07

Reply | Quote

Yeah, I don’t see “Aunt Mildred” running that script.

As Paul T said, fix should be a patch pushed out to users.

 

 

Reply | Quote

For anyone who cares, I have downloaded and reformatted this script, and the previous version. It is a pain to download it in the first place, and the formatting is non-existent, making it very hard to see what it does, or what the difference are between the two versions. Once formatted, it is at least possible to see what it does (even if I don’t fully understand it.)

Attached is a diff file.

I can upload a formatted version of the actual patch if anyone wants it.

Edited to add that I have applied the first version of the patch to one system with no ill-effects.

Reply | Quote

eh I think I’ll follow Susan’s recent advice from here and skip this script altogether and hide/block the KB5034440/KB5034441 updates until Microsoft stops offering these problematic updates

Microsoft released a new script for the KB5034441/KB5034440 issues. My take? Skip it. I still recommend hiding the offending update and not installing it on consumer Windows machines.

Reply | Quote

This one actually worked like a champ for me.

https://www.yourwindowsguide.com/2024/02/fix-error-0x80070643-for-windows-10-kb5034441-update.html

 

1 user thanked author for this post.

MikeAL8

Reply | Quote