Garacesh Posted January 8, 2016 Posted January 8, 2016 (edited) Holding Shift and clicking Restart in Windows 10 boots you into a recovery partition of-sorts which, amongst other things has an option to erase everything and take the machine back to base settings (to the point of initialising OOBE). This can be done on our student accounts (which are restricted, eg, no control panel/settings) and there are no credential prompts or any kind of protection once you're in the recovery boot. Been mucking around with bcdedit trying to make it reference itself so if you hold shift it boots into 'recovery' (of which recovery just points to the regular OS) but have had no luck there, even with displaybootmenu no, recoveryenabled No and bootstatuspolicy ignoreallfailures set. Anybody got a better method? Edited January 8, 2016 by Garacesh 2
DJ-1701 Posted January 8, 2016 Posted January 8, 2016 Holding Shift and clicking Restart in Windows 10 boots you into a recovery partition of-sorts which, amongst other things has an option to erase everything and take the machine back to base settings (to the point of initialising OOBE) Been mucking around with bcdedit trying to make it reference itself so if you hold shift it boots into 'recovery' (of which recovery just points to the regular OS) but have had no luck there. Anybody got a better method? Doesn't that require the local admin login before accessing that option?
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 Nada. Tested it as a pupil account and it still worked. And there's no credentials prompt before initiating the full wipe
Boredguy Posted January 8, 2016 Posted January 8, 2016 This is why we don't give students reboot options... unless they are at the logon screen. @DC-1701 is currently trying to kill his W10 client so may not return until much, much, much later.....
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 This is why we don't give students reboot options... unless they are at the logon screen. Sorry kiddo, you can do it from any 'Restart' button. Lock/Logon screen too
Boredguy Posted January 8, 2016 Posted January 8, 2016 lol... as he just found out by clicking the "wipe all" button... Looks like that PC will be rebuilding as we go home
X-13 Posted January 8, 2016 Posted January 8, 2016 Anybody got a better method? Destroy the recovery partition?
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 (edited) Yep, it takes a while I let it run through earlier, to see what the end-result was (which ended up being OOBE) It took about 60-75 minutes.. ish? I stopped counting. But it felt about that long. Edited January 8, 2016 by Garacesh
Boredguy Posted January 8, 2016 Posted January 8, 2016 Bah he cheated and rebooted it when it prompted again. It's back to normal =(
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 (edited) Destroy the recovery partition? There isn't one. Not one we can see, anyway. Which is why Turns out there is. I tried modifying the bootloader so when it pointed at recovery, I changed that record to make it point at the 'normal' C: partition. And that didn't work. So then I tried to modify the recovery entry to be identical to the C: one, and that didn't work either. Looks like removing a computers ability to restart may end up being the way forward.. Hadn't thought of that lol. But it would have to be for the entire PC, not the user Bah he cheated and rebooted it when it prompted again. It's back to normal =( Oh, yeah. You get the option to wipe, and then are asked do you want to just wipe a bit, or wipe a lot. I tried the 'a lot' option because that's what I envision our kids picking for teh lulz Edited January 8, 2016 by Garacesh
X-13 Posted January 8, 2016 Posted January 8, 2016 There isn't one. Not one we can see, anyway. Give this a look, it's for 8/8.1 but it's the same thing. https://social.technet.microsoft.com/Forums/windows/en-US/4f1b84ac-b193-40e3-943a-f45d52e23685/cant-delete-extra-healthy-recovery-partitions-and-healthy-efi-system-partition?forum=w8itproinstall
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 Manually diskpart ≈1000 clients? Do I have to? D: Removing the option to reboot looks much better lol. Plus it'll mean they get updated a lot more.
DJ-1701 Posted January 8, 2016 Posted January 8, 2016 Manually diskpart ≈1000 clients? Do I have to? D: Removing the option to reboot looks much better lol. Plus it'll mean they get updated a lot more. Who said anything about manually? I am sure there must be a way to automate it. Anyway, now that I know of this issue, i'll also be looking for a nice fix. Thanks @Garacesh
Garacesh Posted January 8, 2016 Author Posted January 8, 2016 Anyway, now that I know of this issue, i'll also be looking for a nice fix. Thanks @Garacesh Maybe there's a way to auto-do it.. I'll look into it I s'pose. Plenty of time to get W10 sorted. 1
Garacesh Posted January 13, 2016 Author Posted January 13, 2016 (edited) Any idea how to get rid of restart? I'm looking through the start menu policies now, can't find anything to do with it. Maybe it'll be in power settings.. Edit: Not in Power Management, either. Edit 2: I can remove access to everything via User Configuration, Policies, Administrative Templates, Start Menu and Taskbar, Remove and prevent access to the Shut Down, Restart, Sleep and Hibernate commands GPO but that's a little bit excessive. Edited January 13, 2016 by Garacesh
DJ-1701 Posted January 14, 2016 Posted January 14, 2016 Any idea how to get rid of restart? I'm looking through the start menu policies now, can't find anything to do with it. Maybe it'll be in power settings.. Edit: Not in Power Management, either. Edit 2: I can remove access to everything via User Configuration, Policies, Administrative Templates, Start Menu and Taskbar, Remove and prevent access to the Shut Down, Restart, Sleep and Hibernate commands GPO but that's a little bit excessive. I wouldn't say it's too bad, at least they could still use soft off by pressing the power button at the screen to turn off. Would be nice to remove just the one option though I agree.
Garacesh Posted January 14, 2016 Author Posted January 14, 2016 Yes but without the option to shutdown, they can't install updates. Plus it's a user policy so I suspect restart would still be available from the logon screen?
DJ-1701 Posted January 14, 2016 Posted January 14, 2016 (edited) Yes but without the option to shutdown, they can't install updates. Plus it's a user policy so I suspect restart would still be available from the logon screen? Sorry mis-read, thought you were talking about the logon screen (which I believe you can strip out). I am sure @Boredguy removed it from the users accounts. I'll have a look and get back to you. Edit: Drat, no, I am wrong, bah, sorry . Edited January 14, 2016 by DJ-1701
Garacesh Posted January 14, 2016 Author Posted January 14, 2016 Worth a try, let me know, thanks But as I say, it can be done from anywhere there's the option to reboot*, so you don't even need to be logged in to do it. * So far I've found the login screen, the start menu power option, and the CTRL+ALT+DEL screen (After logging in)
Ephelyon Posted January 14, 2016 Posted January 14, 2016 Can you not remove the recovery partition from the WIM file? Then, when you build your next image, you remove the recovery partition in advance from the golden master beforehand. 1
DJ-1701 Posted January 14, 2016 Posted January 14, 2016 Worth a try, let me know, thanks But as I say, it can be done from anywhere there's the option to reboot*, so you don't even need to be logged in to do it. * So far I've found the login screen, the start menu power option, and the CTRL+ALT+DEL screen (After logging in) Just found the entry @Boredguy made to get log off to be the default option on the power button for user logon. With the other GPO you found at least in the user session they will be able to log off... but ofcourse still have the logon screen issue. Administrative Templates\Start Menu and Taskbar Change Start Menu power button: Enabled Choose one of the following actions: Log off
DJ-1701 Posted January 14, 2016 Posted January 14, 2016 (edited) Can you not remove the recovery partition from the WIM file? Then, when you build your next image, you remove the recovery partition in advance from the golden master beforehand. Had the same thought so was going to look at this as well. Great minds... Edit: Test 1 - In MDT, Removing Task Squence: Add Windows Recovery (WinRE) Edited January 14, 2016 by DJ-1701
Garacesh Posted January 14, 2016 Author Posted January 14, 2016 (edited) Test 1 - In MDT, Removing Task Squence: Add Windows Recovery (WinRE) Hm. You know, I hadn't thought of that.. Worth a bash! Disabled the step, updating share, let's see how it goes Edit: And imaging begins. Edited January 14, 2016 by Garacesh
Boredguy Posted January 14, 2016 Posted January 14, 2016 Hm. You know, I hadn't thought of that.. Worth a bash! Disabled the step, updating share, let's see how it goes It's nice watching the MDT install bars when someone else is doing all the work *whistle*
DJ-1701 Posted January 14, 2016 Posted January 14, 2016 It's nice watching the MDT install bars when someone else is doing all the work *whistle* I would say you could take over if you want , but at the moment, it's just a waiting game.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now