Preventing Shift-Restart into recovery mode?

[DJ-1701]

Well my test failed. Reset this PC option still accessible. Though I would be interested in your result.

 

For test 2 I will be investigating adding a command line task squence to disable it.

[Garacesh]

My test failed.. PC imaged correctly, but the mouse and keyboard don't work for some bizarre reason, so I can't test

Maybe it's because I've been adding drivers and didn't regenerate the boot image?

[Boredguy]

Removing partition makes no difference since Windows 10 does not use a recovery partition (so you can update your MDT Task to have the primary partition use all the space)

 

Trying BCDEdit again with some different syntax but not expecting much. It seems MS want it available =(

[AXE]

Have you tried:

bcdedit /deletevalue {default} recoverysequence

 

Removing partition makes no difference since Windows 10 does not use a recovery partition (so you can update your MDT Task to have the primary partition use all the space)

 

Trying BCDEdit again with some different syntax but not expecting much. It seems MS want it available =(

[Patrick]

I don't have Windows 10 handy, but i'm aware of an issue that systemreset can be run and wipe machines, not sure if thats the same file being executed when Shift + restart, but systemreset.exe in C:\Windows\System32, so maybe block users from running that file using group policy? Easy fix to implement so worth a try. Edited January 14, 2016 by Patrick

[Boredguy]

Systemreset.exe permissions have already been set to stop anyone, no effect... although going to try renaming it and expect a negative response.

bcdedit /deletevalue {default} recoverysequence, no effect.

[DJ-1701]

Have you tried:

bcdedit /deletevalue {default} recoverysequence

 

Unfortunately this made no difference.

 

I don't have Windows 10 handy, but i'm aware of an issue that systemreset can be run and wipe machines, not sure if thats the same file being executed when Shift + restart, but systemreset.exe in C:\Windows\System32, so maybe block users from running that file using group policy? Easy fix to implement so worth a try.

 

Already tried that as well, and the SystemResetPlatform folder, no luck.

 

Thanks for the suggestions though both.

[DJ-1701]

The following appears to remove the rebuild commands from the Shift Restart environment.

 

Create folder \\DeploymentServer\DeploymentShare$\Scripts\Custom

 

Create file \\DeploymentServer\DeploymentShare$\Scripts\Custom\AssignDrive.txt

select volume 1
assign letter = L

 

Create file \\DeploymentServer\DeploymentShare$\Scripts\Custom\RemoveDrive.txt

select volume 1
remove letter = L

 

Create file \\DeploymentServer\DeploymentShare$\Scripts\Custom\DisableRefresh.cmd

diskpart.exe /s "%SCRIPTROOT%\Custom\AssignDrive.txt"
L:
attrib -S -H L:\Recovery
ren Recovery xRecovery
attrib +S +H L:\xRecovery
C:
diskpart.exe /s "%SCRIPTROOT%\Custom\RemoveDrive.txt"

 

In Task Squence

Go to Custom Tasks

Add -> General -> Run Command Line

Name: Disable Recovery Environment

Command line: "%SCRIPTROOT%\Custom\DisableRefresh.cmd"

[Garacesh]

How the bloomin' 'eck did you figure that out?

I'm faffing about with drivers right now (it turns out my keyboard/mouse not working was a problem with adding different types of drivers.. So now I need to figure out how to do that without causing this conflict.. ) but I'll put that in my next deployment sequence and give it a bash.

[DJ-1701]

How the bloomin' 'eck did you figure that out?

 

Well it was a little like the infinite monkey theorem, but unfortunately without the infinate monkeys and more like a technician with a hammer.

 

I'm faffing about with drivers right now (it turns out my keyboard/mouse not working was a problem with adding different types of drivers.. So now I need to figure out how to do that without causing this conflict.. ) but I'll put that in my next deployment sequence and give it a bash.

 

Ack, all the best.

[Garacesh]

Bah, I'm getting deployment errors when the image completes now

Tried giving SYSTEM and Administrators full control over the deployment share, still no dice. I've a feeling it's to do with the custom scripts.

[bon_clay]

You can also use "bcdedit /deletevalue {current} recoverysequence" to remove the reset option from the Shift+Restart menu.

{default} does not have the value recoverysequence. If you are dual booting you may need to check bcdedit to see which identifier has a value for recoverysequence.

[DJ-1701]

Bah, I'm getting deployment errors when the image completes now

Tried giving SYSTEM and Administrators full control over the deployment share, still no dice. I've a feeling it's to do with the custom scripts.

 

Strange... @Boredguy if you have a moment could you have a look at the NTFS and Share Permissions for the Deployment Share folder? If not will try and remember to do it when I am back over.

[Boredguy]

Share is everyone full

NTFS is users read & execute and they have special to create files/folders as setup by MDT when it was installed.

 

No permissions have been altered or reconfigured.

[Garacesh]

Strange... @Boredguy if you have a moment could you have a look at the NTFS and Share Permissions for the Deployment Share folder? If not will try and remember to do it when I am back over.

Are.. Are you to really communicating via an edugeek thread? Don't you guys share an office or nothin'?!

 

Share is everyone full

NTFS is users read & execute and they have special to create files/folders as setup by MDT when it was installed.

 

No permissions have been altered or reconfigured.

Hm. Bugger.

 

Gonna give a full update a try, though I can't see why I'd need to, all I did was update the deployment sequence. Though I may end up leaving for BETT before it finishes.

[Boredguy]

Are.. Are you to really communicating via an edugeek thread? Don't you guys share an office or nothin'?!

 

I send him to the local primary school for 2 days a week.... what he does over there I have no idea!!

And we can not shout over the 200 metres from our office and the store room he works out of over there

[Garacesh]

I send him to the local primary school for 2 days a week.... what he does over there I have no idea!!

Just sits on EduGeek, by the look of it

Not that I can talk. But I have my emails on one screen and a remote connection to the WDS server on the other. And I'm also configuring GAFE whilst it's updating. So yeah.

 

If it finishes updating before we leave for BETT, I'll give it another bash. Imaging 10 only takes about 30 mins max (takes about an 75-90 mins to deploy Windows 7, but in all fairness a lot of that is installing updates from WSUS)

 

And we can not shout over the 200 metres from our office and the store room he works out of over there

Clearly you need some beans cans and string.

[Boredguy]

Clearly you need some beans cans and string.

 

I think the buses would break the string as they drive between the 2 sites.

But hopefully your image will be ready before your departure to London.....

[DJ-1701]

Just sits on EduGeek, by the look of it

Actually communicatating between server reboots and tring to get DirectAccess working with VPN connectivity for our older devices.

Also was waiting for two rooms to be free to do some work in.

[Garacesh]

Nada. Still didn't work

 

Operating system deployment did not complete successfully.
Please review the log files to determine the cause of the problem.

During the deployment process, 1 errors and 0 warnings were reported.

Details ...
Litetouch deployment failed, Return Code = -2147467259  0x80004005

 

Same error as before. Maybe something wrong with how I've put the custom task in.

[X-13]

Nada. Still didn't work

 

Operating system deployment did not complete successfully.
Please review the log files to determine the cause of the problem.

During the deployment process, 1 errors and 0 warnings were reported.

Details ...
Litetouch deployment failed, Return Code = -2147467259  0x80004005

 

Same error as before. Maybe something wrong with how I've put the custom task in.

 

Have you tried updating the deployment share and regenerating the boot images?

 

-214 means it can't find something, apparently.

[DJ-1701]

Nada. Still didn't work

 

Operating system deployment did not complete successfully.
Please review the log files to determine the cause of the problem.

During the deployment process, 1 errors and 0 warnings were reported.

Details ...
Litetouch deployment failed, Return Code = -2147467259  0x80004005

 

Same error as before. Maybe something wrong with how I've put the custom task in.

 

Out of interest though, what version of MDT are you running (inc update number)?

[Garacesh]

Have you tried updating the deployment share and regenerating the boot images?

 

-214 means it can't find something, apparently.

Yus. That's why I checked file permissions first, but then did a full update.

 

[ATTACH=CONFIG]34454[/ATTACH]

Out of interest though, what version of MDT are you running (inc update number)?

I have no idea how to check the logs O.o lol.

 

Just realised, derp, there's spaces in my path. Perhaps I just need to quote it. Aaaand off we go again, reimaging.

[DJ-1701]

Yus. That's why I checked file permissions first, but then did a full update.

 

 

I have no idea how to check the logs O.o lol.

 

Just realised, derp, there's spaces in my path. Perhaps I just need to quote it. Aaaand off we go again, reimaging.

 

You can usually find some under the C:\MiniNT folder... btw, which reminds me, if you have a problem with a build sometimes it's worth deleting this folder... I have had some issues in the past when I have changed the build process items in this folder seem to override the task sequence... Great Maker knows why because the drive should be formated as part of the build...

[Ripleys]

Have you tried completely removing the ability to logoff/shutdown/reset/hibernate with GPO and making custom desktop icons to shutdown and/or logoff?