Preventing Shift-Restart into recovery mode?

[Boredguy]

Have you tried completely removing the ability to logoff/shutdown/reset/hibernate with GPO and making custom desktop icons to shutdown and/or logoff?

 

This does not remove the reboot option at the logon screen, where shift+reboot brings up the recovery image =(

[Garacesh]

You can also use "bcdedit /deletevalue {current} recoverysequence" to remove the reset option from the Shift+Restart menu.

{default} does not have the value recoverysequence. If you are dual booting you may need to check bcdedit to see which identifier has a value for recoverysequence.

 

This has worked for me!

 

I can still shift-reboot to recovery, but the Reset option is no longer there.

I can still go to the troubleshooting menu, though. So now I need to find a way to get rid of that. But definitely a step in the right direction. Thank you!

 

Edit:

Going to try

bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
bcdedit /set {bootmgr} displaybootmenu no

and see if that gets me anywhere.

 

Further edit: Did not work. Troubleshooting boot menu still accessible.

Edited January 21, 2016 by Garacesh

[Garacesh]

Update:

I was hoping that

bcdedit /set {default} bootmenupolicy legacy
bcdedit /set {bootmgr} displaybootmenu no

would work. Change the boot menu back to the old (F8) style menu, and then disable it. But it has not worked Shift-Reboot still has the troubleshoot option, which now reboots into the legacy F8 menu. Nuts!

 

Still, the legacy menu might be the right way to go, so worth posting.

[DJ-1701]

Update:

I was hoping that

bcdedit /set {default} bootmenupolicy legacy
bcdedit /set {bootmgr} displaybootmenu no

would work. Change the boot menu back to the old (F8) style menu, and then disable it. But it has not worked Shift-Reboot still has the troubleshoot option, which now reboots into the legacy F8 menu. Nuts!

 

Still, the legacy menu might be the right way to go, so worth posting.

 

If it is anything like my long winded workaround, the only thing that they can really do is getting into safe mode using the Shift-Reboot environment, so would need a username and password to login anyway. I was conserned that I saw a recovery mode, but at least in the long winded work around it made it inaccessable. Worth while giving the options a try.

[Garacesh]

Well the current options in my troubleshoot menu are:

 

Safe Mode
Safe mode with Networking
Safe Mode with Command Prompt

Enable Boot Logging
Enable low-resolution video
Debugging Mode
Disable automatic restart on system failure
Disable Driver Signature Enforcement
Disable Early Launch Anti-Malware Driver

Start Windows Normally

I mean, the biggest issue is the full format, so it's good that we got rid of that. Could still be worse. I'd just prefer the entire recovery environment be gone if possible. If it gets to the point we need recovery environments, we just reimage.

[Ripleys]

Found this on /r/sysadmin subreddit this morning. Maybe itll help.

 

Good news, everyone!This turned out to be easier than expected.

Simply run:

reagentc.exe /disable

We get to keep our Advanced Startup options with the recovery function disabled.

This results in the following functionality:

--"Reset this PC" from the settings app = User receives an error message that the system "Could not find the recovery environment."

--Advanced Statup -> Restart now -> Troubleshoot = The option to "Reset this PC" is missing entirely.

Edit:

Added post-command behavior of both reset options.

[Garacesh]

Yeah, that sounds about right for the environment I have already, except Reset this PC isn't even an option. If you shift-reboot into recovery the only option is Continue (i.e. normal boot) or the Troubleshoot menu.

 

All I've done is added a command line "bcdedit /deletevalue {current} recoverysequence" as part of the task sequence.

 

Edit: Nobody but us can get to the Settings app here because of the GPO denying control panel access.

(Well, in theory. I'm the only one here using W10 at the moment)

Edited January 22, 2016 by Garacesh

[themightymrp]

I tried the "bcdedit /deletevalue {current} recoverysequence" command and yes, it has removed the refresh PC options. However, for some bizarre reason when back into the desktop mode, my Start Menu now longer works :-/ At all!?? Will try the reagent option above....

[Garacesh]

Only start menu problem I'm having at the moment is not being able to remove everything from it. The start menu itself still works fine for me.

 

Are you using the default start menu, or Classic Shell?

[themightymrp]

Default start menu. I'm only quickly testing this on a VM thats been installed straight from ISO. Its not on the network or anything yet, just tinkering with this "Refresh PC" scenario. Will try the other thing in just a sec...

[Garacesh]

Oh, you misunderstand. I'm not using Classic Start either, in fact, I'm strictly trying to avoid it if I can. I don't want to introduce more points of failure if I can.

 

How are you deploying the image? Installing "from a CD"? And what version of Windows?

[themightymrp]

Installing from the ISO image at the moment. Enterprise LTSB edition, whatever revision that is (10240??).

 

It could have been just a one off glitch. I literally did the bcdedit after installing Windows and rebooted. Thats it, killed the start menu lol.

[Garacesh]

Are you using a Mandatory profile? Apparently they break the start menu the first time you log in.

[themightymrp]

Ahhhhhh :-) Could be that!

[themightymrp]

Doing this:

 

reagentc.exe /disable

 

Works for me Thanks!

[ErVaDy]

Just wanted to share the solution I'm using. This keeps the menu option 'Advanced options' but when choosing this and letting the computer restart you just return to the 'normal' log on screen.

 

bcdedit /deletevalue {current} recoverysequence

bcdedit /set {bootmgr} bootems off

bcdedit /set {bootmgr} advancedoptions off

bcdedit /set {bootmgr} optionsedit off

bcdedit /set {bootmgr} recoveryenabled off

bcdedit /set {current} bootems off

bcdedit /set {current} advancedoptions off

bcdedit /set {current} optionsedit off

bcdedit /set {current} bootstatuspolicy IgnoreAllFailures

bcdedit /set {current} recoveryenabled off

 

The bcdedit lines I added myself I just copied from the 'safe mode lockdown settings' I use on W7. Maybe they aren't all needed for W10 but it seems to work and I just started testing with W10 today (as we are thinking of 'upgrading' from W7 to W10 next year) so I didn't check if any of the lines can be omitted.

[kennysarmy]

Just wanted to share the solution I'm using. This keeps the menu option 'Advanced options' but when choosing this and letting the computer restart you just return to the 'normal' log on screen.

 

bcdedit /deletevalue {current} recoverysequence

bcdedit /set {bootmgr} bootems off

bcdedit /set {bootmgr} advancedoptions off

bcdedit /set {bootmgr} optionsedit off

bcdedit /set {bootmgr} recoveryenabled off

bcdedit /set {current} bootems off

bcdedit /set {current} advancedoptions off

bcdedit /set {current} optionsedit off

bcdedit /set {current} bootstatuspolicy IgnoreAllFailures

bcdedit /set {current} recoveryenabled off

 

The bcdedit lines I added myself I just copied from the 'safe mode lockdown settings' I use on W7. Maybe they aren't all needed for W10 but it seems to work and I just started testing with W10 today (as we are thinking of 'upgrading' from W7 to W10 next year) so I didn't check if any of the lines can be omitted.

 

Works a treat here...

[Localtechie]

Just wanted to share the solution I'm using. This keeps the menu option 'Advanced options' but when choosing this and letting the computer restart you just return to the 'normal' log on screen.

 

bcdedit /deletevalue {current} recoverysequence

bcdedit /set {bootmgr} bootems off

bcdedit /set {bootmgr} advancedoptions off

bcdedit /set {bootmgr} optionsedit off

bcdedit /set {bootmgr} recoveryenabled off

bcdedit /set {current} bootems off

bcdedit /set {current} advancedoptions off

bcdedit /set {current} optionsedit off

bcdedit /set {current} bootstatuspolicy IgnoreAllFailures

bcdedit /set {current} recoveryenabled off

 

The bcdedit lines I added myself I just copied from the 'safe mode lockdown settings' I use on W7. Maybe they aren't all needed for W10 but it seems to work and I just started testing with W10 today (as we are thinking of 'upgrading' from W7 to W10 next year) so I didn't check if any of the lines can be omitted.

We have about 200+ device out in the wild at the moment anyone got a good way of getting this out there?

 

It works perfectly here though!

[Garacesh]

As long as the machines are domain joined, a startup script should do the trick, since those run with SYSTEM privileges.

[gshaw]

Bumping this back up as it's just saved me a lot of work trying to get the UEFI Advanced Options menu locked down.

 

Does everything except the Boot Devices menu, which MS have helpfully made so it ignores any UEFI \ BIOS settings regarding password protection for network boot

[KK20]

just found out about this. In the old W7 days you needed the local admin logon to do anything "bad" (you could system restore but only if system restore was enabled in the first place). this is not good. Scripting the BCDEDIT as a one off machine startup now...

[gshaw]

just found out about this. In the old W7 days you needed the local admin logon to do anything "bad" (you could system restore but only if system restore was enabled in the first place). this is not good. Scripting the BCDEDIT as a one off machine startup now...

 

Yeah it's one of numerous tweaks I've had to make to 10 to keep everything under control.

 

The big downside is that the Boot Device option will override your BIOS settings so either make sure your PXE services are secured and \ or disable all other devices in the BIOS apart from HDD.

 

Just deployed the bcdedit settings plus reagentc /disable via MDT and it looks to work fine

[Garacesh]

just found out about this. In the old W7 days you needed the local admin logon to do anything "bad" (you could system restore but only if system restore was enabled in the first place). this is not good. Scripting the BCDEDIT as a one off machine startup now...

 

If you boot into the recovery environment you can access the command line and set up the stickykeys trick, so local admin is child's play to get if you have an (easily obtainable) set of instructions.

W7 needed its own bcdedit commands to disable the recovery environment.

[sp123]

This is an old thread, but I have 4 questions. Kindly bear with me as I'm not such a techie:

 

1) Is there a difference between this: Reagentc /disable, and Reagentc.exe /disable?

 

2) Would all the bcdedit command lines above be "knocked out" by simply typing: bcdedit /set {globalsettings} advancedoptions false ?

 

3) I've seen both bcdedit /set {current} recoveryenabled off, and instead of "off", then word "no". Would it matter? Above it says "no".

 

4) Must I enter each bcdedit cmd and press enter after each one?

 

Thanks in advance!!!!!

Edited November 17, 2019 by sp123

[Garacesh]

The exact commands I use are:

 

bcdedit /set {default} recoveryenabled No

(which disables the recovery environment)

 

and

 

bcdedit /set {default} bootstatuspolicy ignoreallfailures

(which stops the computer booting into startup repair when it's improperly shut down)

 

and

 

bcdedit /deletevalue {current} recoverysequence

(which removes the reimage option from the shift-reboot menu)

 

Personally, I set each of these three commands to execute as part of the task sequence, each as a Run command line step.

Edited November 18, 2019 by Garacesh