KB5034441

[andy_b]

Anyone having fun with KB5034441?

 

The RE partition seemingly isn't large enough - and the resolution seems to be disable RE and then size partition and re-enable. Which isn't easy to do at scale.

 

https://support.microsoft.com/en-au/topic/kb5034441-windows-recovery-environment-update-for-windows-10-version-21h2-and-22h2-january-9-2024-62c04204-aaa5-4fee-a02a-2fdea17075a8

[mavhc]

Do you need a RE partition? Can you just delete it?

[andy_b]

Do you need a RE partition? Can you just delete it?

 

Not really, but don't know how to do this at scale either tbh.

[mavhc]

https://superuser.com/a/1824309 suggests you can script to disable it and then delete it

[andy_b]

Call me crazy, but really don't fancy scripting partition deletes at scale.

 

I'm sure with all the checking and testing, some how it'd go wrong and I'd have a very bad day

[sigma]

Microsoft offer a script to resize the RE partition:

https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589

 

Since KB5034441 isn't even offered in WSUS, it could be presumed safe to ignore?

[psydii]

Microsoft offer a script to resize the RE partition:

https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589

 

Since KB5034441 isn't even offered in WSUS, it could be presumed safe to ignore?

 

Is this not the update that allows the recovery tools to continue to work after Microsoft switch on the previously installed bitlocker-bypass-vulnerabilty fix in a few month time?

 

I seem to recall that MS are working on a better way to get the RE partition updated (but that was from an anon in a forum who claimed to have an open ticket about it), if true, I'd imagine it will either be in WSUS, in a standard monthly update, or there will be an easy automatable way to resize the partitions magically added to Windows.

[sigma]

A longer more detailed post:

 

https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5034441-security-update-fails-with-0x80070643-errors/

[mavhc]

Call me crazy, but really don't fancy scripting partition deletes at scale.

 

I'm sure with all the checking and testing, some how it'd go wrong and I'd have a very bad day

 

Step 0: A script that tells you what it would potentially do

 

Disabling recovery agent is a standard step in the first place for schools, otherwise people use it to reset their computers

[TwistedHelixis]

Doesn't the recovery partition also have something to do with bitlocker?