Does the WinRE script Microsoft provided work on GPT systems?

Question

I found the WinRE bitlocker bypass script at

https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589

I seems to work fine on systems that utilize MBR.

I am having issues on systems that use GPT completing properly.

Instead of GPT/MBR, it may be EFI and BIOS.

The system will not re-enable WinRE due to the partition being encrypted by bitlocker. See below for before and after script runs information.

Is there something I can do to enable WinRE after running the Microsoft provide script (and supplying the proper "Safe OS Dynamic Update")

Before running the script:

DISKPART> detail part

Partition 4
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: Yes
Attrib : 0X8000000000000001
Offset in Bytes: 511559335936

Volume ### Ltr Label Fs Type Size Status Info

---

* Volume 4 NTFS Partition 524 MB Healthy Hidden

DISKPART> exit

Leaving DiskPart...

C:\WINDOWS\system32>reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

Windows RE status:         Enabled  
Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE  
Boot Configuration Data (BCD) identifier: a077847b-0483-11e9-ad22-86d3f7b9cffe  
Recovery image location:  
Recovery image index:      0  
Custom image location:  
Custom image index:        0  

REAGENTC.EXE: Operation Successful.

After running the script:

06/04/2024 13:48:24 - Re-enable WinRE
REAGENTC.EXE: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption enabled.

Windows Recovery Environment (Windows RE) and system reset configuration
Information:

Windows RE status:         Disabled  
Windows RE location:  
Boot Configuration Data (BCD) identifier: 00000000-0000-0000-0000-000000000000  
Recovery image location:  
Recovery image index:      0  
Custom image location:  
Custom image index:        0  

REAGENTC.EXE: Operation Successful.

The operation completed successfully.
06/04/2024 13:48:25 - Delete mount directory

---

Any information and help is appreciated.

Chris

Answer 1

Hi Chris,

Any update?

Answer 2

Here you go. As suspected, the existing WinRE partition doesn't have free space. That's why ReagentC tried to move Winre to the OS partition which is BitLocker protected.

2024-06-04 13:48:24, Warning                      [ReAgentc.exe] MeetPartitionRequirements Not enough free space req = 538904163 avail = 533209088 offset = 511559335936 
[ReAgentc.exe] Existing WinRE partition does not have enough free space to meet the requirements

-------------------------------------------

(a) Required free space		: 538904163
(b) WinRE WIM size		: 484378211
(c) avail			: 533209088
-------------------------------------------
WinRE basic requirement (a - b) : 54525952 (i.e., 52   MB)
Difference		(a - c)	:  5695075 (i.e., 5.44 MB)
-------------------------------------------

Per this Microsoft article. https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-biosmbr-based-hard-drive-partitions?view=windows-11

The Windows Recovery Environment (Windows RE) tools require additional free space: A minimum of 52 MB is required but 250 MB is recommended, to accomodate future updates, especially with custom partition layouts.

So, I think extending the Recovery partition by 5.44 MB (at least) should resolve the issue. By the way, it's not because the disk is GPT. I have recently seen this issue on an MBR system as well.

Answer 3

Ok. From sys2, please share the following log on OneDrive:

c:\windows\logs\ReAgent\ReAgent.log

Also, please run:

• dir c:\recovery\windowsre /a

Share the output.

Answer 4

I'll look into expanding the partition, but from what I'm seeing there should be enough room. I thought the script that Microsoft provided was supposed to take care of everything that needed to happen.

The script did work fine on systems that had a Type ID of '07' or '27'. It's the systems that have a type of 'Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac' that won't re-enable after the script finishes.

I'm attaching 4 screen shots. Two are of a system that completed and was able to re-enable WinRE (labeled sys1...) and two that completed but would not re-enable (labeled sys2...). The system with 509MB completed normally (sys1), the system with 524 MB is the one mentioned in the original post (sys2).

System that worked and re-enabled is below:

Answer 5

Hi Chris,

The Reagentc command is likely trying to move winre.wim to the OS partition (which is Bitlocker encrypted) because the Recovery partition's size (524 MB) is insufficient.

You may run the resize script to extend the WinRE partition, and then re-enable WinRE.

The script is located here: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-update-to-winre?view=windows-11#extend-the-windows-re-partition

Also:

1. Please post a screenshot of Disk Management (maximized).
2. Post the output of the following command:

• dir c:\windows\system32\recovery /a