How do SafeOS updates work?

Question

How do SafeOS updates work?

Macaulay Skinner 20

I am getting really confused with SafeOS updates from Microsoft. As part of the latest Yellowkey update, Microsoft released the latest cumulative update and was meant to fix the issue. I checked some machines and noticed they were still vulnerable but noticed that their WinRE version wasnt the same as the OS version. I then found out about SafeOS patches which seem to come down through windows updates sometimes, but not if you are using autopatch in Intune. My understanding is that safeOS patches deploy winre and winpe updates. How are these deployed and how can they be tracked?

0 comments

Answer accepted by question author

VPHAN 35,770 Independent Advisor

Hello

WinRE is essentially a standalone, highly compressed operating system stored as a file named winre.wim within a hidden partition. Because it is serviced independently from the main OS via SafeOS Dynamic Updates, its build version will inherently differ from the primary Windows build displayed in your management portal. In modern Intune Autopatch environments, Microsoft deploys these SafeOS payloads concurrently with standard monthly Quality Updates, attempting to patch both environments in the same servicing window.

The primary reason your devices remain vulnerable despite receiving recent cumulative updates is a physical space limitation on the hidden recovery partition. To successfully apply a SafeOS update, the Windows update engine must extract the winre.wim file, inject the new security binaries, and repackage it. If the partition lacks the requisite free space to handle this extraction, the WinRE update will fail, often generating a 0x80070643 error in local update logs, while the main OS update successfully installs and deceptively reports as fully compliant in Intune.

Tracking and verifying these updates requires inspecting the offline image directly using Microsoft's official script methodology. This involves running the reagentc /info command to locate the active recovery partition, then using the Deployment Image Servicing and Management tool to mount the winre.wim file to a temporary local folder. Mounting temporarily unpacks the offline file system so you can check the exact build version of Windows\System32\winpeshl.exe, which is the core executable responsible for launching the recovery interface. If this file version is outdated, the official remediation is to deploy Microsoft's supported partition extension script to shrink your primary OS drive slightly and expand the recovery partition, ensuring the SafeOS patch can successfully extract and install during the next update cycle.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Macaulay Skinner 20 Reputation points

2026-06-16T11:08:05.63+00:00

Thank you, that's really helpful. Are those updates under a separate KB number when released or the same? What I am trying to work out is how I track if these are applied or not over the year.
VPHAN 35,770 Reputation points Independent Advisor

2026-06-16T13:37:44.42+00:00

SafeOS Dynamic Updates do indeed possess their own distinct Knowledge Base numbers, operating completely independently from the standard monthly Cumulative Update identifiers. While your primary operating system receives its standard monthly quality patch under one KB, the corresponding Windows Recovery Environment update is published under a unique, isolated identifier, such as the widely documented KB5034441. This strict separation exists because the recovery environment is structurally an independent, miniature operating system requiring its own dedicated servicing stack update and binary payload. When your devices process updates via Intune Autopatch, the Windows Update service evaluates the machine and pulls down these distinct SafeOS KBs concurrently in the background, provided the hidden recovery partition meets the physical space prerequisites.

Tracking the successful application of these specific isolated KBs over the course of a year requires shifting away from standard reporting methodologies. Because the patching literally occurs inside the offline winre.wim file, standard live-system query commands like Get-HotFix or default Intune patch compliance dashboards will not accurately reflect the true SafeOS state. To track this reliably at an enterprise scale, administrators leverage Intune Proactive Remediations or custom compliance policies. You must deploy a PowerShell script that programmatically mounts the recovery image and temporarily loads its offline registry hive to read the specific Update Build Revision value located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Routing the output of this offline registry query back into your Intune compliance reports or an Azure Log Analytics workspace creates a definitive, verifiable audit trail of exactly which machines have successfully absorbed the separate SafeOS patches throughout the year.

VPHAN

1 additional answer

Your answer

Macaulay Skinner 20 Reputation points

2026-06-16T11:08:05.63+00:00

Thank you, that's really helpful. Are those updates under a separate KB number when released or the same? What I am trying to work out is how I track if these are applied or not over the year.
VPHAN 35,770 Reputation points Independent Advisor

2026-06-16T13:37:44.42+00:00

SafeOS Dynamic Updates do indeed possess their own distinct Knowledge Base numbers, operating completely independently from the standard monthly Cumulative Update identifiers. While your primary operating system receives its standard monthly quality patch under one KB, the corresponding Windows Recovery Environment update is published under a unique, isolated identifier, such as the widely documented KB5034441. This strict separation exists because the recovery environment is structurally an independent, miniature operating system requiring its own dedicated servicing stack update and binary payload. When your devices process updates via Intune Autopatch, the Windows Update service evaluates the machine and pulls down these distinct SafeOS KBs concurrently in the background, provided the hidden recovery partition meets the physical space prerequisites.

Tracking the successful application of these specific isolated KBs over the course of a year requires shifting away from standard reporting methodologies. Because the patching literally occurs inside the offline winre.wim file, standard live-system query commands like Get-HotFix or default Intune patch compliance dashboards will not accurately reflect the true SafeOS state. To track this reliably at an enterprise scale, administrators leverage Intune Proactive Remediations or custom compliance policies. You must deploy a PowerShell script that programmatically mounts the recovery image and temporarily loads its offline registry hive to read the specific Update Build Revision value located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Routing the output of this offline registry query back into your Intune compliance reports or an Azure Log Analytics workspace creates a definitive, verifiable audit trail of exactly which machines have successfully absorbed the separate SafeOS patches throughout the year.

VPHAN

Answer 1

Safe OS / WinRE servicing has three key pieces:

How WinRE is serviced

WinRE is not updated by the regular OS cumulative update alone.
WinRE is serviced by:
- The servicing stack update (SSU) that is part of a cumulative update, and
- A Safe OS Dynamic Update package.
Applying the SSU and then the Safe OS Dynamic Update is the supported way to ensure WinRE is updated.
Because of this, the WinRE binaries and version can differ from the main OS build; what matters is that the correct Safe OS Dynamic Update has been applied.

What Safe OS Dynamic Updates do

Safe OS Dynamic Updates make improvements to the Windows recovery environment (WinRE) and the “Safe OS” used during recovery/upgrade.
For Windows 10 and Windows 11, Microsoft publishes Safe OS Dynamic Updates (for example, KB5069340, KB5072542, KB5073933) that specifically state they update WinRE.
These updates are used to fix WinRE issues (for example, WinRE not starting after a previous Safe OS update) and to deliver changes such as Secure Boot certificate updates.

How Safe OS / WinRE updates are deployed and tracked

Deployment paths

Windows Update
- Safe OS Dynamic Updates are available via Windows Update and are downloaded and installed automatically on supported devices.
- For example, KB5069340 and KB5072542 state that they are available through Windows Update and install automatically.
Microsoft Update Catalog / manual deployment
- The same Safe OS Dynamic Updates are also published as standalone packages in the Microsoft Update Catalog.
- For WinRE specifically, Microsoft documents a manual path: download the Safe OS Dynamic Update package and then manually add it to WinRE using the documented “Add an update package to Windows RE” process.
- This is the supported method when managing images or when automatic delivery does not apply (for example, offline media or controlled servicing scenarios).
Installation media / upgrade scenarios
- During setup or media-based deployment, Dynamic Update can pull Safe OS packages to update WinRE in the media. This is covered under the guidance to update Windows installation media with Dynamic Update.

Because the context provided does not describe Intune Autopatch behavior, only the general servicing model can be stated: if a device does not receive the Safe OS Dynamic Update through its configured update channel, WinRE will not be fully serviced even if the OS cumulative update is present.

Tracking WinRE / Safe OS state

Checking WinRE version

Microsoft provides a PowerShell script GetWinReVersion.ps1 in multiple Safe OS KBs (for Windows 10 and Windows 11) to determine the installed WinRE version.
The script:
- Uses reagentc /info to find the WinRE location.
- Mounts winre.wim to a temporary directory (for example, C:\mnt) using DISM.
- Reads the version information from Windows\System32\winpeshl.exe inside the mounted image.
- Outputs the WinRE version and then unmounts and cleans up the mount directory.
Running this script with administrative privileges on target machines allows tracking which WinRE version is installed and verifying whether a given Safe OS Dynamic Update has been applied.

Tracking Safe OS Dynamic Updates themselves

Safe OS Dynamic Updates are published as KBs (for example, KB5069340, KB5072542, KB5073933) and can be tracked like other updates:
- Via Windows Update history on the device.
- Via update management tools that report installed KBs.
For manual servicing of WinRE (for example, on images or when using the Update Catalog), the process documented under Add an update package to Windows RE is used to apply and thus track which Safe OS package has been injected.

Checkpoint cumulative updates and WinRE

Checkpoint cumulative updates do not change the WinRE servicing model.
WinRE still requires:
- The servicing stack update from a cumulative update, and
- The Safe OS Dynamic Update.
Applying both is the only way to ensure WinRE is serviced; checkpoint cumulative updates do not replace the need for Safe OS Dynamic Updates.

In practice, to ensure machines are not left vulnerable due to outdated WinRE:

Confirm that the relevant Safe OS Dynamic Update KBs for the OS version have been deployed (via Windows Update or manually from the Update Catalog).
Use the GetWinReVersion.ps1 script to verify WinRE version on representative devices.
For custom images or controlled environments, follow the documented process to add Safe OS update packages directly to WinRE.

References:

Share via

How do SafeOS updates work?

1 additional answer

Your answer