Add an update package to Windows RE

Article
02/03/2023
5 minutes to read

You can apply an update, either an LCU or Safe OS Dynamic Update (DU) to a Windows RE image. The steps to update a Windows RE image are different depending on whether you're updating an offline image, or an image on a running system.

When adding an LCU: Both prior to adding an update, and also after you've added an update, check the WinRE version number to make sure that the update was applied properly.
When adding a DU package: After you've added the package, check the list of packages in the image to ensure the package was successfully added to the image.

Update an offline image

The steps below cover how to add an updated package to an offline Windows RE image.

Mount your Windows image

The Windows RE image (winre.wim) is included inside the Windows image (install.wim) and is eventually copied to the Windows RE tools partition on the destination PC or device. To modify the WinRE image, you have to first mount the Windows image, then mount the Windows RE image. After both images are mounted, you can make your changes, unmount the WinRE image, then unmount the Windows image.

Create a mount directory and mount install.wim:

md C:\mount\windows
Dism /Mount-Wim /WimFile:C:\images\install.wim /index:1 /MountDir:C:\mount\windows

Mount your WinRE image

Mount the Windows RE Image file from your mounted image.

Md c:\mount\winre 
Dism /Mount-Wim /WimFile:C:\mount\windows\Windows\System32\Recovery\winre.wim /index:1 /MountDir:C:\mount\winre

Tip

If winre.wim cannot be seen under the specified directory, use the following command to set the file visible:

attrib -h -a -s C:\mount\windows\Windows\System32\Recovery\winre.wim

Add Update package to WinRE

With your recovery image mounted, you can add the update to fix the issue.

Download the required update package and add it to your recovery image.

Dism /Add-Package /Image:C:\mount\winre /PackagePath:"c:\downloadedupdate\update.msu"

Dism /Add-Package /Image:C:\mount\ /PackagePath:"c:\downloadedupdate\dynamicupdate.cab"

If you added a Dynamic Update package, validate that the package you added is in your image:
```
 Dism /Image:C:\mount\ /Get-Packages
```
Check the list for the update package you just added. The package should include the KB number, and will show the State as Installed if it's been successfully added:
```
Package Identity : Package_for_KB5021041~31bf3856ad364e35~amd64~~22621.815.1.0
State : Installed
Release Type : Update
```
Clean up your recovery image and reset the base of any superseded components:
```
dism /image:C:\mount /cleanup-image /StartComponentCleanup /ResetBase 
```

Unmount your images

Close all applications that might be accessing files from the image, including File Explorer.
Commit the changes and unmount the Windows RE image:
```
Dism /Unmount-Image /MountDir:"C:\mount\winre" /Commit 
```
This process can take a few minutes.
Commit the changes and unmount the Windows image:
```
Dism /Unmount-Image /MountDir:"C:\mount\windows" /Commit 
```
Where C is the drive letter of the drive that contains the image. This process may take several minutes.

The Windows RE image is now updated and part of the larger Windows image.

Apply the update to a running PC

You can apply the fix to the Windows Recovery image on a running PC. The following steps walk you through mounting a Windows Recovery image, applying an update to it, and then saving the changes:

Open a Command Prompt as administrator.
Create a directory where you can mount the recovery image to make changes to it.
```
md c:\mount 
```
Mount your recovery image with REAgentC:
```
ReAgentC.exe /mountre /path c:\mount 
```

With your recovery image mounted, you can download and add the update package to the Windows RE image.

Dism /Add-Package /Image:C:\mount\ /PackagePath:"c:\downloadedupdate\update.msu"

Dism /Add-Package /Image:C:\mount\ /PackagePath:"c:\downloadedupdate\dynamicupdate.cab"

If you added a Dynamic Update package, validate that the package you added is in your image:
```
 Dism /Image:C:\mount\ /Get-Packages
```
Check the list for the update package you just added. The package should include the KB number, and will show the State as Installed if it's been successfully added:
```
Package Identity : Package_for_KB5021041~31bf3856ad364e35~amd64~~22621.815.1.0
State : Installed
Release Type : Update
```
Clean up your recovery image and reset the base of any superseded components:
```
dism /image:C:\mount /cleanup-image /StartComponentCleanup /ResetBase 
```

Unmount the Windows recovery image:

ReAgentC.exe /unmountre /path c:\mount /commit

If the PC's disk is protected by BitLocker or Device Encryption: Use ReagentC to disable and then re-enable Windows RE. This ensures that the updated Windows RE image is turned on and correctly configured for your Windows installation:
```
reagentc /disable
reagentc /enable 
```

The Windows RE image on the running PC is now updated.

Check the WinRE image version

You can check the WinRE image's version number on both online and offline Windows installations. This can be helpful for checking the WinRE version prior to adding an update, and then after applying an update to verify that the update was successfully added.

Note

The WinRE version number will only change after you add an LCU. If you add a DU package, use DISM /get-packages as described in the steps above to ensure that the package has been added to the image.

Validate the Windows RE version in an Online Windows OS

Use ReagentC to find the location of the installed WinRE image by running the following command:
```
reagentc /info
```
This command returns the Windows RE location that resembles the following example:
```
\\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
```
Use DISM to get version information about the winre.wim image located in the path returned by ReagentC in the previous step. Make sure to add the WinRE image name and image index number to the path when you run the command:
```
Dism /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE\winre.wim /index:1
```
Notice the reported version. For example:
```
Version : 10.0.22621
ServicePack Build : 1
ServicePack Level : 0
```
Make sure that the ServicePackBuild is greater than or equal to the UBR for the update that you added. For example, for Windows 11, version 22H2, the November security update would show 819 as the SerivcePack Build, since full version number for that update is 22621.819.
- If the version reported is an earlier version, this indicates the Windows RE image is not up to date.
- If the reported version is the same or a later version, no action is needed.

Validate the Windows RE version in an Offline Windows OS

Mount the Windows image to a local folder, for example C:\mount\windows:

mkdir C:\mount\windows
Dism /Mount-Image /ImageFile:C:\mount\install.wim /Index:1 /MountDir:C:\mount\windows

Use DISM to get version information about the winre.wim image located in the Windows\system32\recovery folder. Make sure to specify the image's index number when you run the command:
```
Dism /Get-ImageInfo /ImageFile:c:\mount\windows\windows\system32\recovery\winre.wim /index:1
```
Notice the reported version. For example:
```
Version : 10.0.22621
ServicePack Build : 1
ServicePack Level : 0
```
Make sure that the ServicePackBuild is greater than or equal to the UBR for the update that you added. For example, for Windows 11, version 22H2, the November security update would show 819 as the SerivcePack Build, since full version number for that update is 22621.819.
- If the reported version is an earlier version, this indicates the Windows RE image is not up to date.
- If the reported version is the same or a later version, no action is needed.