Windows Recovery Environment (Windows RE)

Windows Recovery Environment (WinRE) is a recovery environment that can repair common causes of unbootable operating systems. WinRE is based on Windows Preinstallation Environment (Windows PE), and can be customized with additional drivers, languages, Windows PE Optional Components, and other troubleshooting and diagnostic tools. By default, WinRE is preloaded into the Windows 10 and Windows 11 for desktop editions (Home, Pro, Enterprise, and Education) and Windows Server 2016, and later, installations.

What's new with WinRE for Windows 11

• You can now run most tools within WinRE without selecting an administrator account and entering the password. When booted into the Recovery environment, encrypted files won't be accessible unless the user has the key to decrypt the volume.
• We've updated the behavior of Advanced startup (Settings > Update & Security > Recovery > Advanced startup "Restart now") so that Ease of Access features work in the recovery environment. For example, previously, if you turned on the narrator feature prior to launching Advanced startup, it wouldn't turn on upon restart (and couldn't be enabled). Now Advanced startup boots directly into the Windows Recovery Environment where a user can turn on Ease of Access features by using a keyboard shortcut.

Tools

WinRE includes these tools:

• Automatic repair and other troubleshooting tools. For more info, see Windows RE Troubleshooting Features.
• Point-in-time restore: Users can quickly restore their Windows PC to the exact state, in which it was at an earlier point in time, using locally stored restore points. For more info, see Point-in-time restore for Windows. If point-in-time restore isn't available or if you need to go back further than 3 days, you can enable System Restore. System Restore rolls back system files and settings (but not personal files). It's available on both Windows 10 and Windows 11.
• Push-button reset (Windows desktop editions only). Users can repair their own PCs quickly while preserving their data and important customizations, without having to back up data in advance. For more info, see Push-button reset overview.
• System image recovery (Windows Server editions only). This tool restores the entire hard drive. For more info, see Recover the Operating System or Full Server.

In addition, you can create your own custom recovery solution by using the Windows Imaging API, or by using the Deployment Image Servicing and Management (DISM) API.

Entry points into WinRE

Your users can access WinRE features through the Advanced startup menu, which can be launched from Windows in a few different ways:

• From the login screen, click Shutdown, then hold down the Shift key while selecting Restart.
• Click Start > Settings > Update & security > Recovery > under Advanced Startup, click Restart now.
• Boot to recovery media.
• Use a hardware recovery button (or button combination) configured by the original equipment manufacturer (OEM).

After any of these actions is performed, all user sessions are signed off and the Advanced startup menu is displayed. If your users select a WinRE feature from this menu, the PC restarts into WinRE and the selected feature is launched.

WinRE starts automatically after detecting the following issues:

• Two consecutive failed attempts to start Windows.
• Two consecutive unexpected shutdowns that occur within two minutes of boot completion.
• Two consecutive system reboots within two minutes of boot completion.
• A Secure Boot error (except for issues related to Bootmgr.efi).
• A BitLocker error on touch-only devices.

Advanced startup menu

Users can perform these actions from the menu:

• Start recovery, troubleshooting, and diagnostic tools.
• Boot from a device (UEFI only).
• Access the Firmware menu (UEFI only).
• Choose which operating system to boot, if multiple operating systems are installed on the PC.

Note

You can add one custom tool to the Advanced startup menu. Otherwise, these menus can't be further customized. For more info, see Add a Custom Tool to the Windows RE Advanced startup Menu.

Security considerations

When working with WinRE, be aware of these security considerations:

• You can run most tools within WinRE without selecting an administrator account and entering the password. When booted into the recovery environment, encrypted files won't be accessible unless the user has the key to decrypt the volume.

• WinRE doesn’t maintain general-purpose network connectivity by default. Networking is on only when a recovery workflow requires connectivity (for example, quick machine recovery, cloud rebuild).
• When networking is required, WinRE can use available network connection options such as Ethernet, Wi‑Fi profiles preconfigured for WinRE, manually selected Wi‑Fi networks, and on supported versions of Windows, eligible Wi‑Fi profiles saved in the Windows OS (see more information below).

Networking in WinRE

Windows Recovery Environment can use networking for recovery scenarios that require connectivity. Relevant scenarios include quick machine recovery, cloud rebuild, remote remediation, or other recovery workflows that need access to Microsoft services or organizational management infrastructure.

By default, WinRE doesn’t maintain a general-purpose network connection. Networking is on only when a recovery workflow requires it or when a user manually connects to a network from WinRE. When networking is required, WinRE attempts to connect to network in the following order:

1. Ethernet connection: If Ethernet is connected, WinRE uses Ethernet.
2. Pre-configured Wi-Fi credentials: If a Wi-Fi network's SSID and password is pre-configured for WinRE, WinRE automatically connects to it if it's in range. Pre-configure Wi-Fi credentials using the Recovery CSP. Alternatively, use the command line.
3. Reusing saved Wi-Fi profiles from Windows OS (Preview): Unless you turn it off, WinRE syncs Wi-Fi profiles from the Windows OS and attempts connection to those profiles. See Reusing saved Wi‑Fi profiles from Windows OS.
4. Manual Wi-Fi selection: If needed, the user can select a Wi-Fi network during recovery by using the manual connection user interface (UI).

Reusing saved Wi-Fi profiles from Windows OS (Preview)

On supported versions of Windows (initially in Windows Insider Preview builds only), WinRE can reuse saved Wi‑Fi profiles from the main Windows OS to help the device regain connectivity during recovery. This includes supported certificate-based Wi‑Fi profiles, when the required profile and credential material are available and usable from WinRE. This behavior improves recovery success for scenarios where the device needs internet or organizational network access before the user can return to the full Windows environment.

For managed devices, network-connected recovery flows such as quick machine recovery is off by default. You must turn it on before the flow can initiate network connectivity from WinRE. For unmanaged devices, quick machine recovery is on by default.

Configure networking in WinRE

Use the ReuseWifiSavedOnDevice node within the Recovery CSP to control whether WinRE reuses saved Wi‑Fi profiles from the Windows OS.

The option to reuse saved Wi-Fi profiles from the Windows OS is on by default on both managed and unmanaged systems.

CSP node setting	WinRE behavior	Outcome
ReuseWifiSavedOnDevice = On  (default)	WinRE can reuse eligible Wi‑Fi profiles saved in the Windows OS when a recovery workflow requires network connectivity.	WinRE accesses Windows OS Wi‑Fi profile and secrets only when there's a network connectivity trigger. Triggers include quick machine recovery and future network connected recovery features.
ReuseWifiSavedOnDevice = Off	WinRE doesn’t access saved Windows OS Wi‑Fi profiles and secrets, even when a recovery workflow requires network connectivity.	Recovery workflows can still use Ethernet, pre-configured WinRE Wi‑Fi profiles, or manual Wi‑Fi connection from the WinRE UI, if available.

Note

If you turn off ReuseWifiSavedOnDevice node, network-connected recovery workflows might need manual user intervention. This especially applies to devices that aren’t connected to Ethernet and don’t have a Wi-Fi profile for WinRE pre-configured.

Use your MDM provider to configure the ReuseWifiSavedOnDevice node. By default, this setting is on.

Limitations and considerations

• WinRE can only connect to networks that are available and supported in the recovery environment. These include:
  • Unauthenticated Ethernet
  • WPA-Personal networks (SSID/password)
  • Certain WPA-Enterprise networks that use machine certificates (EAP-TLS, PEAP, EAP-TTLS, TEAP)
  • Wi-Fi profiles that use certificates with software KSP-backed private keys

    Note

    Wi-Fi profiles that use certificates with TPM-backed private keys aren't supported at this time.

• Some Wi‑Fi hardware, drivers, certificate providers, or enterprise authentication configurations might require components that aren’t present in WinRE.
• Firmware-level or hardware-level radio disablement can prevent WinRE from using Wi‑Fi.
• If the ReuseWifiSavedOnDevice node is disabled, WinRE doesn’t use saved Windows OS Wi‑Fi profiles. Ensure that another recovery networking path is available. Alternatives include Ethernet, a preconfigured WinRE Wi‑Fi profile, or manual user connection.

Test automatic networking in WinRE

You can validate automatic network connectivity in WinRE before using it in recovery workflows.

Before testing:

1. Configure a supported Wi-Fi profile in Windows to connect automatically.
2. If your device is connected to Ethernet, disconnect the Ethernet connection before testing automatic Wi-Fi connectivity in WinRE.

Use one of the following methods:

Start cloud rebuild from WinRE (Recommended)

Note

This option is only available to devices enrolled in the Windows Insiders Program in the Experimental channel as of July 6, 2026.

Cloud rebuild provides the simplest way to verify that WinRE can automatically connect to a network.

1. On a Windows device, select Start > Settings > System > Recovery.
2. Under Advanced startup, select Restart now to boot into WinRE.
3. Select Troubleshoot > Cloud rebuild.
4. Confirm whether WinRE connects to a network automatically.
   • If the device auto-connects to the network, the following screen appears: "Your PC will be installed with the following configuration." This screen includes the target build information.
   • If the device doesn't connect automatically, the manual Wi-Fi connection experience is displayed. If you don't see this experience, WinRE is likely missing Wi-Fi drivers. Use OEM-provided recovery media to re-image your system with all the networking drivers needed in WinRE.

You don't need to complete the cloud rebuild workflow to validate automatic network connectivity. Starting the workflow is sufficient.

Use quick machine recovery test mode

Quick machine recovery includes a test mode that simulates the auto remediation process without requiring an actual boot failure.

Note

Quick machine recovery test mode is available to devices enrolled in the Windows Insider Program's Experimental channel.

1. Enable and run quick machine recovery test mode. Follow these instructions.
2. Allow the device to restart into WinRE.
3. Observe the recovery experience: If the manual Wi-Fi connection experience appears, automatic network connection failed. Otherwise, automatic network connection likely succeeded.
4. Confirm success: After the device boots back into Windows, open Settings > Windows Update > Update history. Within the Quality updates section, look for a "Quick machine recovery update". If shown, the automatic network connection succeeded; if not, it failed. File feedback via Recovery & Uninstall > Quick machine recovery in Feedback Hub.

Customizing WinRE

You can customize WinRE by adding packages (Windows PE Optional Components), languages, drivers, and custom diagnostic or troubleshooting tools. The base WinRE image includes these Windows PE Optional Components:

• Microsoft-Windows-Foundation-Package
• WinPE-EnhancedStorage
• WinPE-Rejuv
• WinPE-Scripting
• WinPE-SecureStartup
• WinPE-Setup
• WinPE-SRT
• WinPE-WDS-Tools
• WinPE-WMI
• WinPE-StorageWMI-Package (added to the base image in Windows 8.1 and Windows Server 2012 R2)
• WinPE-HTA (added to the base image in Windows 10)

Note

The number of packages, languages, and drivers is limited by the amount of memory available on the PC. For performance reasons, minimize the number of languages, drivers, and tools that you add to the image.

Hard drive partitions

When you install Windows by using Windows Setup, WinRE is configured like this:

1. During Windows Setup, Windows prepares the hard drive partitions to support WinRE.

2. Windows initially places the WinRE image file (winre.wim) in the Windows partition, in the \Windows\System32\Recovery folder.

   Before delivering the PC to your customer, you can modify or replace the WinRE image file to include additional languages, drivers, or packages.

3. During the specialize configuration pass, the WinRE image file is copied into the recovery tools partition, so that the device can boot to the recovery tools even if there's a problem with the Windows partition.

When you deploy Windows by applying images, you must manually configure the hard drive partitions. When WinRE is installed on a hard drive, the partition must be formatted as NTFS.

Add the baseline WinRE tools image (winre.wim) to a separate partition from the Windows and data partitions. This way, users can use WinRE even if the Windows partition is encrypted with Windows BitLocker Drive Encryption. It also prevents your users from accidentally modifying or removing the WinRE tools.

Store the recovery tools in a dedicated partition, directly after the Windows partition. This way, if future updates require a larger recovery partition, Windows will be able to handle it more efficiently by adjusting the Windows and recovery partition sizes, rather than having to create a new recovery partition size while the old one remains in place.

To learn more, see Configure UEFI/GPT-Based Hard Drive Partitions or Configure BIOS/MBR-Based Hard Drive Partitions.

Memory requirements

In order to boot Windows RE directly from memory (also known as RAM disk boot), a contiguous portion of physical memory (RAM) which can hold the entire Windows RE image (winre.wim) must be available. To optimize memory use, manufacturers should ensure that their firmware reserves memory locations either at the beginning or at the end of the physical memory address space.

Updating the on-disk Windows Recovery Environment

The on-disk copy of Windows RE can be serviced as part of rollup updates for the OS. Not all rollup updates will service Windows RE.

Unlike the normal OS update process, updates for Windows RE don't directly service the on-disk Windows RE image (winre.wim). Instead, a newer version of the Windows RE image replaces the existing one, with the following contents being injected or migrated into the new image:

• Boot critical and input device drivers from the full OS environment are added to the new Windows RE image.
• Windows RE customizations under \Sources\Recovery of the mounted winre.wim are migrated to the new image.

The following contents from the existing Windows RE image are not migrated to the new image:

• Drivers which are in the existing Windows RE image but not in the full OS environment
• Windows PE optional components which are not part of the default Windows RE image
• Language packs for Windows PE and optional components

The Windows RE update process makes every effort to reuse the existing Windows RE partition without any modification. However, in some rare situations where the new Windows RE image (along with the migrated/injected contents) does not fit in the existing Windows RE partition, the update process will behave as follows:

• If the existing Windows RE partition is located immediately after the Windows partition, the Windows partition will be shrunk and space will be added to the Windows RE partition. The new Windows RE image will be installed onto the expanded Windows RE partition.
• If the existing Windows RE partition is not located immediately after the Windows partition, the Windows partition will be shrunk and a new Windows RE partition will be created. The new Windows RE image will be installed onto this new Windows RE partition. The existing Windows RE partition will be orphaned.
• If the existing Windows RE partition cannot be reused and the Windows partition cannot successfully be shrunk, the new Windows RE image will be installed onto the Windows partition. The existing Windows RE partition will be orphaned.

Important

To ensure that your customizations continue to work after Windows RE has been updated, they must not depend on functionalities provided by Windows PE optional components which are not in the default Windows RE image (e.g. WinPE-NetFX). To facilitate development of Windows RE customizations, the WinPE-HTA optional component has been added to the default Windows RE image in Windows 10.

Note

The new Windows RE image deployed as part of the rollup update contains language resources only for the system default language, even if the existing Windows RE image contains resources for multiple languages. On most PCs, the system default language is the language selected at the time of OOBE.

Known Issue

If the GPO "Windows Settings/Security Settings/Local Policies/Security Options/Accounts: Block Microsoft accounts" is set to enable the policy "User can’t add or log with Microsoft account", attempting to restore the System in WinRE will fail with the error message "You need to sign in as an administrator to continue, but there aren't any administrator accounts on this PC."

This is a known issue and the workaround is to either avoid setting the "Accounts: Block Microsoft accounts" to "User can't add or log with Microsoft Account" or set the MDM policy Security/RecoveryEnvironmentAuthentication to 2.

See also

Content type	References
Deployment	Customize Windows RE | Deploy Windows RE
Operations	REAgentC Command-Line Options
Troubleshooting	Windows RE Troubleshooting Features
Add-on tools	Add a Custom Tool to the Windows RE Advanced startup Menu | Add a Hardware Recovery Button to Start Windows RE | Push-Button Reset Overview