IMPORTANT Issue to be aware of if you use BitLocker on your OS drive

wingers · Jan 13, 2023

@hsehestedt - thank you so much for your detailed steps, I will give them a try shortly - I did think the error message may relate to the partition size not being large enough - how annoying

I do have another issue though, when running the DISM command DISM /Add-Package for the latest cumulative update I am getting error 0x800f0823 - full error below - if I run the command again, it seems to complete - so not sure if an issue or not?

"Error: 0x800f0823

Package c:\updates\windows10.0-kb5022282-x64_fdb2ea85e921869f0abe1750ac7cee34876a760c.msu may have failed due to pending updates to servicing components in the image. Try the command again.The command completed with errors.
For more information, refer to the log file."

Also for some reason my WIM is growing considerably - initial size is 587mb, after applying just the above CU it grows to 937mb, I then use export command as suggested by SIW2 which gets it down to 663mb.

Strangely my partition shows in disk manager as 694mb so odd I get "REAGENTC.EXE: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption enabled." when trying to run REAGENTC /enable as looks like it should be large enough.

wingers · Jan 13, 2023

@hsehestedt

Just followed your revised instructions - thank you very much for your guide.

N.B. You have missed a " from the end of the line - DISM /Add-Package /Image:"c:\mount" /PackagePath="c:\updates\lcu

My 0x800f0823 error was resolved by the step of applying the SSU first!

My issue is that the WIM increases in size so much, it starts off at 587mb but after applying KB5022282 (Win10 x64) using your steps it grows to 929mb. I then follow SIW2 method of exporting which got it down to 655mb but still get "REAGENTC.EXE: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption enabled." so looks like I need to resize my partition - which is odd as partition shows in disk management as 694mb so appears as it should be large enough, very annoying - hope I don't have same issue on all 250 machines.......

wingers · Jan 13, 2023

This size issue is definitely a problem and means I am probably going to have to resize partition on multiple (250+) computers.

Just tried this with a completely fresh winre.wim extracted from install.wim from a Windows 10 ISO.

Starts off at 414mb, use above method to add-package for KB5022282 (Win10 x64) and it increases to 755mb, use Dism /Export-Image and get it down to about 497mb but still can't then use reagentc /enable as get the "REAGENTC.EXE: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption enabled." error but I am not convinced this is solely to do with the size of partition as explained below:

On a machine where I had no issue with the original steps before they were amended the recovery partition is showing as 500mb

If I run reagentc /disable on that machine and look at size of winre.wim it is 733mb - BUT reagentc /enable works fine - so even though the wim clearly is bigger than the partition it worked

On a machine it doesn't work on and I get above error the partition is again 500mb but the image is only 497mb so should definitely fit.

---------------

Is the problem more to do with simply the fact that you can't do this process on a drive with bitlocker encryption enabled which defeats the whole point of why we are having to update the winre.wim to fix a bitlocker vulnerability surely?

wingers · Jan 13, 2023

UPDATE - followed your "MAKE PARTITION LARGER" section and all now working fine - very odd, because as per last reply the sizes are quite misleading, as in first case a 733mb WIM seems to fit on a 500mb partition, and in second case a 497mb image wouldn't fit on a 500mb partition and I had to resize it!!

This is going to be painful to do on 250+ computers - thinking might just disable recovery environment on all the machines instead !

Bree · Jan 13, 2023

wingers said:
....wouldn't fit on a 500mb partition and I had to resize it!!

I clean installed Win12 22H2 on a laptop a few months ago. Setup created a 633MB recovery partition by default.

hsehestedt · Jan 13, 2023

wingers said:
@hsehestedt

N.B. You have missed a " from the end of the line - DISM /Add-Package /Image:"c:\mount" /PackagePath="c:\updates\lcu

wingers said:
@hsehestedt

Just followed your revised instructions - thank you very much for your guide.

N.B. You have missed a " from the end of the line - DISM /Add-Package /Image:"c:\mount" /PackagePath="c:\updates\lcu

My 0x800f0823 error was resolved by the step of applying the SSU first!

My issue is that the WIM increases in size so much, it starts off at 587mb but after applying KB5022282 (Win10 x64) using your steps it grows to 929mb. I then follow SIW2 method of exporting which got it down to 655mb but still get "REAGENTC.EXE: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption enabled." so looks like I need to resize my partition - which is odd as partition shows in disk management as 694mb so appears as it should be large enough, very annoying - hope I don't have same issue on all 250 machines.......

I'm not understanding. When you say

N.B. You have missed a " from the end of the line - DISM /Add-Package /Image:"c:\mount" /PackagePath="c:\updates\lcu

what is it that I am missing on that line?

Also, thanks to you and @SIW2, I have revised the procedure to add an export operation. That makes the file significantly smaller. I'm not used to doing an export with the SafeOS (WinRE.wim) so I missed this. Thanks again for the feedback.

wingers · Jan 13, 2023

hsehestedt said:
I'm not understanding. When you say

N.B. You have missed a " from the end of the line - DISM /Add-Package /Image:"c:\mount" /PackagePath="c:\updates\lcu

what is it that I am missing on that line?

You are missing the " at the end of the second /Add-Package after \lcu line it should be as below

hsehestedt · Jan 13, 2023

wingers said:
View attachment 49862

You are missing the " at the end of the second /Add-Package after \lcu line it should be as below

View attachment 49863

Thanks for that. I cleaned it up by removing all those double quote marks. Since we don't have any spaces in any of these paths, we don't need them. So, rather than add them on that one line, I removed them all.

Thanks for pointing this out to me!

hsehestedt · Jan 13, 2023

Bree said:
I clean installed Win12 22H2 on a laptop a few months ago. Setup created a 633MB recovery partition by default.

That's exactly the size I have been seeing with new installs. But I'm getting tired of this recovery partition nonsense so I've now revised my installations scripts to create 2 GB partitions with new installs. I have lots of space on Windows partition, so I figure I might as well just make it nice and big and then not have to deal with it later.

wingers · Jan 13, 2023

hsehestedt said:
That's exactly the size I have been seeing with new installs. But I'm getting tired of this recovery partition nonsense so I've now revised my installations scripts to create 2 GB partitions with new installs. I have lots of space on Windows partition, so I figure I might as well just make it nice and big and then not have to deal with it later.

agreed, just amended all my scripts to do the same on all new rollouts. Just the hassle of sorting all the existing machines now, they all have 500mb partitions and the amended winre.wim just won't fit, so I need to either a) find a way to slim down the winre.wim, b) resize the partition on around 250 machines or c) decide to just disable the recovery environment on all machines instead

markslog · Jan 13, 2023

This is what a system looks like with two Recovery Partitions (although this is on Windows 10):

Original

Partition 1
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: Yes
Attrib : 0X8000000000000001
Offset in Bytes: 1048576

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 Windows RE NTFS Partition 499 MB Healthy Hidden

New

Partition 5
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: No
Attrib : 0X8000000000000000
Offset in Bytes: 254986420224

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 Recovery NTFS Partition 1024 MB Healthy Hidden

hsehestedt · Jan 13, 2023

wingers said:
agreed, just amended all my scripts to do the same on all new rollouts. Just the hassle of sorting all the existing machines now, they all have 500mb partitions and the amended winre.wim just won't fit, so I need to either a) find a way to slim down the winre.wim, b) resize the partition on around 250 machines or c) decide to just disable the recovery environment on all machines instead

Yeah, this is a mess. I'm a little surprised that Microsoft has not put out some sort of script to automate all of this. Maybe they have something in the works.

hsehestedt · Jan 13, 2023

markslog said:
This is what a system looks like with two Recovery Partitions (although this is on Windows 10):

Original

Partition 1
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: Yes
Attrib : 0X8000000000000001
Offset in Bytes: 1048576

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 Windows RE NTFS Partition 499 MB Healthy Hidden

New

Partition 5
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: No
Attrib : 0X8000000000000000
Offset in Bytes: 254986420224

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 Recovery NTFS Partition 1024 MB Healthy Hidden

Very interesting. One is marked as required while the other is not.

I'm experimenting with all of this on Hyper-V now as well.

Thanks for taking the time to provide this.

wingers · Jan 13, 2023

Potential solution to size issue?

Add "/compress:recovery" switch to end of the Dism /Export-Image command e.g.

Dism /Export-Image /SourceImageFile:"C:\WINDOWS\System32\Recovery\Winre_big.wim" /SourceIndex:1 /DestinationImageFile:"C:\WINDOWS\System32\Recovery\Winre.wim" /compress:recovery

Winre.wim fresh from ISO was 414Mb, after applying latest updates it grew to 764Mb, running Dism /Export-Image only got it down to 506Mb so was still too big to fit on 500mb recovery partition, using the /compress:recovery switch got it down to 345Mb.

Need to test booting into Recovery Environment to make sure all works okay, but reagentc /enable worked fine and didn't give me any errors, and all looks okay when I use reagentc /info and Dism /Get-ImageInfo ......

At least if this works I can update the winre.wim without having to resize the recovery partition on all my machines :)

hsehestedt · Jan 13, 2023

wingers said:
Potential solution to size issue?

Add "/compress:recovery" switch to end of the Dism /Export-Image command e.g.

Dism /Export-Image /SourceImageFile:"C:\WINDOWS\System32\Recovery\Winre_big.wim" /SourceIndex:1 /DestinationImageFile:"C:\WINDOWS\System32\Recovery\Winre.wim" /compress:recovery

Winre.wim fresh from ISO was 414Mb, after applying latest updates it grew to 764Mb, running Dism /Export-Image only got it down to 506Mb so was still too big to fit on 500mb recovery partition, using the /compress:recovery switch got it down to 345Mb.

Need to test booting into Recovery Environment to make sure all works okay, but reagentc /enable worked fine and didn't give me any errors, and all looks okay when I use reagentc /info and Dism /Get-ImageInfo ......

At least if this works I can update the winre.wim without having to resize the recovery partition on all my machines :)

Wow, that would be nice if it all proves out. Let me know how your testing goes.

BTW, I may be unresponsive for quite a while as I need to address some other things today.

SIW2 · Jan 13, 2023

compress:recovery

can you boot that .esd file ? even with a .wim extension that is .esd compression

wingers · Jan 13, 2023

SIW2 said:
can you boot that .esd file ?

~~now setting up virtual computer to test it~~

EDIT - unfortunately it would appear not......

The application or operating system couldn’t be loaded because a required file is missing or contains errors.
File: \Windows\system32\winload.efi
Error code: 0xc0000225

SIW2 · Jan 13, 2023

unfortunately it would appear not......

thought not.

c) decide to just disable the recovery environment on all machines instead

is that going to be simpler

Bree · Jan 13, 2023

SIW2 said:
can you boot that .esd file ?

wingers said:
~~now setting up virtual computer to test it~~
EDIT - unfortunately it would appear not......

You can use DISM to convert a .esd file to a .wim file, and I believe you can do it the other way round too....

https://www.tenforums.com/tutorials/95308-convert-esd-file-wim-using-dism-windows-10-a.html

wingers · Jan 13, 2023

SIW2 said:
is that going to be simpler

Would definitely be the simpler option - hardly ever use / need recovery environment so wouldn't be a great loss to disable it especially on existing machines. And then on new machines will ensure they have a 2000mb recovery partition rather than 500mb so never have these issues again!