IMPORTANT Issue to be aware of if you use BitLocker on your OS drive


I am totally confused by this thread - I see statements on internet that imply MS have updated Windows now and it is only an issue for older installations. Then I see others that imply they have not.

Does anybody actually know?
 

My Computer My Computer

At a glance

Windows 11 Pro + Win11 Canary VM.I9 13th gen i9-13900H 2.60 GHZ16 GB solderedIntegrated Intel Iris XE
OS
Windows 11 Pro + Win11 Canary VM.
Computer type
Laptop
Manufacturer/Model
ASUS Zenbook 14
CPU
I9 13th gen i9-13900H 2.60 GHZ
Motherboard
Yep, Laptop has one.
Memory
16 GB soldered
Graphics Card(s)
Integrated Intel Iris XE
Sound Card
Realtek built in
Monitor(s) Displays
laptop OLED screen
Screen Resolution
2880x1800 touchscreen
Hard Drives
1 TB NVME SSD (only weakness is only one slot)
PSU
Internal + 65W thunderbolt USB4 charger
Case
Yep, got one
Cooling
Stella Artois (UK pint cans - 568 ml) - extra cost.
Keyboard
Built in UK keybd
Mouse
Bluetooth , wireless dongled, wired
Internet Speed
900 mbs (ethernet), wifi 6 typical 350-450 mb/s both up and down
Browser
Edge
Antivirus
Defender
Other Info
TPM 2.0, 2xUSB4 thunderbolt, 1xUsb3 (usb a), 1xUsb-c, hdmi out, 3.5 mm audio out/in combo, ASUS backlit trackpad (inc. switchable number pad)

Macrium Reflect Home V8
Office 365 Family (6 users each 1TB onedrive space)
Hyper-V (a vm runs almost as fast as my older laptop)
cereberus said:
I am totally confused by this thread - I see statements on internet that imply MS have updated Windows now and it is only an issue for older installations. Then I see others that imply they have not.

Does anybody actually know?
Click to expand...
In a nutshell the update MS rolls out only updates the files within Windows itself, to update the files on the recovery partition you have to manually follow the procedures as outlined on MS website and on this forum thread.
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
wingers said:
In a nutshell the update MS rolls out only updates the files within Windows itself, to update the files on the recovery partition you have to manually follow the procedures as outlined on MS website and on this forum thread.
Click to expand...
Yeah - I get that but my point is some sites say you do not need to do that as MS have already updated the files on recovery partition. Maybe that is garbage.
 

My Computer My Computer

At a glance

Windows 11 Pro + Win11 Canary VM.I9 13th gen i9-13900H 2.60 GHZ16 GB solderedIntegrated Intel Iris XE
OS
Windows 11 Pro + Win11 Canary VM.
Computer type
Laptop
Manufacturer/Model
ASUS Zenbook 14
CPU
I9 13th gen i9-13900H 2.60 GHZ
Motherboard
Yep, Laptop has one.
Memory
16 GB soldered
Graphics Card(s)
Integrated Intel Iris XE
Sound Card
Realtek built in
Monitor(s) Displays
laptop OLED screen
Screen Resolution
2880x1800 touchscreen
Hard Drives
1 TB NVME SSD (only weakness is only one slot)
PSU
Internal + 65W thunderbolt USB4 charger
Case
Yep, got one
Cooling
Stella Artois (UK pint cans - 568 ml) - extra cost.
Keyboard
Built in UK keybd
Mouse
Bluetooth , wireless dongled, wired
Internet Speed
900 mbs (ethernet), wifi 6 typical 350-450 mb/s both up and down
Browser
Edge
Antivirus
Defender
Other Info
TPM 2.0, 2xUSB4 thunderbolt, 1xUsb3 (usb a), 1xUsb-c, hdmi out, 3.5 mm audio out/in combo, ASUS backlit trackpad (inc. switchable number pad)

Macrium Reflect Home V8
Office 365 Family (6 users each 1TB onedrive space)
Hyper-V (a vm runs almost as fast as my older laptop)
cereberus said:
Yeah - I get that but my point is some sites say you do not need to do that as MS have already updated the files on recovery partition. Maybe that is garbage.
Click to expand...
I haven't seen any sites that say that and the official information on MS site still says you have to update the recovery partition manually. Can't see how they can do it automatically to be honest, especially going on how many different issue I hit when trying to do it manually, they was enough of a problem without MS trying some automated method which is more likely to cause more problems to be honest
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
wingers said:
I haven't seen any sites that say that and the official information on MS site still says you have to update the recovery partition manually. Can't see how they can do it automatically to be honest, especially going on how many different issue I hit when trying to do it manually, they was enough of a problem without MS trying some automated method which is more likely to cause more problems to be honest
Click to expand...
I've got a support call logged with Microsoft to see if they have any suggestions on how to roll a fix out to a couple thousand machines. Given the complexity of the script on this thread and the issues it randomly throws up, I don't expect them to have a magic fix, but I'm asking the question.

Even deploying with Intune or GPO is going to be problematic.
 

My Computer My Computer

At a glance

WIndows 10
OS
WIndows 10
Whatsgoingon said:
I've got a support call logged with Microsoft to see if they have any suggestions on how to roll a fix out to a couple thousand machines. Given the complexity of the script on this thread and the issues it randomly throws up, I don't expect them to have a magic fix, but I'm asking the question.

Even deploying with Intune or GPO is going to be problematic.
Click to expand...
If all of your machines are running the same build of Windows then just follow steps on first machine to create an update winre.wim and then deploy that wim file to the remaining machines, you don't need to follow all the steps on all the machines, that saves a lot of time, that is what I did to roll it out to 350+ machines quite quickly.

Just created updated winre.wim, then with a script connected to each machine using enter-psssession, ran reagentc /disable, copied my updated winre.wim to c:\windows\system32\recovery overwriting existing file and then run reagentc /enable
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
wingers said:
If all of your machines are running the same build of Windows then just follow steps on first machine to create an update winre.wim and then deploy that wim file to the remaining machines, you don't need to follow all the steps on all the machines, that saves a lot of time, that is what I did to roll it out to 350+ machines quite quickly.

Just created updated winre.wim, then with a script connected to each machine using enter-psssession, ran reagentc /disable, copied my updated winre.wim to c:\windows\system32\recovery overwriting existing file and then run reagentc /enable
Click to expand...
Ahh - OK, so yeah that certainly helps, thank you.

I think someone else mentioned this earlier in the thread, but it makes you wonder what stops someone wanting to exploit the vulnerability just overwriting the WIM again with an older version when they have physical access.
 

My Computer My Computer

At a glance

WIndows 10
OS
WIndows 10
Whatsgoingon said:
Ahh - OK, so yeah that certainly helps, thank you.

I think someone else mentioned this earlier in the thread, but it makes you wonder what stops someone wanting to exploit the vulnerability just overwriting the WIM again with an older version when they have physical access.
Click to expand...
No probs

Yes that is a separate issue, but if they have physical access then they have access to your data anyway potentially so the problem is more than just this vulnerability e.g. if they have physical access and workstation left unlocked etc
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
hsehestedt said:
I work extensivly with DISM and have always made it a habit to first install the ADK to be certain that I am running the latest version. Still, I rather doubt that this is the problem, but it's worth a shot.

A couple tips if you decide to do this:

1) When installing the ADK, you get the option to select from a whole bunch of different components to install. The only option that you need to select is the deployment tools.

2) After installing the ADK, one of the installed items will be Windows Kits > Deployment and Imaging Tools Environment. Use that to run DISM. This is basically a modified command prompt with the correct paths to the ADK version of tools such as DISM.
Click to expand...
I continue to get the same error message about path can not be found even when I on a new computer that I just turned BitLocker on just for testing. This is so frustrating. Do you think I could send you my dism.log to see if you can spot something I am missing? Thanks for all your help with this.
 

My Computer My Computer

At a glance

Windows 10
OS
Windows 10
ncisb said:
I continue to get the same error message about path can not be found even when I on a new computer that I just turned BitLocker on just for testing. This is so frustrating. Do you think I could send you my dism.log to see if you can spot something I am missing? Thanks for all your help with this.
Click to expand...
Sure, that would be fine.
 

My Computers My Computers

System One System Two

  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-14650HX32 GBNo GPU - Built-in Intel Graphics
    OS
    Win11 Pro 25H2 (RTM+)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Acemagic
    CPU
    Intel i7-14650HX
    Memory
    32 GB
    Graphics Card(s)
    No GPU - Built-in Intel Graphics
    Sound Card
    Integrated
    Monitor(s) Displays
    Varies as machine will often be moved to locations with different monitors
    Screen Resolution
    Varies
    Hard Drives
    1 x 1TB Gen 4 NVMe SSD
    PSU
    120W Power Brick
    Keyboard
    Corsair K70 Max RGB Magnetic Keyboard
    Mouse
    Logitech MX Master 3
    Internet Speed
    1Gb Up / 1 Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender

  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-1255U16 GBIntel Iris Xe Graphics
    Operating System
    Win11 Pro 25H2 (RTM+)
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo ThinkBook 13x Gen 2
    CPU
    Intel i7-1255U
    Memory
    16 GB
    Graphics card(s)
    Intel Iris Xe Graphics
    Sound Card
    Realtek® ALC3306-CG codec
    Monitor(s) Displays
    13.3-inch IPS Display
    Screen Resolution
    WQXGA (2560 x 1600)
    Hard Drives
    2 TB 4 x 4 NVMe SSD
    PSU
    USB-C / Thunderbolt 4 Power / Charging
    Keyboard
    Backlit, spill resistant keyboard
    Mouse
    Buttonless Glass Precision Touchpad
    Internet Speed
    1Gb Up / 1Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
    Other Info
    WiFi 6e / Bluetooth 5.1 / Facial Recognition / Fingerprint Sensor / ToF (Time of Flight) Human Presence Sensor
Whatsgoingon said:
Ahh - OK, so yeah that certainly helps, thank you.

I think someone else mentioned this earlier in the thread, but it makes you wonder what stops someone wanting to exploit the vulnerability just overwriting the WIM again with an older version when they have physical access.
Click to expand...
Yes, and @wingers comment is not correct, when he writes " if they have physical access then they have access to your data anyway potentially".

The encryption is helping against people with physical access, that's why it's done in the first place. "Potentially accessible" until now meant "it's potentially possible to break the encryption key", but from now on, it means "just give me a machine that is turned on (but locked) or that is startable without preboot authentication and I can defeat Bitlocker (after I have undone the patch) as soon as the undisclosed details how to do it become available".

So while most here worry how to apply the patch, you should just disable WinRE completely to be on the safe side again. No one needs WinRE. All its options are available from a bootable USB-based windows setup as well, so you don't lose a thing doing so.
reagentc.exe /disable
This line, deployed as immediate scheduled task (executor: system) would save your day in the office.
 

My Computer My Computer

At a glance

Win11
OS
Win11
Comport Colin said:
Yes, and @wingers comment is not correct, when he writes " if they have physical access then they have access to your data anyway potentially".

The encryption is helping against people with physical access, that's why it's done in the first place. "Potentially accessible" until now meant "it's potentially possible to break the encryption key", but from now on, it means "just give me a machine that is turned on (but locked) or that is startable without preboot authentication and I can defeat Bitlocker (after I have undone the patch) as soon as the undisclosed details how to do it become available".

So while most here worry how to apply the patch, you should just disable WinRE completely to be on the safe side again. No one needs WinRE. All its options are available from a bootable USB-based windows setup as well, so you don't lose a thing doing so.
reagentc.exe /disable
This line, deployed as immediate scheduled task (executor: system) would save your day in the office.
Click to expand...
You have only quoted part of what I said - I clearly said "...e.g. if they have physical access AND workstation left unlocked etc".
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
I didn't need to quote that, since it is not what we have here. This is no exploit that needs an unlocked ("etc") machine. It is an exploit that still works against Bitlocker in standard config on a machine that is turned off.
 

My Computer My Computer

At a glance

Win11
OS
Win11
Comport Colin said:
I didn't need to quote that, since it is not what we have here. This is no exploit that needs an unlocked ("etc") machine. It is an exploit that still works against Bitlocker in standard config on a machine that is turned off.
Click to expand...
I was answering somebody elses point about the vulnerability, just meaning if unlocked and have access then too easy to replace the patched winre.wim with an unpatched one etc. I fully understand how the exploit works and what we have here thanks, been part of the discussion since the start, and have spent enough years working in IT, and enough time fixing this issue on hundreds of computers. Thankfully we use pre-boot authentication with bitlocker so makes everything much more secure - until the next vulnerability.....
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
Ok... I didn't mean to step on your toes. Just saying, don't patch but disable if you care for your data. You have not won a thing if you patch if your opponent has physical access, while your opponent has truly won a thing with this exploit if you patch WinRE but leave it enabled.
 

My Computer My Computer

At a glance

Win11
OS
Win11
Comport Colin said:
Ok... I didn't mean to step on your toes. Just saying, don't patch but disable if you care for your data. You have not won a thing if you patch if your opponent has physical access, while your opponent has truly won a thing with this exploit if you patch WinRE but leave it enabled.
Click to expand...
Fair enough, but even if you do disable it, what is stopping someone if they gain access somehow (e.g. like I said via a machine which has been left unlocked for example) enabling it again, and copying an unpatched winre.wim - and then you are back to square one - a vulnerable machine. The whole thing is a mess and Microsoft don't seem to know what to do about it.
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
If someone gains access to my unlocked machine, I am an idiot, who should not worry about security - I think anyone should agree.
For all other cases hiding behind "somehow" - to modify WinRE.wim (or to re-enable WInRE) when the machine is online, you need to gain administrative permissions, first. If you gain those, you have passed the bitlocker hurdle already, since you may read the recovery key now or add protectors or decrypt.
 

My Computer My Computer

At a glance

Win11
OS
Win11
The amount of times I walk around a workplace and see users leaving machines left unlocked. And we all know of tools that can be run on an unlocked machine whether you have admin rights or not that will allow you to raise privleges or gain access to the file system etc, so re-enabling the recovery partition and copying over a unpatched winre.wim isn't exactly difficult. But whatever we do in IT we can't control users behaviour or stupidity and whenever we fix one vulnerability another one will soon open up, all we can do is protect ourselves as much as possible.
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
If you had exploits to elevate your privs from user to admin handy at any time, you would be winning the Pwn2Own over and over. There's no arsenal of windows internal unpatched exploits commonly available. But this one here allows to tear down the main barrier. "all we can do is protect ourselves as much as possible" -Yes! So let's not downplay this one and discuss scripted patching. Disable it. That's how you protect as much as possible.
 

My Computer My Computer

At a glance

Win11
OS
Win11
With it disabled you do lose some useful functionality e.g. startup repair I believe, and with lots of my workforce still working remotely spread over hundreds of miles things like that have often proved useful when a computer fails to boot and it fixes itself etc, without it would mean several hours drive and hours of lost work etc to get laptop fixed, so it is not always just as simple as disabling it for all organizations, hence why we chose to patch it to not lose functionality that has proved useful in the past. This thread was to discuss the threat and how to fix it. If you want to disable it then fine, but we are all free to discuss and make our own decisions, hence why we are on a discussion forum. One solution doesn't always work for everyone. So we chose patch, and make sure all computers using bitlocker with pre-boot. For now that is our choice.
 

My Computer My Computer

At a glance

Windows 11Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90...32Gb
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
Dell
CPU
Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz 2.90 GHz
Memory
32Gb
Browser
Google Chrome
Antivirus
AVG Internet Security
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom