IMPORTANT Issue to be aware of if you use BitLocker on your OS drive

SIW2 · Jan 20, 2023

not easy to understand MS jargon

"IMPORTANT: End users and enterprises who are updating Windows devices which are already deployed in their environment can instead use the latest Windows Safe OS Dynamic Updates to update WinRE when the partition is too small to install the full Windows update. You can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog."

do they mean this ?
kb5022370

the most recent I could find that specifies Safe Os is from November

Microsoft Update Catalog

wingers · Jan 20, 2023

SIW2 said:
not easy to understand MS jargon

do they mean this ?
kb5022370

the most recent I could find that specifies Safe Os is from November

Microsoft Update Catalog

No they mean one of these - Microsoft Update Catalog

So yes the latest one would be the one from 8th November - that is what I applied along with January CU following @hsehestedt steps in earlier post

SIW2 · Jan 20, 2023

If only that is needed it wont add much to the size.

hsehestedt · Jan 20, 2023

barreleye said:
I don't know if this has already been posted, but they've updated the FAQ since the last time I looked at it, around the time this thread was started. It now includes the paragraph:

"IMPORTANT: End users and enterprises who are updating Windows devices which are already deployed in their environment can instead use the latest Windows Safe OS Dynamic Updates to update WinRE when the partition is too small to install the full Windows update. You can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog."

Thanks for pointing this out. The only problem is that, as has been noted, the Update Catalog shows no SafeOS update since November. I really wish that they would get their act together with this stuff

barreleye · Jan 20, 2023

hsehestedt said:
Thanks for pointing this out. The only problem is that, as has been noted, the Update Catalog shows no SafeOS update since November. I really wish that they would get their act together with this stuff

How do you know it doesn't cover the vulnerability? The CVE says "Released: Nov 8, 2022", same as the date on the SafeOS updates.

Whatsgoingon · Jan 20, 2023

What a mess this one is!!

Any admins on here with a task to deploy this across 1000+ workstations? If so, how are you going about it?

hsehestedt · Jan 20, 2023

barreleye said:
How do you know it doesn't cover the vulnerability? The CVE says "Released: Nov 8, 2022", same as the date on the SafeOS updates.

If the November update covered it, it would have been in the release notes rather than waiting until January. At least, that's what I would think. Why wait two months to tell you that you need to patch the recovery environment?

EDIT: Also, take a look at the notes for that SafeOS Update - no mention of the CVE in the notes.

KB5021041: Compatibility update for installing and recovering Windows 11, version 22H2: November 8, 2022 - Microsoft Support

support.microsoft.com

barreleye · Jan 20, 2023

hsehestedt said:
If the November update covered it, it would have been in the release notes rather than waiting until January. At least, that's what I would think. Why wait two months to tell you that you need to patch the recovery environment?

Why is the CVE itself dated Nov 8 but only came to light this month?

hsehestedt · Jan 20, 2023

barreleye said:
Why is the CVE itself dated Nov 8 but only came to light this month?

A CVE is a report of a vulnerability. Just because a CVE is published, does not mean that a fix is already available.

barreleye · Jan 20, 2023

hsehestedt said:
A CVE is a report of a vulnerability. Just because a CVE is published, does not mean that a fix is already available.

Yet they just very specifically pointed you to it.

hsehestedt · Jan 21, 2023

FYI, I tried injecting only the SafeOS update and it does not update the build as required. So, that answers the question as to whether the November 2022 includes the fix; it does not.

SIW2 · Jan 21, 2023

I tried injecting only the SafeOS update

it doent change to sp build 1105.

how do you know that is what is required?

hsehestedt · Jan 21, 2023

SIW2 said:
it doent change to sp build 1105.

how do you know that is what is required?

Interesting. While looking for some documentation regarding this, I ran into the following in a Microsoft article:

So, there is a possibility that the Safe OS update has what we need, but * I JUST DON'T KNOW *. To be o the safe side, I am continuing my strategy of applying BOTH the LCU and the Safe OS update, Actually, to really update the WinRE.wim, I'm doing the SSU, the LCU, and the Safe OS update. That way I am 100% confident that it's updated!

ncisb · Jan 25, 2023

I followed all the steps in post #24 on my personal Win10 machine and it worked without any issues. When I try the same steps on our work machines I get an error when trying to mount winre.wim with the command DISM /mount-image /imagefile:c:\windows\system32\recovery\winre.wim /index:1 /mountdir:c:\mount. The error is specified path can not be found even though winre.wim in located in that path and c:\mount exists. I get the same error on multiple machines. DISM error log doesn't provide any more information. Any ideas why I can't mount winre? Thanks in advance.

hsehestedt · Jan 25, 2023

Is it possible that the WinRE.wim is read-only? Make sure to remove the read-only attribute if that is the case.

If that's not it, let me know and I'll look further into this.

ncisb · Jan 27, 2023

hsehestedt said:
Is it possible that the WinRE.wim is read-only? Make sure to remove the read-only attribute if that is the case.

If that's not it, let me know and I'll look further into this.

I ran attrib -h -s -i c:\windows\system32\recovery\winre.wim before I tried to mount WinRe.wim. I also tried it -r as well with the same result. Is there something else I can try?

hsehestedt · Jan 27, 2023

The message is pretty specific, indicating that the file cannot be found. Are you SURE that there were no spelling or syntax errors in the command that you were running?

ncisb · Jan 27, 2023

hsehestedt said:
The message is pretty specific, indicating that the file cannot be found. Are you SURE that there were no spelling or syntax errors in the command that you were running?

I have tripled checked the syntax and used copy and paste multiple times and have verified several times the path is correct and the file is in the correct location. It's all very odd. I don't has any experience with DISM and I haven't separately installed install ADK. Do I need to install ADK and try again? Thanks for your help with this.

hsehestedt · Jan 27, 2023

I work extensivly with DISM and have always made it a habit to first install the ADK to be certain that I am running the latest version. Still, I rather doubt that this is the problem, but it's worth a shot.

A couple tips if you decide to do this:

1) When installing the ADK, you get the option to select from a whole bunch of different components to install. The only option that you need to select is the deployment tools.

2) After installing the ADK, one of the installed items will be Windows Kits > Deployment and Imaging Tools Environment. Use that to run DISM. This is basically a modified command prompt with the correct paths to the ADK version of tools such as DISM.

SIW2 · Jan 27, 2023

you copy winre.wim to e.g the root of the partition, create a mount folder e.g. C:\mount and see if you are able to mount winre .wim into that mount folder with dism.

IMPORTANT Issue to be aware of if you use BitLocker on your OS drive

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

New member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

Well-known member

My Computers