Solved Is my winre.wim the latest?

hdmi · May 9, 2024

Add an update to Windows RE

Add an update package to Windows RE.

learn.microsoft.com

Make sure that the ServicePackBuild is greater than or equal to the UBR for the update that you added. For example, for Windows 11, version 22H2, the November security update would show 819 as the SerivcePack Build, since full version number for that update is 22621.819.

If the version reported is an earlier version, this indicates the Windows RE image is not up to date.

If the reported version is the same or a later version, no action is needed.

UBR stands for Update Build Revision. The 3518 build that you currently have is a Compatibility Update that is not available through Windows Update, specifically, KB5037739: KB5037739: Compatibility update for installing and recovering Windows 11, version 22H2 and 23H2: April 23, 2024 - Microsoft Support

Even though your build is newer than build 3447, i.e., KB5036893 ( April 9, 2024—KB5036893 (OS Builds 22621.3447 and 22631.3447) - Microsoft Support ), there exists an even newer (optional) build, 3527, which is a Preview Cumulative Update, KB5036980. April 23, 2024—KB5036980 (OS Builds 22621.3527 and 22631.3527) Preview - Microsoft Support
Granted, it's only a Preview, BUT... it's on the production channel nonetheless. Therefore, it is the newest.

FreeBooter · May 9, 2024

x BlueRobot said:
I've read the exact same article, I've just been trying to explain what attack vector means, however, you don't seem to understand that, you've just been back pedalling since @pseymour pointed out your nonsensical stance that you don't need to ever update the Windows RE image since it never contains vulnerabilities which are exploited. That was your original point.

An attack vector is either how a malicious payload is delivered to a machine or how an malicious action is able to be carried out. Some will require physical access to the machine like this example or to be more obvious, conducting DMA drive by attacks.

I give up...

Why explain to me who said i need your explanation also i read what i read and how understand nothing to do with you.

I never said WinRe never have contains vulnerabilities, i said if Microsoft add features to WinRe then it can be updated but @pseymour point out that the it has contains vulnerabilities i said someone physically need to take control of the PC for that vulnerabilities took effect and that what Microsoft says as well.

Ghot · May 9, 2024

@kelper

Generally, you can get the latest version of... any build, at UUP Dump.

UUP dump

UUP dump lets you download Unified Update Platform files, like Windows Insider updates, directly from Windows Update.

uupdump.net

Once you've decided on which version to download...

This is what will be IN the zip file you download.
Just double click the file in the RED box to download and build the ISO...

When finished, the ISO will be in whatever folder you extracted the zip file to.

NOTE: While the ISO is being built, the stuff in the open command window will "look" like it's finished.
It's won't be. When it's actually finished, the command window will say something like: Press 0 to Exit.

kelper · May 9, 2024

thanks @Ghot

this is odd. the build is the same as mine but the extracted winre.wim is half the size!

Ghot · May 9, 2024

kelper said:
thanks @Ghot

this is odd. the build is the same as mine but the extracted winre.wim is half the size!

View attachment 95677

I'm not sure how that works. I've never messed around with WinRE, or done anything with the .wims.

kelper · May 9, 2024

@Ghot

Please tell me the size or version of the winre.wim file in C:\Recovery\WindowsRE or C:\Windows\System32\Recovery or the one in your Recovery partition.

Mine is 1,020,592KB version 10.0.22621 according to

Dism /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE\winre.wim /index:1

Except that today, I have deleted the recovery partition.

Ghot · May 9, 2024

kelper said:
Please tell me the size or version of the winre.wim file in C:\Recovery or C:\Windows\System32\Recovery or the one in your Recovery partition.

My Recovery partition and all it's associated files are long gone. I removed all that, long ago.

kelper · May 9, 2024

I will mark this solved as it has drifted off topic and nobody has been able to fully answer what I thought was a simple question.

SailorHF · Wednesday at 9:40 AM

I have not found any official MS source for what is the latest winre.wim version. I guess someone on Microsoft's own forums might be able to answer the question.

However, for what it's worth, my version on a Win 11 23H2 machine that just recently installed the May 2024 Windows updates is the same as yours: 10.0.22621.3518. I believe that is the latest version that MS is pushing out with the Windows updates. And why do I believe that?

Like many others, I suffered from the problem of the recovery partition being too small, which would cause the Windows update trying to update the recovery environment to fail to update it, giving a critical event 4502 like this in the System Event log: "Windows Recovery Environment servicing failed". So I was stuck on an old version of the winre. Just recently I was able to resize my recovery partition to fix this problem, and when I installed this month's Windows updates, they also successfully updated the recovery environment. This was confirmed by an event 4501 in the System Event log. Event source is WinREAgent and it basically says that "servicing was successful" and then reports the new recovery environment version number and that is exactly "10.0.22621.3518".

For those who don't think the Windows recovery environment version is important, there have been vulnerabilities in the recovery environment, some of which allow a bypass of BitLocker disk encryption (including the Windows Home versions' "Device encryption", of course) if someone has physical access to the system. So if someone steals your laptop that is encrypted, such a vulnerability could be used to bypass the encryption and see all your sensitive data, so it is a serious vulnerability for those who use full disk encryption to protect their data.

hdmi · Wednesday at 2:55 PM

SailorHF said:
I have not found any official MS source for what is the latest winre.wim version. I guess someone on Microsoft's own forums might be able to answer the question.

However, for what it's worth, my version on a Win 11 23H2 machine that just recently installed the May 2024 Windows updates is the same as yours: 10.0.22621.3518. I believe that is the latest version that MS is pushing out with the Windows updates. And why do I believe that?

Like many others, I suffered from the problem of the recovery partition being too small, which would cause the Windows update trying to update the recovery environment to fail to update it, giving a critical event 4502 like this in the System Event log: "Windows Recovery Environment servicing failed". So I was stuck on an old version of the winre. Just recently I was able to resize my recovery partition to fix this problem, and when I installed this month's Windows updates, they also successfully updated the recovery environment. This was confirmed by an event 4501 in the System Event log. Event source is WinREAgent and it basically says that "servicing was successful" and then reports the new recovery environment version number and that is exactly "10.0.22621.3518".

For those who don't think the Windows recovery environment version is important, there have been vulnerabilities in the recovery environment, some of which allow a bypass of BitLocker disk encryption (including the Windows Home versions' "Device encryption", of course) if someone has physical access to the system. So if someone steals your laptop that is encrypted, such a vulnerability could be used to bypass the encryption and see all your sensitive data, so it is a serious vulnerability for those who use full disk encryption to protect their data.

22621.3527 was the latest before yesterday. Now, 22621.3593 is the latest (but it soon won't be...).

SailorHF · Thursday at 6:41 AM

hdmi said:
22621.3527 was the latest before yesterday. Now, 22621.3593 is the latest (but it soon won't be...).

That is very interesting. I just updated another Win 11 system, and Windows Update updated the recovery environment to servicepack build 3518, again. Where are you getting these higher versions like 3593, are they coming from this month's Windows updates or some other source?

I wonder if language is a factor here, you seem to have Dutch Windows version and all mine are Finnish ones...

hdmi · Thursday at 12:44 PM

SailorHF said:
That is very interesting. I just updated another Win 11 system, and Windows Update updated the recovery environment to servicepack build 3518, again. Where are you getting these higher versions like 3593, are they coming from this month's Windows updates or some other source?

I wonder if language is a factor here, you seem to have Dutch Windows version and all mine are Finnish ones...

May 14, 2024—KB5037771 (OS Builds 22621.3593 and 22631.3593) - Microsoft Support

support.microsoft.com

Finally,
Apply the update to a running PC.

hsehestedt · Thursday at 1:08 PM

x BlueRobot said:
Any new versions of WinRE will be delivered through Windows Update, so as long as you're installing the latest updates, then you should always have the latest applicable version.

Yes and no - there is no one single item that is simply an update WinRE. That WIM can get updates injected into it, just like the install.wim, although it would need to be extracted first from the install.wim to do so.

If interested, I have a script that can do this for you.

hsehestedt · Thursday at 1:16 PM

hdmi said:
22621.3527 was the latest before yesterday. Now, 22621.3593 is the latest (but it soon won't be...).

View attachment 96279

@hdmi,

What is the source of your image? Even with all the latest updates applied to my image, the winre.wim is showing a build of 3518 rather than 3593 while my install.wim and boot.wim show a build of 3593.

kelper · Thursday at 1:33 PM

@hsehestedt

Haven't you written a little utility to capture the latest winre.wim from the cloud? It should be a doddle for a man with your skills!

hdmi · Thursday at 1:41 PM

hsehestedt said:
@hdmi,

What is the source of your image? Even with all the latest updates applied to my image, the winre.wim is showing a build of 3518 rather than 3593 while my install.wim and boot.wim show a build of 3593.

See the link at the bottom of my post #52.

Next,
Validate the Windows RE version in an Online Windows OS

kelper · Thursday at 2:00 PM

@hdmi I think he was asking where you got that winre.wim, not how you identified its version.

SIW2 · Thursday at 2:19 PM

apply the update.

hdmi · Thursday at 4:32 PM

kelper said:
@hdmi I think he was asking where you got that winre.wim, not how you identified its version.

I didn't need to get a winre.wim file from anywhere TBH. Like explained in the official link I gave, on a running PC the REAgentC.exe tool can actually be used to mount winre.wim directly off of the Recovery partition itself (even though there's no winre.wim file that can be found on the Recovery partition, as this partition isn't meant to be browsed so, using Diskpart to assign a drive letter to it will simply lead you nowhere).

There's also the hidden folder C:\$WinREAgent and the hidden system file C:\$WinREAgent\Backup\Winre.wim that you could maybe decide to use, but that isn't required when you already have a Recovery partition that you know you can use to boot into Windows RE. You could also decide to update this winre.wim file, i.e. by following the steps to Update an offline image. That is, at least if you have the file.

Either way, if you have a working Recovery partition and WinRE is enabled, then if you use REAgentC to disable WinRE, normally it should create a winre.wim file for you. In C:\Windows\System32\Recovery or in C:\Recovery\WindowsRE you should be able to find it then. If not, you can still look for the winre.wim file elsewhere (e.g., extract the winre.wim file from the official Windows 11 installation ISO that can be downloaded from Microsoft).

hsehestedt · Saturday at 12:11 AM

kelper said:
@hsehestedt

Haven't you written a little utility to capture the latest winre.wim from the cloud? It should be a doddle for a man with your skills!

I don't capture the WinRE.wim from anywhere. I simply update instead. Every month, both when the patch Tuesday updates are released and again when the preview updates are released, I perform a complete update of my Windows images. The chart below shows when updates I apply and to what. Everything in parenthesis has to do with optional updates, language packs, etc. Since I don't bother adding any of these components to my images I don't need to update those items and they can simply be skipped.

Because there are multiple components that get updated from the very same source files, I want to make sure that all components being updated are updated from the exact same source. As a result, I download nothing and handle all the updates myself because I can only trust my own work

. In fact, there are known issues of ending up with the same file in different locations that don't match but they are supposed to be identical. This can and does cause various failures, especially in the installation of Windows so it's vital to make sure that files found in multiple places (such as Win PE and the main OS) are exact matches.

As an example, from the chart above, note that the SSU gets applied to WinRE, WinPE, and the main OS. You want to be sure that all files come from the same matching source file, so downloading any component with unknown components is a big no no.