KB5028254 breaks the Macrium bootable media.

Ghot · Jul 26, 2023

I'm still on Macrium Reflect 8.0.6635, and today's Cumulative Update broke my bootable rescue media.
I can create a Macrium Boot Menu entry that works, which IMO is useless.
If the boot record ever gets corrupt, I won't be able to access my backups.

I have NOT done the "revocations".

I created the Macrium Boot Option, and restored from .2070 back to .1992, and now my bootable USB rescue media works again.

See post #69, this topic, for the easiest solution I found for Revocations and Macrium bootable media.

Flashorn · Jul 26, 2023

Can't believe you did that. A man with your standings. Sorry, just could not hold this one back.
It's a preview. I was taught to only look at them and tell MS to find someone else to be their tester.

IanMosley · Jul 26, 2023

Ghot said:
I'm still on Macrium Reflect 8.0.6635, and today's Cumulative Update broke my bootable rescue media.

I'm on Build .2070 & MR 8.1.7544 and I'm not able to reproduce your issue.

Ghot · Jul 26, 2023

IanMosley said:
I'm on Build .2070 & MR 8.1.7544 and I'm not able to reproduce your issue.

I'm gonna check on the Macrium Forums and see if the newer versions have dealt with this issue.

Do you have Secure Boot, enabled or disabled?

CornishRattler · Jul 26, 2023

Ghot said:
I'm still on Macrium Reflect 8.0.6635

Even the defunct free version has a newer build number than that 8.0.7279

IanMosley · Jul 26, 2023

Ghot said:
Do you have Secure Boot, enabled or disabled?

Enabled. I also have NOT done the "revocations".

IanMosley · Jul 26, 2023

Flashorn said:
It's a preview.

Yet available as an optional update on Public. I've been on 'this' build since 13 July '23 with no issues.

Ghot · Jul 26, 2023

IanMosley said:
Enabled.

It's gonna take me a bit to figure this out. I noticed some changes in the BIOS (made by ASUS I presume).
I don't seem to have a toggle for Secure Boot any more. Currently it says disabled.

I had to Clear the Secure Boot keys, to disable Secure Boot (BLUE box)
The RED boxes are how other things are currently set.

I think I'm too tired to figure this out right now.

It's been a loooong day. Walmart screwed up my order... delivered one out of eight items, and marked them ALL as delivered.
Got refund and reordered. Just dealing with Walmart, tuckered me out.

Got a new medication today, bring the total to 13. LOL

@IanMosley I can't compare your DELL prebuilt to my home built PC... unfortunately.

Something I can do tonight, is make a fresh pre- .2070 backup, now that Secure Boot is OFF. Re-do the KB5028254 update, and see if the Macrium bootable Rescue USB stick works (with Secure Boot disabled).

Be back in about 10 minutes...

Ghot · Jul 27, 2023

Ok... time to redo today's updates...
Ok, Secure Boot is still off. Gonna restart and see if it will boot from the Macrium Rescue media.

Yeah doggies... the Macrium rescue media USB works!

I'm guessing this update forced the revocations? I know I didn't do the revocations.
The ones that were supposed to be released in Dec 2023.

Tomorrow I'll turn Secure Boot back on and see what happens. Maybe... :/
Might wait and see if I can get rid of the big Taskbar icons, first.

Fabler2 · Jul 27, 2023

KB5028254 installed and secure boot enabled, OS 22621.2070. Works for me

Ghot · Jul 27, 2023

Fabler2 said:
KB5028254 installed and secure boot enabled, OS 22621.2070. Works for me

View attachment 65879

Can't go by prebuilt comps. They have utilities that download things for you.
Honestly... who knows what they're downloading.

Need to compare to a home built comp.

All over the web I've been seeing... disable Secure Boot, do the revocations, then re-enable Secure boot.
I had Secure Boot running, and didn't do any revocations.
The revocations are supposed to be forced on us... in Dec 2023.
Pretty sure this is July.

Fabler2 · Jul 27, 2023

Ghot said:
Can't go by prebuilt comps. They have utilities that download things for you.
Honestly... who knows what they're downloading.

Need to compare to a home built comp.

The only thing this Acer utility has ever downloaded is an update to itself. Totally useless :lmao:

Ghot · Jul 27, 2023

Fabler2 said:
The only thing this Acer utility has ever downloaded is an update to itself. Totally useless

All I can do is post what happened.
Today's update broke my Macrium bootable USB stick.
Only way I could get it to work again, was to disable Secure Boot.

I even tried making a new Win 11 PE stick... no joy with Secure Boot enabled.
I mean Macrium made the stick no problem... it just wouldn't boot.

I'm guessing it has something to do with this...

Additional guidance for devices using Secure Boot to address CVE-2023-24932

Microsoft Support: UPDATE 7/11: Second Deployment This phase starts with updates released on July 11, 2023, which adds additionally support mitigating the issue. Security updates released May 9, 2023 and later contain security hardening changes to protect against vulnerabilities tracked by...

www.elevenforum.com

Fabler2 · Jul 27, 2023

Ghot said:
All I can do is post what happened.
Today's update broke my Macrium bootable USB stick.
Only way I could get it to work again, was to disable Secure Boot.

I even tried making a new Win 11 PE stick... no joy with Secure Boot enabled.
I mean Macrium made the stick no problem... it just wouldn't boot.

I'm guessing this has something to do with this...

Additional guidance for devices using Secure Boot to address CVE-2023-24932

Microsoft Support: UPDATE 7/11: Second Deployment This phase starts with updates released on July 11, 2023, which adds additionally support mitigating the issue. Security updates released May 9, 2023 and later contain security hardening changes to protect against vulnerabilities tracked by...

www.elevenforum.com

Yes. Going to be a PITA possibly. Recovery drive is Win RE build 253757.

Ghot · Jul 27, 2023

Fabler2 said:
Yes. Going to be a PITA possibly. Recovery drive is Win RE build 253757.

Yep. The instructions for dealing with these changes are ridiculous.

They're like... Go outside at midnight during a full moon. Have with you... eye of newt, hair of dog, and three fingers from a drunk leprechaun. Using the three fingers, rub the eye of newt with the hair of dog, while dancing naked in a circle, and chanting the rules for BSOD posting.

The instructions should be... download this hotfix and double click to apply.
But that would require that MS actually do some work.

Fabler2 · Jul 27, 2023

I'll have to try that although the only problem would be to see a full moon. It always rains here :woozy:

Ghot · Jul 27, 2023

Well... time for bed... for me.
Cya all on the flipside.

Scott · Jul 27, 2023

Ghot said:
Well... time for bed... for me.
Cya all on the flipside.

Hope you had a good night's sleep

To see if revocations are applied, the Secure Boot DBX Management key will say "Mixed"

And I still have control of Secure Boot on/off

Ghot · Jul 27, 2023

Scott said:
Hope you had a good night's sleep

To see if revocations are applied, the Secure Boot DBX Management key will say "Mixed"

View attachment 65883

And I still have control of Secure Boot on/off

View attachment 65884

Yeah, I believe mine did say that. Since I had never seen "values" in any of those management keys (not sure I looked)...
I chose... "Clear Secure Boot Keys".

When I cleared the keys, "Secure Boot state"switched from Enabled to Disabled.

From the manual...

Also, my boot menu used to have all these and two entries for the USB stick. But after the update, only showed the two with the RED dots.

The only way I could access any of my backups, was to let Macrium add a Macrium boot option to the boot process.
While handy, I don't like this option because if the Boot Configuration Data ever becomes corrupt, I won't be able to access my backups.

And I know the Macrium bootable USB stick has worked since I flashed the BIOS on May 24th, this year, because I've used the Macrium bootable USB stick a couple times since then, to restore from a backup. Last use was July 16th 2023.
I always make backups in Macrium within Windows, and restore backups using the Macrium USB stick.

Microsoft should have kept their hands and ideas away from the BIOS.

@Brink
If "ever" there was a need for a tutorial... this is it.
And it can't be in Micro-speak either.
You may have to go to Redmond, WA and hassle some oriental lady programmers, to get the required info.
But we're behind you.

Ghot · Jul 27, 2023

@hsehestedt has created an excellent tutorial here, but it's still too complex, at least for my addled mind.

Latest on the BlackLotus Bootkit Mitigations - Includes Instructions and Batch Files

EDIT: Batch files have been tweaked and updated on Jul 27, 2023. Please also note that this was tested with the US English version of Windows. It's possible that some adjustments may be needed for other locales but I have not looked into that. Use this information as a reference. There was a...

www.elevenforum.com

I'd like to see three batch files.
One, that downloads and installs the Windows ADK, and the PE addon, with no help from the user.
One, that creates the Macrium bootable rescue media, or takes a Macrium rescue media ISO and fixes it.
One, that applies the revocations.

What I'd really like to see, is one batch file that does it all.