KB5028254 breaks the Macrium bootable media.

Ghot · Aug 1, 2023

Ghot said:
Ok... w/o using Rapid Delta Restore... and restoring from bootable rescue media...

.6635 ~1:55
.7544 3:14 <--- there is the speed problem.

Ok, with the new USB stick, the speed is almost back to normal for restores from outside Windows.
.7544 with Win 11 PE stick, 2:15.

Ok, no more experimenting till someone finds a solution to the big Taskbar icons.
Cause if I do the .2070 July 26th update... they'll be back.

Now... Imma make me some pork potstickers and watch some of the old Kung Fu series.

Chicken or Pork Pot Stickers - Fusia Asian Inspirations | ALDI US

ALDI

www.aldi.us

Wisewiz · Aug 1, 2023

Ghot said:
Noiw... Imma make me some pork potstickers and watch some of the old Kung Fu series.

Positively decadent! Enjoy!

Tweakfiend · Aug 2, 2023

IanMosley said:
You need to read my message #47 in this thread and take the PREVENTATIVE action advised.

Fraid not relevant to my non boot rescue issues

glasskuter · Aug 6, 2023

@Ghot I screwed up today and had to restore an image. Remember me...I'm that old lady that keeps secure boot turned off because I don't trust this mess. Both the May and July updates have been applied, but no manual revocations. My old Macrium 8.0 recovery media booted just fine, I restored an image just fine BUT windows would NOT boot. A big ol' blue screen. That's the first time that has ever happened for me with a Macrium image. I sat here shaking in my little old lady house slippers for about 15 minutes, scared to even touch this computer.
Finally, I booted back into my recovery media and ran "fix boot issues" and Windows booted up. I can't understand why it happened since secure boot was off and no revocations have been applied. I just know it was scary enough to make me pee my pants. There's got to be a connection...somewhere. There's just too much hoo-do voo-do for my liking.

Ghot · Aug 6, 2023

glasskuter said:
There's just too much hoo-do voo-do for my liking.

I disabled Secure Boot.
I updated to the latest version of Macrium 8.1.xxxx
I rebuilt the bootable rescue media, (still on Windows PE 10 (WADK)), then made a backup and tried a restore.
It worked.

Next up is to do the revocations, patch the bootable Win PE rescue media, then re-enable Secure Boot and test.
Using the Macrium Guide

I'm putting that off temporarily. I got a pile of doctors appointments coming up.
Nothing too serious, just follow-ups and new Primary Care team meet and greet stuff.
Ofc, everything is happening in the next three weeks.

It's just not a good time for me to be worrying about Macrium and Microsoft weirdness.

Also... August patch Tuesday is in 2 days. LOL

Doesn't affect me but, @Brink just posted this, today... MS may block Win 11 install on non-compatible hardware

glasskuter · Aug 7, 2023

THAT I've been expecting. I believe cutting off updates for incompatible hardware will happen, too. I'll also bet a dollar to a donut, at some point soon bypassing a MS account (on setup) will also be impossible. They'll plug up all the holes.

Ghot · Aug 7, 2023

glasskuter said:
THAT I've been expecting. I believe cutting off updates for incompatible hardware will happen, too. I'll also bet a dollar to a donut, at some point soon bypassing a MS account (on setup) will also be impossible. They'll plug up all the holes.

The darkness is growing...
We must get the ring to Mt. Doom... ASAP!

Big yawn. I'm off to sleepy-ville.

Ghot · Aug 7, 2023

@glasskuter

Post #65 and this oddity...

If I recall... the only way I could get Secure Boot state (in the BIOS), to say "disabled", was to "Clear Secure Boot Keys".
This ofc, may have caused a rip in the Space-Time continuum.

Previously, the Secure Boot item used to say... Enabled. Now it just says... Supported.
Yet up above in Win 11 Settings... it says Secure Boot is... ON.

I have the latest BIOS and the latest chipset drivers, as well.

Kind of makes me wonder if we might, in 10 years, see an article titled...
"Back when we thought we had a clue about... KEYS".

Ghot · Aug 12, 2023

UPDATE...
@Brink

Ok... the Macrium directions didn't work for me. Well the Macrium revocation directions didn't.
The Macrium Revocation directions told me I have to disable Secure Boot.
That wasn't necessary.
For the Revocations... I just leave Secure Boot enabled, then I do this...

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

The Event ID 1035 is located in Event Viewer (Local) > Information

The Event ID 276 is buried here: Applications and Services Log > Microsoft > Windows > Kernel-Boot > Operational

Then I go here...

Windows Security update for Secure Boot - Knowledgebase 8.0 - Macrium Reflect Knowledgebase

knowledgebase.macrium.com

I format the USB stick (FAT32), ...and scroll down and follow the directions, here... Create New Macrium Reflect Rescue Media

Summary: Revocations applied successfully. Everything works, Macrium Rescue Media works.. etc.

Scott · Aug 12, 2023

@Ghot do you have Other OS on this drop-down menu? Choosing Other OS turns off Secure Boot on my ASUS board.

Ghot · Aug 12, 2023

Scott said:
@Ghot do you have Other OS on this drop-down menu? Choosing Other OS turns off Secure Boot on my ASUS board.

View attachment 67632

Ah that makes sense... NOT.
But good look. Have some cookies.

Leave it to ASUS to change the entire BIOS format, just for Secure Boot. LOL
I mean... clicking Secure Boot, then choosing Disable or Enable... would be way too simple.

But... mine didn't need disabled, for the Revocations to work. But... I just did the revocations today.

The Macrium instructions say: Disable Secure Boot...
The Microsoft instructions don't say that.

On a side note: Since the July patch Tuesday... to get my Movies folder (910 files, 72 folders), to open instantly, I've had to remove all the column headings except three... Name, Date and Length. [Fast hard drive with large cache]

It used to open instantly with four column headings. Before Windows 10... it used to open instantly with five column headings.

hsehestedt · Aug 12, 2023

I'll have to repost my batch files again when I get in front of my desktop. At least for me, that seems to fix Macrium Reflect just fine

Ghot · Aug 12, 2023

hsehestedt said:
I'll have to repost my batch files again when I get in front of my desktop. At least for me, that seems to fix Macrium Reflect just fine

The Macrium Rescue media "rebuild" instructions worked fine.
Scroll down to find them... here... Create New Macrium Reflect Rescue Media

Windows Security update for Secure Boot - Knowledgebase 8.0 - Macrium Reflect Knowledgebase

knowledgebase.macrium.com

For Revocations and Macrium Rescue Media, post #69 contains all the ancient secrets.

hsehestedt · Aug 12, 2023

Good. I guess I misread. I had thought that the rebuild instructions did not work.

Okay, I'll refrain from butting in any further

Ghot · Aug 12, 2023

hsehestedt said:
Good. I guess I misread. I had thought that the rebuild instructions did not work.

Okay, I'll refrain from butting in any further

No worries. Was not a butt.

Scannerman · Aug 13, 2023

glasskuter said:
What I didn't want to see is:
Caution: Once the mitigation for this issue is enabled on a device, meaning the revocations have been applied, it cannot be reverted if you continue to use Secure Boot on that device. Even reformatting of the disk will not remove the revocations if they have already been applied. Please be aware of all the possible implications and test thoroughly before applying the revocations that are outlined in this article to your device.
I don't mind telling you, boys and girls, as messed up and misunderstood as this entire mess has been, it scares the pee-waddling-do out of me when I'm told something can't be UNDONE. One has to be a rocket scientist to understand it, and this old woman ain't. And for MS to be in control of what's in my UEFI bios....just doesn't sit right with me. Maybe I'm stupid...or hardheaded...or crazy...but I'd rather take my chances that I won't be a Black Lotus victim.

^^^ This. Good to see some of us here finally "get it". I am opposed to the monopolistic undertakings of the TPM Consortium because this is precisely where it is going. Once MS has full control of your UEFI they might as well own your hardware while their at it. That ain't right. The Psi-Op the Syndicate (the consortium really is a syndicate) promotes in Win 11 is beyond the pale. It isn't ethical.

Jody here, does make a valid point about Secure Boot.

hsehestedt · Aug 13, 2023

Scannerman said:
I am opposed to the monopolistic undertakings of the TPM Consortium because this is precisely where it is going. Once MS has full control of your UEFI they might as well own your hardware while their at it.

My opinion is a little bit different.

What I do agree on is that the average person probably has no real solid reason to apply the revocations now. They can and probably should wait Q1 2024 when the enforcement phase begins.

However, and you are going to love this part, bear in mind that Microsoft already has control here. Secure Boot already has a list revocations. All that is being done here is that Microsoft is adding to that list. But, they are doing so for a very good reason - to protect against a newly created compromise.

Resistance is futile!

LOL. Okay, joking aside, I get it. I truly hate all this stuff myself. I resent all these heavy-handed practices in the name of security. I hate having to run anti-virus software. I hate that my own program erroneously gets flagged as containing a trojan. I hate having to install constant security updates that just end up breaking other things. But with all that said, I understand why it's needed in this day and age.

Scannerman · Aug 14, 2023

hsehestedt said:
My opinion is a little bit different.

What I do agree on is that the average person probably has no real solid reason to apply the revocations now. They can and probably should wait Q1 2024 when the enforcement phase begins.

However, and you are going to love this part, bear in mind that Microsoft already has control here. Secure Boot already has a list revocations. All that is being done here is that Microsoft is adding to that list. But, they are doing so for a very good reason - to protect against a newly created compromise.

Resistance is futile!

LOL. Okay, joking aside, I get it. I truly hate all this stuff myself. I resent all these heavy-handed practices in the name of security. I hate having to run anti-virus software. I hate that my own program erroneously gets flagged as containing a trojan. I hate having to install constant security updates that just end up breaking other things. But with all that said, I understand why it's needed in this day and age.

Well, we are certainly entitled to our opinions. I've expressed mine several times in this forum. In fact, that's what I really enjoy about these forums: That we can express our opinions without getting trolled to death.

Microsoft has control of the Microsoft OS. That is all Microsoft needs to have. Microsoft does not need to have absolute control over my hardware. I should always have the option to tell Microsoft "no" with respect to specific venues of my hardware without having to put a blanket all check mark in the EULA. My UEFI (BIOS) should be one of those venues.

Resistance is essential.

I run anti-virus software because it is vital to use if I want to keep using the internet. I use a firewall because this is practical. I make back ups simply because it is prudent to do. TPM is neither vital, practical, or prudent. TPM consistently fails, is completely unnecessary, and destroys the end user's positive experience because it is a positive disaster. The only "good" thing about TPM is it makes the big boys in the Consortium richer.

BUT Come Q1 2024 we shall see what happens. I already have Windows to thank for making me a Linux user.

hsehestedt · Aug 14, 2023

Scannerman said:
Well, we are certainly entitled to our opinions. I've expressed mine several times in this forum. In fact, that's what I really enjoy about these forums: That we can express our opinions without getting trolled to death.

Microsoft has control of the Microsoft OS. That is all Microsoft needs to have. Microsoft does not need to have absolute control over my hardware. I should always have the option to tell Microsoft "no" with respect to specific venues of my hardware without having to put a blanket all check mark in the EULA. My UEFI (BIOS) should be one of those venues.

Resistance is essential.

I run anti-virus software because it is vital to use if I want to keep using the internet. I use a firewall because this is practical. I make back ups simply because it is prudent to do. TPM is neither vital, practical, or prudent. TPM consistently fails, is completely unnecessary, and destroys the end user's positive experience because it is a positive disaster. The only "good" thing about TPM is it makes the big boys in the Consortium richer.

BUT Come Q1 2024 we shall see what happens. I already have Windows to thank for making me a Linux user.

Once again, let me present a counterpoint.

NOTE: I am not endorsing this viewpoint, nor am I saying that this is my viewpoint. I am simply presenting it because it has at least caused me to think a bit more about my own views and temper thoughts that are "absolutes" on either side...

It has been pointed out by some that people who don't take security seriously or simply may not have the technical skills to properly secure their systems put other people at risk. This is because when their systems become compromised, their systems can be used to attack others. Sometimes these attacks come as huge numbers of systems attacking a single or a few targets, or they may take a more targeted approach where contact information that has been compromised on a victim system is used to directly target known contacts of that victim. This makes these attacks a lot more believable since they appear to come from a known contact. So, the viewpoint of some is that it is absolutely mandatory for Microsoft to take some rather aggressive steps to secure systems from outside threats as well as from the end users own possible shortcomings.

Don't shoot the messenger! Once again, I'm presenting this only because it made me think and examine some of my own views and drove home how complex issues surrounding security can be.

Scannerman · Aug 14, 2023

hsehestedt said:
Once again, let me present a counterpoint.

NOTE: I am not endorsing this viewpoint, nor am I saying that this is my viewpoint. I am simply presenting it because it has at least caused me to think a bit more about my own views and temper thoughts that are "absolutes" on either side...

It has been pointed out by some that people who don't take security seriously or simply may not have the technical skills to properly secure their systems put other people at risk. This is because when their systems become compromised, their systems can be used to attack others. Sometimes these attacks come as huge numbers of systems attacking a single or a few targets, or they may take a more targeted approach where contact information that has been compromised on a victim system is used to directly target known contacts of that victim. This makes these attacks a lot more believable since they appear to come from a known contact. So, the viewpoint of some is that it is absolutely mandatory for Microsoft to take some rather aggressive steps to secure systems from outside threats as well as from the end users own possible shortcomings.

Don't shoot the messenger! Once again, I'm presenting this only because it made me think and examine some of my own views and drove home how complex issues surrounding security can be.

Without prejudice

I do not dispute your counterpoint. Microsoft could give any fanciful reason they wish for doing whatever they choose to do with their operating systems. It matters not. My point is that when they start messing with my hardware, including the UEFI on my system board that is my property to the extent that it interferes with my ability to run "OTHER OS" without having to toggle, toggle, toggle... This is unethical. It is a needless bother. Furthermore TPM has been around for a decade and continually has problems. Microsoft and the rest need to find a better approach to the security that they claim to offer outside of TPM and offer an approach that isn't so invasive. IMO TPM has failed the acid test and the only reason the Consortium keeps pushing it on people is because they have so much invested in it. These aggressive steps to secure systems from outside threats closely resemble patented malware that is only a couple of steps away from the end user relinquishing ownership of the hardware they paid for. When you cannot tell the "good guys" from the "bad guys" what difference does it make? TPM might as well be a root kit. It is said that those who give up liberty for security deserve neither. As an end user I like to keep my options open.