Solved Latest Macrium Reflect updates

Ghot · Sep 4, 2023

Wisewiz said:
MR update a few mins ago (both main machines). Then plugged in rescue flash and clicked Rescue icon (upper left, main MR window):

View attachment 69908

Then, after rebuilding rescue media by just clicking Build:

View attachment 69909

Another reason to love Macrium.

Didn't break the Revocation stuffies...
And it even boots like it should.

Wisewiz · Sep 4, 2023

Yes. Used the same procedure on both main machines to produce two rescue keys. Tested both, and both booted into MR flawlessly. :clap:

Caledon Ken · Sep 4, 2023

I know this is an eleven forum but is it safe to say the recovery partition on Windows 10 machines has also been updated (WinRe.wim)

Ghot · Sep 4, 2023

Caledon Ken said:
I know this is an eleven forum but is it safe to say the recovery partition on Windows 10 machines has also been updated (WinRe.wim)

Dunno... but it's usually a good idea to update the bootable rescue media occasionally.
Sooner or later, MS or Macrium will change something major, and the stick will no longer boot.

For example... on Win 11, the MS Revocations (optional), forced a rebuild of the Macrium bootable rescue media.

Caledon Ken · Sep 4, 2023

Wisewiz said:
Yes. Used the same procedure on both main machines to produce two rescue keys. Tested both, and both booted into MR flawlessly.

So Wisewiz did you do the manual steps (May 9th) changes to enforce or when you say tested you just mean Macrium boots.

Question for Ghot. You mention you needed to format USB key to pick up the new PE environment. Do you also use the boot option for Macrium. Given you needed to format USB I would assume someone using PE in the boot menu would have to first remove it and then reinstall to get the Win 11 PE files.

Caledon Ken · Sep 4, 2023

Ghot said:
Dunno... but it's usually a good idea to update the bootable rescue media occasionally.
Sooner or later, MS or Macrium will change something major, and the stick will no longer boot.

For example... on Win 11, the MS Revocations (optional), forced a rebuild of the Macrium bootable rescue media.

Agree Ghot but still asking if WinRe.wim updated in 10 if MS did this in 11.

Ghot · Sep 4, 2023

Caledon Ken said:
Agree Ghot but still asking if WinRe.wim updated in 10 if MS did this in 11.

Not that I know of. It was just a Win 11, Secure Boot thing.
See the Revocations link I added to my post just above.

For Win 11 folks... I did this... Revocations Management
Note: I use the Windows 11 PE (WADK) WIM, not the WinRE... when I build the bootable rescue media.

Wisewiz · Sep 4, 2023

Caledon Ken said:
So Wisewiz did you do the manual steps (May 9th) changes to enforce or when you say tested you just mean Macrium boots.

Took my cue from Bree in 574 above:
"If you have just rebuilt your WinRE boot media you will have unknowingly followed the steps to be ready for coping with the Secure Boot revocations."

I did the MR update, then did the rescue media updates as I indicated above, then tested both rescue drives to make sure they booted. And that's all I have to say about that. (Forrest G.) No manual steps (May 9th) here.

Caledon Ken · Sep 4, 2023

Wisewiz said:
Took my cue from Bree in 574 above:
"If you have just rebuilt your WinRE boot media you will have unknowingly followed the steps to be ready for coping with the Secure Boot revocations."

I did the MR update, then did the rescue media updates as I indicated above, then tested both rescue drives to make sure they booted. And that's all I have to say about that. (Forrest G.) No manual steps (May 9th) here.

So you will still have to test once Windows enforces the change. Should be fine as you've done all the prep.

Caledon Ken · Sep 4, 2023

Ghot said:
Not that I know of. It was just a Win 11, Secure Boot thing.
See the Revocations link I added to my post just above.

For Win 11 folks... I did this... Revocations Management
Note: I use the Windows 11 PE (WADK) WIM, not the WinRE... when I build the bootable rescue media.

KB5025885 is for Windows 10 and 11.

Just a small screen shot from KB.

Wisewiz · Sep 4, 2023

Caledon Ken said:
So you will still have to test once Windows enforces the change.

Agreed. But I have all the confidence of the innocent and the ignorant. :zany:

Caledon Ken said:
Should be fine as you done all the prep.

Agreed. Emphasis on the word "should," however.

Ghot · Sep 4, 2023

Caledon Ken said:
KB5025885 is for Windows 10 and 11.

The other option of course... is to just disable Secure Boot in the BIOS.

Caledon Ken · Sep 4, 2023

Not really looking for a workaround but you're right it is an option.

@Bree could you post a link where you got the info that WinRe.wim has been updated and I can read. Thanks

Bree · Sep 4, 2023

Caledon Ken said:
@Bree could you post a link where you got the info that WinRe.wim has been updated and I can read. Thanks

Microsoft says so, and I tested that it had worked here:

,KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support says that for the Second Deployment Phase:

Updates for Windows released on or after July 11, 2023 which adds the following:

Allow easier, automated deployment of the revocation files (Code Integrity Boot policy and Secure Boot disallow list (DBX)).

New Event Log events will be available to report whether revocation deployment was successful or not.

SafeOS dynamic update package for Window Recovery Environment (WinRE).

Additional guidance for devices using Secure Boot to address CVE-2023-24932 - post #120

Wisewiz · Sep 4, 2023

Also, as noted in #540 above, Macrium confirms that it has been changed since Macrium's last update:

Caledon Ken · Sep 4, 2023

Thanks Bree. I was challenging you if that is how it came out. I just want to understand if they replaced Re Wim in 10. I have about forty clients using Macrium and did not want to embark on rebuilding media only to find that Win 10 has not been updated.

Wisewiz · Sep 4, 2023

@Caledon Ken

I'm going to butt in on this conversation that's primarily between you and Bree just long enough to suggest that since it is now clear that the Macrium people have their fingers on the pulse of these changes MS is making, and that Macrium is telling users who plug in their rescue media and hit the Rescue button whether their WIM has changed (and they need to rebuild their rescue media), it should suffice for you to open and update MR on one Win 10 machine, then plug in a rescue key and hit Rescue. The notice I posted above (#555) will appear if and only if the "WIM has changed since the last build." From that one machine, it should be possible to generalize to the other thirty-nine or so clients' machines. That's just my two cents' worth.

Caledon Ken · Sep 6, 2023

Wisewiz said:
@Caledon Ken

I'm going to butt in on this conversation that's primarily between you and Bree just long enough to suggest that since it is now clear that the Macrium people have their fingers on the pulse of these changes MS is making, and that Macrium is telling users who plug in their rescue media and hit the Rescue button whether their WIM has changed (and they need to rebuild their rescue media), it should suffice for you to open and update MR on one Win 10 machine, then plug in a rescue key and hit Rescue. The notice I posted above (#555) will appear if and only if the "WIM has changed since the last build." From that one machine, it should be possible to generalize to the other thirty-nine or so clients' machines. That's just my two cents' worth.

Thanks Wisewiz. I'm more a trust but verify kind of person, especially with this change.