Solved Latest Macrium Reflect updates

cereberus · Jun 1, 2023

CountMike said:
Yes you can.

Download Windows 11

That is not what I was saying.

Imagine I had a single downloader, and I named it W11Dev.exe, it would download Dev iso. If I named it W11Can.exe, it would download Can iso etc.

However, as MS do not provide downloaders like Reflect or individual Insider isos that often, it is a moot point.

CountMike · Jun 6, 2023

Just now

Bree · Jun 6, 2023

CountMike said:
Just now

Thank you, post #1 updated.

Josey Wales · Jun 6, 2023

I upgraded to this Version and then did a backup & went to eat breakfast, when I cam back I found that my machine restarted for some unknown reason due to Kernal Power??

Josey Wales · Jun 6, 2023

Just did another backup with no problems.

pietcorus2 · Jun 6, 2023

No changes reported for the bacup-media...............so, if using backup-ISO ( Ventoy ! ) only , update not necessary ! :wink:

MiguelAngel11 · Jun 6, 2023

Installed the latest Macrium updates (ver. 8.1.7544). Days ago I performed the revocations after quitting Insider Program with a Windows "in-place" installation.
Once done I updated the Macrium Boot Rescue Media and tested. Inside the Rescue Environment, checked the Windows Console version (22621.1702).
Also checked my UEFI settings and I had a lot of DBX hash entries.

Bottom line : All fine in the cold southern front.

cereberus · Jun 6, 2023

MiguelAngel11 said:
Installed the latest Macrium updates (ver. 8.1.7544). Days ago I performed the revocations after quitting Insider Program with a Windows "in-place" installation.
Once done I updated the Macrium Boot Rescue Media and tested. Inside the Rescue Environment, checked the Windows Console version (22621.1702).
Also checked my UEFI settings and I had a lot of DBX hash entries.

Bottom line : All fine in the cold southern front.

Was your Reflect build a WinRe or WinPe build?

Also is secure boot enabled?

MiguelAngel11 · Jun 6, 2023

cereberus said:
Was your Reflect build a WinRe or WinPe build?

Also is secure boot enabled?

Reflect boot media Windows RE build. With SB enabled. Also I checked my main's UEFI BIOS under Secure Boot options showed 389 hash codes into DBX entry

Bree · Sep 4, 2023

New build released. v8.1.7638 - 4th September 2023

See Post #1 for details.

CountMike · Sep 4, 2023

Ghot · Sep 4, 2023

Even if the slider is set to High Priority, it resets to one notch lower, every time a backup is started.
So... if nothing else, this update is important.

Bree · Sep 4, 2023

CountMike said:
.....

This time I beat you to the draw by a minute or so :wink:

Bree · Sep 4, 2023

Ghot said:
So... if nothing else, this update is important.

If you have just rebuilt your WinRE boot media you will have unknowingly followed the steps to be ready for coping with the Secure Boot revocations. If you prefer WinPE you'll need to download the updated PE 11 May 2023 WADK first....

Note: If you utilize the Macrium Reflect Download Agent to download a copy of the Windows PE 11 files that can be utilized offline, be sure to select the PE 11 (WADK) Rescue Components Only (May 2023) option.

Windows Security update for Secure Boot - Knowledgebase 8.0 - Macrium Reflect Knowledgebase

knowledgebase.macrium.com

Ghot · Sep 4, 2023

Bree said:
If you have just rebuilt your WinRE boot media you will have unknowingly followed the steps to be ready for coping with the Secure Boot revocations. If you prefer WinPE you'll need to download the updated PE 11 May 2023 WADK first....

Windows Security update for Secure Boot - Knowledgebase 8.0 - Macrium Reflect Knowledgebase

knowledgebase.macrium.com

Yeah... figured that out like three weeks ago.

I always do WinPE

KB5028254 breaks the Macrium bootable media.

Ok... w/o using Rapid Delta Restore... and restoring from bootable rescue media... .6635 ~1:55 .7544 3:14

www.elevenforum.com

Little tip for anyone else doing the Revocations cr*p... and you choose the WinPE... the directions say to remove the old ADK before you create the new bootable USB.
I found out, you also need to remove the old ADK (like in the directions), AND remove the old ADK stuff from the current bootable USB.
If you don't format the USB as FAT32 before you attempt rebuilding it.... it won't download the new ADK.

If WinPE... short version:

1. Format the USB as FAT32 first.
2. THEN follow the other directions.

jimbo45 · Sep 4, 2023

I might be septical here but isn't this whole thing for "Secure boot revocations" absolutely 100% -- no make that 100,000% over the top for the 99.99999% of domestic consumers just using Windows where most problems aren't evil N.Korean or Russian hackers wanting to raid "Mom and Pop" computers of €50 or so when actually what these hackers really want to do is break national / international infrastructure and load enterprise computers with ransomware. Domestic computer users are far more vulnerable to attack by basic simple scams.

If you make security too bonkers - people just get fed up with it and switch the whole thing off.

Cheers
jimbo

Ghot · Sep 4, 2023

jimbo45 said:
I might be skeptical here but isn't this whole thing for "Secure boot revocations" absolutely 100% -- no make that 100,000% over the top for the 99.99999% of domestic consumers just using Windows where most problems aren't evil N.Korean or Russian hackers wanting to raid "Mom and Pop" computers of €50 or so when actually what these hackers really want to do is break national / international infrastructure and load enterprise computers with ransomware. Domestic computer users are far more vulnerable to attack by basic simple scams.

If you make security too bonkers - people just get fed up with it and switch the whole thing off.

Cheers
jimbo

Agreed... 100%.
MS has gone off the deep end.

Btw... hilarious typo on the fourth word, skeptical.
Google septic tank.

Bree · Sep 4, 2023

jimbo45 said:
I might be septical here but isn't this whole thing for "Secure boot revocations" absolutely 100% -- no make that 100,000% over the top for the 99.99999% of domestic consumers just using Windows where most problems aren't evil N.Korean or Russian hackers wanting to raid "Mom and Pop" computers of €50 or so when actually what these hackers really want to do is break national / international infrastructure and load enterprise computers with ransomware. Domestic computer users are far more vulnerable to attack by basic simple scams.

If you make security too bonkers - people just get fed up with it and switch the whole thing off.

Yes, I agree. But they are going to be enforced anyway in 2024. Fortunately the second deployment stage has already updated the WinRE.wim on all our PCs, and MS have updated the Windows install ISOs, so anyone making new boot media from now on shouldn't see an issue. It's only old boot media that won't work without temporarily turning off secure boot.

Timing of updates

Updates are released as follows:

Initial Deployment This phase started with updates released on May 9, 2023, and provided basic mitigations with manual steps to enable those mitigations.

Second Deployment This phase started with updates released on July 11, 2023, which added simplified steps to enable the mitigations for the issue.

Third Deployment This phase will add additional boot manager mitigations. This phase will start no sooner than January 9, 2024.

Enforcement The final enforcement phase that will make the mitigations permanent. This phase will start no sooner than July 9, 2024.

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Ghot · Sep 4, 2023

Ghot said:
So... if nothing else, this update is important.

Well, I take that back.... this update didn't fix that problem.
When the priority is set to High... it still drops back to one notch lower on the next backup.