Overwhelmed - Macrium Reflect

jimbo45 said:

... there should ALWAYS be mechanisms within the regular OS for facilities to perform these basic requirements.

Click to expand...

Still works for me..., Canary Build!

Statistics show that well over half of all computer users don't even do backups.

Large market potential

Still can't make this work

Background - clean install of 25H2 26200.8037; KB5089549 applied; Windows now 26200.8457.

Checked WinSxS for driversipolicy.p7b, 2x found :
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8036_none_5025a1cd93f54e0a\file driversipolicy.p7b, date 6 Mar 2026, size 229,162 bytes
and
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8457_none_4ffc4be994140a1d\file driversipolicy.p7b, date 9 Jun 2026, size 242,130 bytes

Reflect 8 mount image fails due to psmounterx.sys blocked (as expected).

Ran Rollback-VulnerableDriverPolicy.bat. This completed RESTART WINDOWS NOW.

Rebooted - Windows failed to load, going instead to Performing Automatic Repair > Diagnosing your device > Your device ran into a problem and couldn't be repaired.

I eventually went via a Start-up Settings reboot to select 7 Disable Driver Signature Enforcement which did allow Windows to boot okay and Desktop Reflect 8 was then able to mount images.

The problem is that the next reboot re-enables Driver Signature Enforcement and I'm back to square one with Automatic Repair etc etc.

Am I doing something wrong ...?

@S1lent_Azrael, post #138
After running the bat file the computer had to go through 2-stage (automatic) repair
after I pressed F8 just before the final repair stage. After the second stage repair
we ran the bat again and it said it is on previous (older) version of
driversipolicy.p7b (1301)

Click to expand...

This sounds like what I should be doing, but I don't understand step-by-step exactly what he is doing.
Can you / @S1lent_Azrael / anyone explain his method more clearly please? Thanks

thehod said:

This sounds like what I should be doing, but I don't understand step-by-step exactly what he is doing.
Can you / anyone explain his method more clearly please? Thanks

Click to expand...

Why not try my approach.

Thank you @psyclopse. I've never tried anything viBoot / vhdx / Hyper-V so I'm completely in the dark - for now - I'll sit down, learn , and give it a try.
That said, the ideal state would be 'it just works' so if anyone can enlighten me on how @AzRaEL does what he does, that also would be a great help !

thehod said:

Still can't make this work

Background - clean install of 25H2 26200.8037; KB5089549 applied; Windows now 26200.8457.

Checked WinSxS for driversipolicy.p7b, 2x found :
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8036_none_5025a1cd93f54e0a\file driversipolicy.p7b, date 6 Mar 2026, size 229,162 bytes
and
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8457_none_4ffc4be994140a1d\file driversipolicy.p7b, date 9 Jun 2026, size 242,130 bytes

Reflect 8 mount image fails due to psmounterx.sys blocked (as expected).

Ran Rollback-VulnerableDriverPolicy.bat. This completed RESTART WINDOWS NOW.

Rebooted - Windows failed to load, going instead to Performing Automatic Repair > Diagnosing your device > Your device ran into a problem and couldn't be repaired.

I eventually went via a Start-up Settings reboot to select 7 Disable Driver Signature Enforcement which did allow Windows to boot okay and Desktop Reflect 8 was then able to mount images.

The problem is that the next reboot re-enables Driver Signature Enforcement and I'm back to square one with Automatic Repair etc etc.

Am I doing something wrong ...?



This sounds like what I should be doing, but I don't understand step-by-step exactly what he is doing.
Can you / @S1lent_Azrael / anyone explain his method more clearly please? Thanks

Click to expand...

I'm not sure if it helps you or not, but I just tried running the Rollback-VulnerableDriverPolicy.bat in a Windows 11 25H2 virtual machine with the June MS updates applied.

It seemed to work o.k., at least superficially. (I didn't actually have Reflect installed to fully test things).

I ran it from an command prompt (launched with 'run as administrator') and it reported going back to version .8115. Did a normal 'restart' reboot and things seemed to boot normally.

I then repeated the procedure except using the "-restore" option. It reported going back to version .8655. A normal 'restart' again seemed to come up without issue.

Have you tried to check for system file corruption (from an administrator command line prompt when things are 'normal') with

Dism /Online /Cleanup-Image /CheckHealth

Dism /Online /Cleanup-Image /ScanHealth

and

sfc /scannow

to see if it reports any issues?

Some of this is mentioned in the MS article at


(Note that if sounds as though running sfc would likely undo the psmounter change if it was in effect at the time).

thehod said:

Still can't make this work

Background - clean install of 25H2 26200.8037; KB5089549 applied; Windows now 26200.8457.

Checked WinSxS for driversipolicy.p7b, 2x found :
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8036_none_5025a1cd93f54e0a\file driversipolicy.p7b, date 6 Mar 2026, size 229,162 bytes
and
\amd64_microsoft-windows-c..egrity-driverpolicy_31bf3856ad364e35_10.0.26100.8457_none_4ffc4be994140a1d\file driversipolicy.p7b, date 9 Jun 2026, size 242,130 bytes

Reflect 8 mount image fails due to psmounterx.sys blocked (as expected).

Ran Rollback-VulnerableDriverPolicy.bat. This completed RESTART WINDOWS NOW.

Rebooted - Windows failed to load, going instead to Performing Automatic Repair > Diagnosing your device > Your device ran into a problem and couldn't be repaired.

I eventually went via a Start-up Settings reboot to select 7 Disable Driver Signature Enforcement which did allow Windows to boot okay and Desktop Reflect 8 was then able to mount images.

The problem is that the next reboot re-enables Driver Signature Enforcement and I'm back to square one with Automatic Repair etc etc.

Am I doing something wrong ...?



This sounds like what I should be doing, but I don't understand step-by-step exactly what he is doing.
Can you / @S1lent_Azrael / anyone explain his method more clearly please? Thanks

Click to expand...

you need to re-run the .bat since after performing automatic repair you will end up with the latest driversipolicy.p7b file.
Difference fom re-running will be, this time you will not have problem booting up and can then start a back-up with the previous driversipolicy.p7b file

Thank you @MysteryGuy and @S1lent_Azrael (and again @psyclopse)

Azrael said:

you need to re-run the .bat since after performing automatic repair you will end up with the latest driversipolicy.p7b file.
Difference fom re-running will be, this time you will not have problem booting up and can then start a back-up with the previous driversipolicy.p7b file

Click to expand...

As I said, my problem is that Automatic Repair does not complete; Diagnosing your PC fails "..couldn't be repaired."

Further to my post at #264, this could well be because the hardware is quite old, so I did a Rufus boot USB to remove TPM2 and Secure Boot requirements for the Win11 25H2 build 8037 install (perhaps I should have said so earlier... ). The install has the older driversipolicy.p7b in WinSxS but, as the PC is now at build 8457, I'm guessing that's why Automatic Repair fails...?

MysteryGuy said:

I'm not sure if it helps you or not, but I just tried running the Rollback-VulnerableDriverPolicy.bat in a Windows 11 25H2 virtual machine with the June MS updates applied.

It seemed to work o.k., at least superficially. (I didn't actually have Reflect installed to fully test things).

I ran it from an command prompt (launched with 'run as administrator') and it reported going back to version .8115. Did a normal 'restart' reboot and things seemed to boot normally.

Click to expand...

In the end, I decided to create a 25H2 8037 VM using Hyper-V (so as to avoid any need for the rollback batch) and then installed Macrium Reflect 8 into that VM. Mounts images without any problem. Win11 VM create/install on old hardware needed a bit of back-and-forth plus a smidge of Regedit + CMD, but it worked. VM has no network BTW ( so Windows Update can't mess it up for me ! )

Makes me wonder - if I only want a VM to mount Reflect images, would a Win7 VM work just as well ? It would be smaller and maybe quicker too.

@psyclopse - I watched your video Macrium reflect free - cannot mount image after upgrade a few times before I got it. I don't yet know how to see other hard drives (physical, not virtual) from a ViBoot VM, but I'll give it a try when I get a chance.

My thanks to you all

thehod said:

Makes me wonder - if I only want a VM to mount Reflect images, would a Win7 VM work just as well ? It would be smaller and maybe quicker too.

Click to expand...

Many other users have taken this approach to circumvent the problem and it works well... not sure about quicker

I was tinkering and discovered something that may be obvious to others but was a surprise to me. I never realized I could simply turn off Memory Intergity in Windows Security which then allowed me to switch off Microsoft Vulnerable Driver Blocklist. Off course that come with it's own implications and requires a reboot for it to apply, but seems like an easy way to gain access to browsing saved images. Turning Memory Integrity back on is one click and a reboot which turns on the Microsoft Vulnerable Driver Blocklist on its own and locks it by greying out the switch.

Thanks @Dirtyflash . I had also seen that somewhere but forgot it until now. I now also recall another member posting about the potential security risk, but if you switch off Core Isolation, then reboot offline, would that avoid any risk? (I'm not clear on the implications, but if you don't use any other programs until you turn it back on and reboot, is there actually a potential/credible risk?)

thehod said:

Thanks @Dirtyflash . I had also seen that somewhere but forgot it until now. I now also recall another member posting about the potential security risk, but if you switch off Core Isolation, then reboot offline, would that avoid any risk? (I'm not clear on the implications, but if you don't use any other programs until you turn it back on and reboot, is there actually a potential/credible risk?)

Click to expand...

I'll have to admit it has always been turned off on one of my devices, just thought it odd that I could browse images on one device but not the other. To your question, I guess everyone's situation is different, but looking at mine where I've always had one device with Core Isolation off and not suffered any consequences might suggest it's okay. It's like a lot of stuff that you read online, if you're paranoid you turn every security feature on.

I restored older image with secure boot off, when I tried to reboot, it was a no go..
Thought maybe the image went bad so I tried another one it failed too. Glad I had a image
I made today handy, restored it computer booted fine with secure boot enabled

man00 said:

I restored older image with secure boot off, when I tried to reboot, it was a no go..
Thought maybe the image went bad so I tried another one it failed too. Glad I had a image
I made today handy, restored it computer booted fine with secure boot enabled

Click to expand...

Do you mean the fails were images made when secure boot was off, or secure boot was off when you tried the restores? I'm guessing the latter - or am I just confused...?

If you restored an older backup, the image may be using the older CA 2011 boot files. In that case, keep Secure Boot disabled and boot normally.

1. Run the following commands to replace the boot manager:

2. Now re-enable Secure Boot mode.

There are possibly two separate problems to solve with Secure Boot:

Depending on your circumstances, both, one, or none of those conditions apply to you.