System will not boot and GSODs

Almighty1 · Aug 27, 2024

I tried earlier to implement the following:

KB5042562 Guidance for blocking rollback of Virtualization-based Security (VBS) related security updates

Microsoft Support: Summary Microsoft was made aware of a vulnerability in Windows that allows an attacker with administrator privileges to replace updated Windows system files that have older versions, opening the door for an attacker to reintroduce vulnerabilities to Virtualization-based...

www.elevenforum.com

using KB5041876 Windows 11 Insider Beta build 22635.4082 (23H2) - Aug. 26.

Except the problem is the system will not boot and GSOD's as follows:

Anyways, I forgot to update my WinRE as I missed this part so the automatic repair doesn't work:

Windows Recovery Environment. The Windows Recovery Environment (WinRE) on the device must be updated with the Windows updates dated on or after August 13, 2024 before the SkuSipolicy.p7b is applied to the device. Omitting this step might prevent WinRE from running the Reset PC feature. For more information, see Add an update package to Windows RE.

So is there a way to use a USB Flash Drive to update the Windows Recovery Environment (WinRE) because the fix is to:

1) Run the following commands from an elevated Windows PowerShell prompt:

Code:

# Initialize policy location
$PolicyBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b"
# Remove SiPolicy.p7b
Remove-Item -Path $PolicyBinary -force

2) Reboot
3) Turn off Secure Boot in BIOS
4) Run the following from an elevated Windows PowerShell prompt:

Code:

$PolicyBinary = $env:windir+"\System32\SecureBootUpdates\SkuSiPolicy.p7b"
$MountPoint = 'C:\EFIMount'
$EFIPolicyPath = "$MountPoint\EFI\Microsoft\Boot\SkuSiPolicy.p7b"
$EFIDestinationFolder="$MountPoint\EFI\Microsoft\Boot"
$EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0]
if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force }
mountvol $MountPoint $EFIPartition
if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force }
if (Test-Path   $EFIPolicyPath ) {Remove-Item -Path $EFIPolicyPath -Force }
mountvol $MountPoint /D

5) Turn on Secure Boot in BIOS and reboot

The question is what can I use to boot into Windows on a USB flash drive so I can actually do the above as it seems like basically I have to delete the files mentioned above manually to fix it.

Thanks!

Fabler2 · Aug 27, 2024

This, Open Command Prompt at Boot in Windows 10 , or Macrium recovery USB . Never used Hiren's USB though.

Edit,

Fabler2 · Aug 27, 2024

I've never actually thought of having Hiren's boot PE as a standby tool before but might be worth having it, you know, just in case. Then again I image my drive.

Download | Hiren's BootCD PE

Ghot · Aug 27, 2024

Fabler2 said:
or Macrium recovery USB

Yep, yep...

Almighty1 · Aug 27, 2024

@Fabler2 - Is the screenshot you showed above basically the Windows ISO as when I looked at the Open Command Prompt at Boot in Windows 10 - it appears it's just booting with the Windows ISO which is basically this:

Create Windows 11 Bootable USB Installation Media Tutorial

This tutorial will show you how to create a bootable USB flash drive used to install Windows 11 with UEFI support. You can use a Windows 11 installation USB flash drive to clean install, upgrade, reset, or repair Windows 11. The installation USB can also be used as a recovery drive to boot to...

www.elevenforum.com

In my case, isn't the UEFI actually the BIOS itself and not the SSD since it appears to be the SkuSiPolicy.p7b according to MS's article that is the one causing the issue.

For the Macrium Recovery USB, would there be a problem if it was created from a different machine with different hardware? Thanks @Ghot for the screenshot. I am reading this thread:

Macrium Reflect USB Rescue Media.

Hi, After having to do a Clean Install of Windows 11, I have just bought Macrium Reflect 8.1 and have made System Images of our 4 devices. Two are Windows 10 and two Windows 11. I'm not sure if I need to make USB bootable Rescue Media in case Windows will not boot? If so, do I need to create...

www.elevenforum.com

I probably need to pickup some USB Flash Drives as well, what size is needed as a minimum for the latest Windows 11 ISO or for things like Hiren's boot PE or Macrium Recovery USB? Is there a issue if the capacity of the USB Flash Drive is larger than a certain size?

Fabler2 · Aug 27, 2024

Almighty1 said:
@Fabler2 - Is the screenshot you showed above basically the Windows ISO as when I looked at the Open Command Prompt at Boot in Windows 10 - it appears it's just booting with the Windows ISO?

In my case, isn't the UEFI actually the BIOS itself and not the SSD since it appears to be the SkuSiPolicy.p7b according to MS's article that is the one causing the issue.

For the Macrium Recovery USB, would there be a problem if it was created from a different machine with different hardware? Thanks @Ghot for the screenshot. I am reading this thread:

Macrium Reflect USB Rescue Media.

Hi, After having to do a Clean Install of Windows 11, I have just bought Macrium Reflect 8.1 and have made System Images of our 4 devices. Two are Windows 10 and two Windows 11. I'm not sure if I need to make USB bootable Rescue Media in case Windows will not boot? If so, do I need to create...

www.elevenforum.com

I probably need to pickup some USB Flash Drives as well, what size is needed as a minimum for the latest Windows 11 ISO or for things like Hiren's boot PE or Macrium Recovery USB? Is there a issue if the capacity of the USB Flash Drive is larger than a certain size?

I should have really posted this link and nto be in such a hurry at times

, @Brink 's excellent tut,

Open Command Prompt at Boot in Windows 11 Tutorial

This tutorial will show you how to open an elevated command prompt at boot in Windows 11. The Command shell is an entry point for typing commands in the Command Prompt console window. By typing commands at the command prompt, you can perform tasks on your computer without using the Windows GUI...

www.elevenforum.com

USB flash drives are so cheap today I always buy 16 GB drives as the norm for these things. As for Macrium USB I partition it to Macrium on first partition (small fat 32) and data on the second partition (NTFS). Handy if you need to save a screen shot when booted to Macrium's recovery USB.

Edit, you can create any of these recovery isos from another PC.

Almighty1 · Aug 27, 2024

@Fabler2 - Thanks for the prompt response. Would there be problems going with something bigger than 32GB USB Flash Drives?

Never done partitions on USB Flash Drives before.

Ghot · Aug 27, 2024

Almighty1 said:
would there be a problem if it was created from a different machine with different hardware?

I've never tried it, but as long as it's a Windows computer, it should be OK.

Almighty1 · Aug 27, 2024

It seems like the way to update the Windows Recovery Environment is:

Add an update to Windows RE

Add an update package to Windows RE.

learn.microsoft.com

@Brink probaly has a better tutorial on this too.

Wonder if this can be done using one of the methods mentioned above.

Fabler2 · Aug 27, 2024

I use Minitool as it's easy and I'm lazy... here's an example of partitioned Flash drive,

Almighty1 · Aug 27, 2024

@Fabler2 - Thanks, what I meant was I thought with Macrium Recovery USB or Hiren's boot PE, aren't both of these ISO's that gets flashed to the USB Flash Drives as one partition so do I basically flash the ISO first and then use Minitool to create the NTFS partition using the remaining available space?

Fabler2 · Aug 27, 2024

With Minitool I first wipe the USB to unallocated space. With Minitool create a 2GB ish Fat 32 partition for Macrium then using that partition to create the recovery drive. It wont see the rest of the drive.
Then I use Minitool to create the NTFS partition on the unallocated space left on the drive.

Almighty1 · Aug 27, 2024

Thanks @Fabler2 - I think I understand how it works now. Macrium or Hiren's basically gets written to the assigned drive letter instead of a physical drive as a whole which is why it works that way. Haven't written ISOs other than burning CD's which was 15+ years ago. All the current ISOs, I always just mount it.

Fabler2 · Aug 27, 2024

Macrium creates it's own bootable USB, the others you can use Rufus.

Fabler2 · Aug 27, 2024

Almighty1 · Sep 4, 2024

Thanks @Fabler2 and @Ghot for the tips and pointers... I actually fixed this last week on the next day. I will give a quick summary.
The fix was simple:

1) Turn off Secure Boot in BIOS
2) Boot with a USB Flash Drive by hitting F12 to get to the boot menu which in my case was 128GB Sandisk USB-A and USB-C Dual Connector that had Ventoy 1.0.99 with the entire 128GB as a exfat partition and added the following as images:
Hiren's BootCD PE x64 (v1.0.8)
Macrium Rescue ISO Image created as follows:

TuxPE v10.2 WinPE

My Touchpad was not usable in Macrium Rescue but works fine in Hiren's BootCD PE x64 (v1.0.8) as well as TuxPE v10.2 WinPE
3) Opened Administrator Command Prompt and then ran Powershell from there.
This script was useless as the commands were complaining one way or another...

Code:

$PolicyBinary = $env:windir+"\System32\SecureBootUpdates\SkuSiPolicy.p7b"
$MountPoint = 'C:\EFIMount'
$EFIPolicyPath = "$MountPoint\EFI\Microsoft\Boot\SkuSiPolicy.p7b"
$EFIDestinationFolder="$MountPoint\EFI\Microsoft\Boot"
$EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0]
if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force }
mountvol $MountPoint $EFIPartition
if (-Not (Test-Path $EFIDestinationFolder)) { New-Item -Path $EFIDestinationFolder -Type Directory -Force }
if (Test-Path $EFIPolicyPath ) {Remove-Item -Path $EFIPolicyPath -Force }
mountvol $MountPoint /D

It was easier to just:

Code:

mountvol s: /s
del s:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

After this, I rebooted, went into the BIOS to turn Secure Boot back on and then Reboot.

And Windows 11 works again.

The correct way to verify the version of WinRE, when it was updated and also update it is in this thread:

Is my winre.wim the latest?

How can I find the latest available Windows Recovery Environment image? The winre.wim I have is Version : 10.0.22621 ServicePack Build : 3518 ServicePack Level : 0 Which, I think, is from November 2022. Is there a later version?

www.elevenforum.com

I will attempt to do that when I have more time.