Solved Unable to create a pagefile when installing Win 11 to boot from a VHDX

hsehestedt · Jul 23, 2022

I have the following configuration:

Laptop with a single SSD, BitLocker encrypted.

I want to install a second copy of Windows for testing, natively booting from a VHDX. Because C: is BitLocker encrypted, I cannot install Windows to a VHDX on this drive, so I attach an external NVMe in a USB enclosure.

Here is the tricky part: This second instance of Windows also needs to be BitLocker encrypted. To accomplish this I follow these steps:

I enable BitLocker on the external NVMe, create a VHDX and deploy Windows to it.

Now, when I boot, if I select the 2nd instance of Windows I supply the BitLocker password for that volume and Windows boots.

Here is the one tiny glitch that I have: When I logon to that second instance of Windows I always get a "Performance Options" dialog that is a result of Windows not being able to create a pagefile anywhere.

So all of this is leading to this question: How can I create a pagefile for this second instance of Windows in this scenario?

cereberus · Jul 23, 2022

hsehestedt said:
I have the following configuration:

Laptop with a single SSD, BitLocker encrypted.

I want to install a second copy of Windows for testing, natively booting from a VHDX. Because C: is BitLocker encrypted, I cannot install Windows to a VHDX on this drive, so I attach an external NVMe in a USB enclosure.

Here is the tricky part: This second instance of Windows also needs to be BitLocker encrypted. To accomplish this I follow these steps:

I enable BitLocker on the external NVMe, create a VHDX and deploy Windows to it.

Now, when I boot, if I select the 2nd instance of Windows I supply the BitLocker password for that volume and Windows boots.

Here is the one tiny glitch that I have: When I logon to that second instance of Windows I always get a "Performance Options" dialog that is a result of Windows not being able to create a pagefile anywhere.

So all of this is leading to this question: How can I create a pagefile for this second instance of Windows in this scenario?

The problem is you cannot create a page file inside a vhdx file when it is native booting, and it has nowhere to create one as host drive is bitlocked.

You could try setting the pagefile to reside on external nvme using its drive letter (not vhdx drive letter) but I am not sure that would work. It might as nmve counts as a fixed hard drive, not a removable hard drive.

If not, you would probably have to create a unbitlocked partition on host drive to contain pagefile.

You could try this:

1) boot to Host OS, remove bitlocker, shrink C drive by say 10 GB, create a new partition e.g. F:

2) Rebitlock C drive but not F drive.

3) The boot from native vhdx file and set a Pagefile on F drive (note drive letter may be different for new pagefile partition when booting fron vdhx).

4) Reboot into vhdx file, and you should now have a pagefile on drive F.

hsehestedt · Jul 23, 2022

cereberus, I guess great minds think alike. And so do we :)

Windows is installing right now, and I'm basically doing exactly what you suggested. I reformatted the external NVMe, creating one large partition and a smaller partition that I am not encrypting for the purpose of creating a pagefile.

However, I have to wonder what security hole I am opening by having the pagefile on a partition that is not encrypted.

cereberus · Jul 23, 2022

hsehestedt said:
cereberus, I guess great minds think alike. And so do we :)

Windows is installing right now, and I'm basically doing exactly what you suggested. I reformatted the external NVMe, creating one large partition and a smaller partition that I am not encrypting for the purpose of creating a pagefile.

However, I have to wonder what security hole I am opening by having the pagefile on a partition that is not encrypted.

You are correct - there is theoretically a security risk, so if somebody got hold of pc, in theory, they can recover data from it. However, you can set Windows to delete the pagefile on shutdown.

How to Automatically Delete Pagefile.sys on Shutdown in Windows 10

Pagefile.sys can us a lot of storage space on your hard disk. Here's a way for it to automatically delete the pagefile.sys file on shutdown in Windows 10.

www.maketecheasier.com

I do not know if you could bitlock the pagefile partition after creating it - if it did work, I think you would have to enter a password for that drive as well.

I would be interested to know if creating pagefile on nvme works - I am pretty certain it will work on internal drive as I do it like that for different reasons.

As an aside, couldn't you just bitlock the vhdx C drive and leave nvme host partition unbitlocked, then you would not need a second partition on nvme. Also, I think you would not need a password, as the vhdx password would be held in your TPM.

hsehestedt · Jul 23, 2022

cereberus said:
As an aside, couldn't you just bitlock the vhdx C drive and leave nvme host partition unbitlocked, then you would not need a second partition on nvme. Also, I think you would not need a password, as the vhdx password would be held in your TPM.

Okay, I've completed my initial testing....

First, no, When I installed to a VHDX on the NVMe, it wouldn't allow me to use the TPM to BitLock the Windows drive on the external NVMe. Device Manager sees the TPM, but it specifically forbids using it.

However, it did allow me to place the pagefile on a second partition on my external NVMe. I setup the registry entry that deletes the pagefile upon shutting down Windows. Actually, it's more accurate to say that it overwrites the pagefile because you will still find the pagefile there after shutting down Windows.

For my purposes, this is more than good enough, but it might be worth noting for those who are especially paranoid, that while Windows is running data in that pagefile could be potentially accessed, so it's not a good idea to leave that instance of Windows running where someone might have physical access while it is running.

Next Steps

I have no real practical need for this, this is merely an exercise in "can this be done", but I want to try this on a thumb drive. I already know that I can install Windows and boot it from a thumb drive. The only part that I have not tried is to see if I can put the pagefile on a second partition on the thumb drive. I HIGHLY doubt that this would work, but it's just one of those experiments that I feel like I need to try. Don't know if I will still pursue this today, but I'll post my results here once I have tried it

hsehestedt · Jul 23, 2022

Wow, unexpected results - in a good way.

I was able to install Windows to a BitLocker encrypted partition on a thumb drive AND place the pagefile on another unencrypted partition on that same thumb drive.

Would I want to run like that on a regular basis? Heck no, but it is interesting to know that it can be done.

cereberus · Jul 24, 2022

hsehestedt said:
Wow, unexpected results - in a good way.

I was able to install Windows to a BitLocker encrypted partition on a thumb drive AND place the pagefile on another unencrypted partition on that same thumb drive.

Would I want to run like that on a regular basis? Heck no, but it is interesting to know that it can be done.

That is a surprise but I doubt it is a great idea as usb flash drives are not reliable and thrashing it with pagefiles (or hibernation files?) will probably lead to early drive failure?

hsehestedt · Jul 24, 2022

cereberus said:
That is a surprise but I doubt it is a great idea as usb flash drives are not reliable and thrashing it with pagefiles (or hibernation files?) will probably lead to early drive failure?

Agreed. As noted, this was more an exercise to see if it was possible. It's just one of those things where one day I may say "Here, hold my beer...".