Fixlet to resolve WinRE Partition size (Win10/11/etc)

Can we get HCL to release a fixlet that solves the WinRE size issue? MS released an official PowerShell script that accomplishes this task if run manually, but having one that has relevance associated with it would be extremely useful for getting large amounts of machines fixed via BigFix Patch would be amazing!

Here is a link to the Official MS PowerShell Script Article:
https://support.microsoft.com/en-us/topic/kb5034957-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2024-20666-0190331b-1ca3-42d8-8a55-7fc406910c10

1 Like

How do you determine that WinRE has the size issue? Is there a command you would run to make that determination? Is it in WMI, the registry, or elsewhere? or can you just inspect a file?

I’m not sure of the best way to write the relevance without knowing what I’m looking for.

Does this situation seem related to this? Help with disk analysis

they changed the size requirement of that partition, so you’d check for that partition size to be less than the new size, I imagine the PowerShell Script has some of those details in it

1 Like

no those are not related

The WinRE partition is part of the OS drive but does not have a specific drive letter and would not be an “offline” disk, or the OS wouldn’t boot at all

1 Like

Here is an example disk and the recovery partition (WinRE) is highlighted
image

it has a specific Partition Type ID

Is that a good one or a bad one? What is the incorrect state we are trying to resolve and what is the corrected state?

There does seem to be a breadcrumb left behind by the script that could be detected:

$value = Get-ItemProperty -Path HKLM:\Software\Microsoft\PushButtonReset -Name WinREPathScriptSucceed

This should be the correct relevance to determine if the script has run successfully or not:

not exists (it as string as integer) whose(it = 1) of values "WinREPathScriptSucceed" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PushButtonReset" of (x64 registries; x32 registries)

That said, I see in the script where it looks to see if that value is set and if not then it doesn’t run.

The size of that partition is the issue we want to solve, I had to follow the procedure for my home PC in order for the bitlocker patch to install successfully…so the condition for relevance would be partition size there is a new minimum size that partition needs to be, here are the manual instructions

https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf

Right, but what is an example of a value that is too small? what is the new minimum that we want to check is in place? What are example values that are not correct and what are example values that are correct??

I’m pretty sure that WMI will be required to get the values needed to detect this condition unless you can just inspect the WIM file size itself… but I don’t think that would be reliable.

This relevance only works on drives that are mounted with drive letters: total spaces of drives

The following article discusses additional space requirements based on Win OS releases:

The common denominator that would solve the issue regardless of OS build releases would be to add 320MB of space, which is the largest requirement listed.

commonly this partition is between 500 and 700MB depending on options and language, making that partition 1GB would literally solve the issue across the board.

The Caveat is that you’d have to shrink C:\ partition by x amount and this would require a disk space check to occur first, and a failure if there is not enough space on C:\ to achieve the outcome

“For Windows operating systems later than Windows 10, version 2004 or Windows Server 2022, the partition must have at least 200 MB of free space.”

So it isn’t the total size that matters, it is how much free space is required.

It seems like the right way to fix it would be to run the powershell script provided by microsoft, and that is reasonable.

1 Like

I just got done looking through the powershell script MS created for this, it does not modify the partition size, apparently they have a package that is used to patch the system without modifying the WinRE size at all, so perhaps a fixlet that prefetches the package and then is able to perform the update on the system without the modification

Would need to have the correct relevance to download whichever of these are required for the OS it is running on: https://www.catalog.update.microsoft.com/Search.aspx?q=Safe%20OS%202024-01

That is correct Sir!

Fixlets were released.

1 Like