KB5034441 Security Update for Windows 10 (21H2 and 22H2) - Jan. 9 Win Update

falcon4fun said:

Pffff Prod with around 200 workstation. Don't even give a shit to fix this problem instead of Microsoft
They should freaking test their freaking updates before pushing to public. Or whatever I suppose to do? Ask L1-L2 to manually fix this? Nope

MS had to know that 99% of Windows 10 installs only setup a 500MB recovery partition. I know for a fact, during my install of W10 Home, I was never presented with an option during the setup to determine how to partition the drive(s). What do they think we are doing when installing Windows? Performing the steps like Linux? hehehe

So, the only thing to believe, is that MS pushed a patch they knew would fail and didn't care. Smells like sabotage to me.
Then asking inexperienced users (like grandmom and grandpop) to execute 15-20 commands to fix a disk partition to support the patch? That's a big ask. Shame on MS. And for the people who have successfully completed those steps and think it is easy for the majority of the MS community to do, is not fair. Man, I'm just using the MS platform to play games, email, browse internet, etc. Not perform mid and high level disk management commands.

Also I had the problem with installing Windows Update KB5034441 (Error 0x80070643).
This happened on all my PC's (all Windows 10 - 64 bit) due to:

• the Recovery partition being too small,
or
• a Recovery partition not being present on the PC,
or
• a Recovery partition being present but containing corrupted files.

Extending the present Recovery partition or creating a completely new one as explained in all the comments in this post resulted in successfully installing KB5034441.
Thanks to all for your contribution!


Please note that a missing Recovery partition not only prevents KB5034441 from being successfully installed, but also without a Recovery partition:
• a Windows Defender Offline-scan can not be executed (see here),
and
• not all the Advanced Startup Options (when the PC is restarted with the SHIFT-button pressed) are available (see here).


But, even without a Recovery partition, I've been able to successfully install KB5034441, and also get the Windows Defender Offline-scan and all Advanced Startup Options get work fine:
To achieve this, for my Windows 10 - 64 bit Professional I did the following:

• Restart the PC and log on as an Administrator.

• In Folder options, uncheck the setting "Hide protected operating system files".

• If not already available, create the Windows.iso via the MediaCreationTool.exe (download here).

• Now, right click on the Windows.iso, select Open with and then choose 7-Zip File Manager.

• In the 7-Zip-window, double click on the folder "Sources", then scroll down to the file install.esd.
Right click on this file install.esd and select Open. The file will be unpacked, and then a new 7-Zip-window opens.

• In the 7-Zip-window, double click on the folder 5 (which belongs to Windows 10 Professional, if you need another Windows version, see here), then browse to the folder Windows\System32\Recovery.
Double click on this folder Recovery to open it.
Select the 2 files ReAgent.xml and Winre.wim.

• With the 2 files selected, right click and then select Copy to…
In the Copy-window, browse to the path of your Desktop, then click OK.
After a while the 2 files are placed on the Desktop.

• Close the 7-Zip-window.

• Now, open the folder "C:\Windows\System32\Recovery" and drag and drop the 2 files from the Desktop into this folder (Overwrite file). Then close this window.

• Via e.g. MiniTool Partition Wizard delete (if you wish) the existing Recovery partition (to free up disk space).

• Open a cmd (run As administrator) and type:
reagentc /enable <enter> "REAGENTC.EXE: Operation Successful."
Close the cmd-window by typing:
exit <enter>

• In Folder options, check the setting "Hide protected operating system files" (if you wish).

• Ready.
Now test to see whether it all works:

 Restart the PC and verify via Windows Update that Windows Update KB5034441 will now successfully install (this will take a while).
 Verify that the Windows Defender Offline-scan works fine (see also here).
 Restart the PC with the SHIFT-button pressed, and verify that the PC will boot with all the Advanced Startup Options.(see also here).


As said, on all my PC's, above procedure works fine for me.
Hope it will on your PC too.

Regards,

Johan.

Johan99 said:

Also I had the problem with installing Windows Update KB5034441 (Error 0x80070643).


• Close the 7-Zip-window.

• Now, open the folder "C:\Windows\System32\Recovery" and drag and drop the 2 files from the Desktop into this folder (Overwrite file). Then close this window.

•

As said, on all my PC's, above procedure works fine for me.
Hope it will on your PC too.

Regards,

Johan.

Good for you, but do you really expect people to do this? Most people don't even know what 7-Zip is. They might think it is a new soft drink replacing 7-Up.

Pentagon said:

Select extend and leave 20477! That removes the unallocated part
When ready select Shrink Volume and type 1024!

I have a German Windows edition, so my translation is not always correct

Then
diskpart and the following commands from above #572

camelia said:

Lol ok I never read anything about KB5034441

And KB5034763 was installing without any issue

So am I a drama Queen and everything is OK, or I still have to do something?
Attachment 405554

Thanks
Came

Some people, possibly most people, can fail with KB5034441 and other updates keep on installing normally, but some others not, at least that's my suspicion. Among the latter would be Camelia and myself. I opened my thread here Cannot install January patches in a healthy W10 22H2 with the title "Cannot install January patches [...]", not only KB5034441. My complete suspicion is the following: in some systems, a failed KB5034441 attempt, breaks Windows Update and no more updates can be installed. KB5034441 is tried first, and quite possibly it fails with 0x80070643. After this, in some systems, the January and February updates fail too, with different codes. In the first post of the quoted thread, in January yet, the other January updates failed with 0x80070002.

I could go back in time thanks to an image backup (I use Macrium Reflect, there are other utilities of this kind; below there are other possible solutions if an image backup isn't available). After that, with WU paused still, I downloaded the other January patches from the Catalog and installed them more or less successfully, then I hid KB5034441 and un-paused WU. With it hidden still, I did the February patches successfully too, this time the normal way (no Catalog *.msu's). Then I decided to run (from an elevated prompt):

DISM.exe /Online /Cleanup-image /Restorehealth (took about 37 minutes)
sfc /scannow (took about 5 minutes)

(the above commands, afaik, could repair a KB5034441-damaged WU in theory)

sfc /scannow reported that it had found and repaired errors (so, likely, all my previous KB5034441 installing maneuvres had been with those errors or part of them in my system). I did an image backup. I'm now trying again other solutions and I have already failed with some. Due to the said suspicion, if I don't succeed I restore this image backup and try again, because I know that my system could do the February patches and KB5034441 is hidden in that saved state, with a failed KB5034441 Idk.

Try the following if you're having problems with patches in general:
https://support.microsoft.com/en-us/...c-89ce169755dd
https://support.microsoft.com/en-us/...8-32d177eb136c
Windows restore points saved
Windows 10 repair install, although this will lose some things like additional fonts or WiFi settings.

I finally chose to hide KB5034441 since I don't have a WinRE partition, so that security issue is not relevant. Also, I can have equal or better functionality than having the WinRE partition with a recovery USB drive with better tools.

"Finally" (I hope) I've installed the KB5034441-corresponding dynamic update: KB5034232, that can be downloaded from the catalog. It's a *.cab file that requires a semi-complex process to be installed. This route updates the recovery partition (specially the winre.wim file) but does not "register" anything new as installed in WU, neither KB5034441 nor KB5034232 nor anything else.

I've done this with KB5034441 hidden, and I'll keep it hidden until MS makes either a new KB5034441 which I might try, or a successor with a different KB number (in which case WU doesn't report the ancient version anymore afaik, so you could un-hide KB5034441 and WU won't bring it).

I don't use bitlocker. This dialog illustrates part of what is it used for. Why to patch WinRE? . Issue #2 . takondo/WinREupdate . GitHub

MS has done a PowerShell script to update WinRE this way https://support.microsoft.com/en-us/...5-7fc406910c10 . I haven't seen MS download links of it, but you can either copy-paste it from there or download it from a 3rd party source like GitHub - takondo/WinREupdate: Sample script to patch WinRE . I've managed to check that both are equal comparing with FC /W (*). Anyway I've succeded with the takondo's version.

I did exactly the following

1) Open "Windows PowerShell ISE" from the Start menu as Admin (I also have a "Windows Powerhell ISE (x86) that I didn't use).
2) Run "Get-ExecutionPolicy -List". All scopes are "Undefined". I've read that the default is not letting PS run scripts for security reasons.
3) Run "Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process" and "Get-ExecutionPolicy -List". Now the Scope "Process" is "Bypass". This means no/minimum checks during this PowerShell session.
4) Run "cd C:\Users\user_name\Downloads", as I put the script there, and for the case the KB5024232 .cab too, although MS gives an example where the latter is in a different place (a network share actually). The folders part, as you like or need.
5) Run ".\PatchWinREScript_2004plus.ps1 -packagePath .\windows10.0-kb5034232-x64_ff4651e9e031bad04f7fa645dc3dee1fe1435f38.cab". This is what does the main work. It lasted some few minutes.
6) Exit PowerShell and do checks.

The WinRE's main use here is doing Macrium Reflect Rescue Medias, I rebuilt one and works fine. I also clicked on Start Manu -> Shut down arrow -> Reboot while pressing Shift to check the Windows Recover available options and run "Dism /Get-ImageInfo /ImageFile: .... "

Code:

C:\Windows\system32>Dism /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE\winre.wim /index:1

Herramienta Administración y mantenimiento de imágenes de implementación
Versión: 10.0.19041.3636

Detalles de la imagen : \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE\winre.wim

Índice: 1
Nombre: Microsoft Windows Recovery Environment (x64)
Descripción: Microsoft Windows Recovery Environment (x64)
Tamaño: 2.292.951.894 bytes
WIM de arranque: No
Arquitectura: x64
Hal: <sin definir>
Versión: 10.0.19041
Compilación del Service Pack: 3920
Nivel de Service Pack: 0
Edición: WindowsPE
Instalación: WindowsPE
Tipo de producto: WinNT
Conjunto de productos:
Raíz del sistema: WINDOWS
Directorios: 3656
Archivos: 16554
Fecha de creación: 07/12/2019 - 14:44:10
Fecha de modificación: 20/02/2024 - 11:56:29
Idiomas:
        es-ES (predeterminado)
La operación se completó correctamente.

C:\Windows\system32>

Build Service Pack is 3920 as it should.

(*) This part isn't simple. As editor I've only used notepad.exe , the one that comes with Windows. First I tried to put the copy-pasted version like takondo's (which I never altered) adding and deleting empty lines, spaces and tabs (but never joining two separated items; I used two exactly-overlapping Windows for both files, and the mouse in the taskbar for visually comparing each section), intending to compare with just "FC" (not "FC /W"). I succeeded with the heading spaces and tabs from each line and with the empty lines, but takondo's has several ("many", actually) trailing ones and "empty" lines that actually have tabs and possibly spaces. Afterwards I recalled that FC has a switch for cases like this and I got a "both equal" result with FC /W. At first I thought that FC /W doesn't ignore empty lines, for instance it would compare these different

a.txt
------------------------------
hello bye
bye hello


b.txt
------------------------------
hello bye

bye hello


but it compares them equal. Then I thought: "the initial copy-pasted version would also compare equal to takondo's with /W". But it compares different, with all kinds of strange/buggy differences. I did another copy-paste, same result, same concrete (and seemingly false) differences reported. Possibly FC /W can be "overbuffered" or something, but in conclusion:

1) A copy-pasted MS and partially treated version (in terms of empty lines and tabs/spaces) to look exactly as takondo's version in Windows' Notepad, turned out equal for FC /W.

2) Takondo's version worked fine.