Recovery Environment Windows Recovery Environment (WinRE)
it is a minimal image-based OS Windows Preinstallation Environment (WinPE)
, which includes a number of tools for diagnosing and repairing Windows. If Windows does not boot, the BCD bootloader will attempt to launch the WinRE recovery environment, which may fix issues automatically or provide access to recovery tools. From WinRE, you can fix the bootloader configuration, restore the OS from an image backup, roll back to a restore point, run a command line, and so on.
The Windows RE environment consists of 3 three files that are located on a separate hidden Recovery Partition (in older versions of Windows, the partition was called System Reserved
):
- winre.wim
– WIM image with WinPE environment, which integrates additional utilities for Windows recovery; - boot
.sdi
– SDI (System Deployment Image) file used to create RAM disk
WinRE in memory; - ReAgent
.xml
– WindowsRE configuration file.
In this article, we’ll show you how to boot Windows into Recovery Environment and how to recreate WinRE if it doesn’t work.
Before i am told just do it in bios
the issue is this, the computer is connected to a PXE server and when all the machines were legacy bios, i could just disable the disk and reimage the machine. Disable reboot. Machine will boot and install a fresh OS. So i don’t want to be walking to these 1000s of machines pressing bios buttons and such. Needs to be automated. Hard disk is first, when disabled it boots to USB.
Question
When using a legacy bios,
- Disk
- Usb
- Network
Then when you can disable the disk with
diskpart and mark as inactive.
On UEFI bios this doesn’t work
_________ my understanding of the issue
__________
This is because on a uefi machine windows is using a Bootmgr
This is because it is using a Windows Boot Manager
bcdedit /enum
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume1
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
resumeobject {f665eab4-5d61-11e7-b384-e1075a4080e3}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
I have had numerous attempts at disabling this.
This is what I have tried.
bcdedit /deletevalue
This was to delete device partition=c
I have tried it on osdevice
I have tried
bcdedit /delete {...}
this was to delete my current boot entry.
Any of these doesn’t lead to the required results and just leads to either the OS not booting, or attempting to recover itself.
How do I disable the boot store, and have the computer boot from a USB
On some Unified Extensible Firmware Interface (UEFI)-based computers, the firmware creates non-volatile random access memory (NVRAM) entries for local devices, such as a CD-ROM or hard disk drive when the computer boots. synchronizes the firmware namespace objects in NVRAM with the system boot configuration data (BCD). opens the system BCD store when you perform a or command. When opens the BCD, it compares entries in NVRAM with entries in BCD. Entries in NVRAM that were created by the firmware that do not exist in BCD are added to the system BCD. When closes the system BCD, any boot manager entries in BCD that are not in NVRAM are added to NVRAM. The command copies of all firmware namespace objects from system BCD into NVRAM.
Bcdedit /enum firmware
Firmware Boot Manager
---------------------
identifier {fwbootmgr}
displayorder {bootmgr}
{93cee840-f524-11db-af62-aa767141e6b3}
{93cee841-f524-11db-af62-aa767141e6b3}
{93cee842-f524-11db-af62-aa767141e6b3}
{93cee844-f524-11db-af62-aa767141e6b3}
{93cee843-f524-11db-af62-aa767141e6b3}
timeout 2
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Firmware Application (101fffff)
-------------------------------
identifier {93cee840-f524-11db-af62-aa767141e6b3}
description Primary Master CDROM
Firmware Application (101fffff)
-------------------------------
identifier {93cee841-f524-11db-af62-aa767141e6b3}
description Harddisk 4
Firmware Application (101fffff)
-------------------------------
identifier {93cee842-f524-11db-af62-aa767141e6b3}
description Internal EFI Shell
Firmware Application (101fffff)
-------------------------------
identifier {93cee843-f524-11db-af62-aa767141e6b3}
description Floppy
Firmware Application (101fffff)
-------------------------------
identifier {93cee844-f524-11db-af62-aa767141e6b3}
description Acpi(PNP0A03,0)/Pci(1F|1)/Ata(Primary,Master)/CDROM(Entry1)
Firmware Boot Manager
---------------------
identifier {fwbootmgr}
displayorder {bootmgr}
{93cee840-f524-11db-af62-aa767141e6b3}
{93cee841-f524-11db-af62-aa767141e6b3}
{93cee842-f524-11db-af62-aa767141e6b3}
{93cee844-f524-11db-af62-aa767141e6b3}
{93cee843-f524-11db-af62-aa767141e6b3}
{8b87c5a0-f2f2-11db-9717-f87ee6ea6002}
{8b87c5a1-f2f2-11db-9717-f87ee6ea6002}
{8b87c5a2-f2f2-11db-9717-f87ee6ea6002}
{8b87c5a3-f2f2-11db-9717-f87ee6ea6002}
{8b87c5a4-f2f2-11db-9717-f87ee6ea6002}
timeout 2
Two or more entries for each device with different GUIDs might exist. For example, the Primary Master CDROM might include multiple entries:
Firmware Application (101fffff)
-------------------------------
identifier {93cee840-f524-11db-af62-aa767141e6b3}
description Primary Master CDROM
Firmware Application (101fffff)
-------------------------------
identifier {8b87c5a0-f2f2-11db-9717-f87ee6ea6002}
description Primary Master CDROM
You can remove multiple or duplicate entries in the NVRAM and BCD system store by using multiple commands. To use the correct object GUIDs for multiple object entries that you want to remove, you might be required to manually create a command script.
How to enable UEFI secure boot?
1. Reboot your computer and hit “ESC/Delete/F1/F2/F10 to enter the BIOS system (the keys are different depending on computer hosts). Then, click on “Boot” and select “Secure Boot”.
2. Now, you can secure boot is shut down. Click on “Key Management”.
3. Select “Install default Secure Boot Keys” to enable secure boot.
4. Finally, return to the previous column and you can see Secure Boot is enabled.
Does UEFI secure boot affect performance of the PC?
After going through the entire post, some people may wonder whether UEFI secure boot affect their PC’s performance. The answer is definitely negative. Enabling UEFI Secure Boot will increase protection and prevent your computer from virus attacks, so it won’t affect the performance.
Средства восстановления Windows в среде WinRE
В среде восстановления WinRE доступно несколько инструментов, которые позволят вам исправить различные проблемы с Windows:
- Reset this PC
– позволяет сбросить вашу Windows к заводским настройкам (личные данные и файлы будут удалены); - System Restore
– позволяет восстановить состояние Windows с помощью созданной ранее точки восстановления; - System Image Recovery
– полное восстановление Windows из резервной копии образа
(на внешнем носителе); - Startup Repair
– Windows пытается автоматически найти и исправить возможные проблемы (мастер может самостоятельно восстановить загрузчик
, конфигурацию BCD и запись MBR(
Master Boot Record);Рекомендуется использовать этот способ исправления проблем в первую очередь.
- Startup Settings
– позволяет выбрать различные сценарии загрузки Windows: загрузить компьютер в безопасном режиме, отключить проверку цифровой подписи драйверов
, отключить автоматическую перезагрузку
при появлении ошибок (только так можно увидеть код ошибки BSOD на экране загрузки Windows); - Uninstall Updates
– удаление установленных обновлений (обычно используется, если Windows не загружается после установки обновлений
); - • Go back to the previous version
– позволяет откатиться к предудущему билду Windows (после выполнения апгрейда билда Windows
); - Command Prompt
– запустить командную строку для ручного запуска команд диагностики и исправления; - UEFI Firmware Settings
– при следующей загрузки автоматически войти в настройки UEFI компьютера.
Если вы хотите запустить командную строку или другое средство исправления ошибок, WinRE запросит от вас пароль учетной записи с правами локального администратора (используются учетные данные из локальной базы SAM). Впрочем, пароль администратора Windows можно сбросить
.
В Windows 11 большинство инструментов в среде восстановления доступны без ввода пароля администратора.
Перед вами должно открыться окно командной строки X:\Windows\System32>
Из командной строки можно выполнить проверку диска утилитой chkdsk
, выполнить проверку образа Windows с помощью DISM и sfc.exe
, запустить
regedit
,
bootrec
,
startrep
(эта утилита позволяет найти и исправить проблемы с реестром, драйверами, разделами и т.д.), выполнить диагностику памяти командой
mdsched
, и выполнить другие команды (на сайте довольно много статей, где мы показываем как исправить различные проблемы Windows в среде восстановления или WinPE).
Чтобы закрыть командную строку WinRE и вернутся к выбору режима загрузки, выполните команду:
Пересоздать среду восстановления Windows
Если вы не нашли файла Winre.wim ни в одном из стандартных каталогов, попробуйте найти его поиском с помощью файлового менеджера или такой командой:
dir /a /s c:\winre.wim
Совет
. Не забудьте поискать данный файл и на скрытых разделах, которым нужно предварительно назначить букву диска.
Если вы нашли файл, скопируйте в стандартное местоположение его следующими командами:
attrib -h -s c:\Recovery\xxxx\winre.wim
xcopy /h c:\Recovery\xxxx\winre.wim c:\Windows\System32\Recovery
Если на диске отсутствует WIM образ WinPE, вы можете скопировать его с компьютера с аналогичной версией Windows (версия и битность ОС должна совпадать), или с установочного диска / загрузочной USB флешки
с Windows.
В нашем примере у нас есть установочный ISO образ с Windows.
Open ISO image with 7-Zip, select file \sources\install.wim (or install.esd
) and extract the files \Windows\System32\Recovery\ Winre
.
wim
and ReAgent
.
xml
to the c:\Windows\System32\Recovery directory. Original file boot.sdi
can be copied from the \Windows\Boot\DVD folder.
You can replace the standard winre.wim image with a more advanced DART recovery image
, which has additional utilities useful for diagnosing and fixing problems with Windows.
Delete the ReAgent.xml file from the old WinRE configuration:
ren C:\Windows\System32\Recovery\ReAgent.xml ReAgent_backup.xml
Change path to winre.wim file in Recovery Agent configuration:
reagentc /setreimage /path C:\windows\system32\recovery
REAGENTC. EXE: Operation Successful.
If the winre.wim file does not exist in the target directory, the command will return an error:
REAGENTC. EXE: No valid image found in the specified path.
It remains to enable Windows Recovery Agent with the command:
In this case, the recovery environment files will be stored on the system drive C:
Unable to find recovery environment
In some cases, if the partition with the WinRE or WIM file of the recovery environment has been deleted/corrupted, or the ReAgent or BCD configuration is configured incorrectly, then when trying to boot the computer into the Windows Recovery Environment, an error will appear:
Unable to find recovery environment.
Could not find the recovery environment. Insert your Windows installation or recovery media, and restart your PC with the media.
The reasons why the WinRE environment does not boot on the computer can be different:
- WinRE is disabled on Windows;
- In Boot Configuration Store ( BCD
) there are no entries to boot into recovery mode; - Winre.wim environment image file missing or moved;
- WinRE configuration file (ReAgent.xml) is missing or contains incorrect data.
Next, we will look at the main ways to restore the WinRE environment using the example of Windows 10 and 11
Enable (disable) Recovery Environment in Windows
You can check if the recovery environment is enabled on your computer with the command:
The command will show the current configuration of the Windows Recovery Environment. In this example WinRE is active:
Windows RE status: Enabled
This command also outputs the Boot Configuration Data (BCD) identifier of the WinRE entry in the BCD and the path to the Windows RE image (location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE)
To enable (disable) the recovery environment in Windows, use the commands:
reagentc /disable
reagentc /enable
Windows Recovery Environment logs are stored in the file %WINDIR%\System32\LogFiles\Srt\SrtTrail.txt.
Bypass UEFI detection by using the install disk to boot
2. After creating the account and logging in, scroll down the page and select version and language. Then, you can download the ISO file of the Windows 11 preview version.
3. After you finish downloading, you need to make an installation disk in order that you can be led by the installation disk to enter the Windows 11 installation process.
4. Insert the prepared installation disk into the USB port of the PC that needs to install Windows 11, and immediately press the shortcut key to enter the boot startup interface ( different motherboard shortcut keys are different, usually F8/F11/F12).
5. After booting into the startup window, select the option of installation disk and click on it.
To remove duplicate entries
Bcdedit /export savebcdYou can use this file later for recovery purposes.
Make a copy of the SaveBCD file to use for the delete operations:
Copy savebcd newbcdEnumerate the firmware namespace objects in the system BCD store and save the output results to a text file:
Bcdedit /enum firmware > enumfw.txtOpen Enumfw.txt with Notepad.exe to view the list of duplicate GUID entries to delete. Review the list of GUID entries on the computer.
Use Notepad to create a new command file. Save the file as RemoveDups.cmd.
Add a command line in the RemoveDups.cmd file to delete the duplicate firmware GUIDs listed under the Firmware Boot Manager display order:
Bcdedit /store newbcd /delete {93cee840-f524-11db-af62-aa767141e6b3}Bcdedit /store newbcd /delete {93cee841-f524-11db-af62-aa767141e6b3} Bcdedit /store newbcd /delete {93cee842-f524-11db-af62-aa767141e6b3} Bcdedit /store newbcd /delete {93cee843-f524-11db-af62-aa767141e6b3} Bcdedit /store newbcd /delete {93cee844-f524-11db-af62-aa767141e6b3} Bcdedit /store newbcd /delete {8b87c5a1-f2f2-11db-9717-f87ee6ea6002} Bcdedit /store newbcd /delete {8b87c5a2-f2f2-11db-9717-f87ee6ea6002} Bcdedit /store newbcd /delete {8b87c5a3-f2f2-11db-9717-f87ee6ea6002} Bcdedit /store newbcd /delete {8b87c5a4-f2f2-11db-9717-f87ee6ea6002}Add a final command to RemoveDups.cmd to import the new BCD file by using the option to remove all NVRAM entries as part of the import operation:
Bcdedit /import newbcd /cleanSave the file and, at a command prompt, run RemoveDups.cmd to remove all duplicate entries from the store and import the store to the system BCD.
Reboot the system. During reboot, the EFI firmware reinitializes the NVRAM with the firmware object GUIDs corresponding to the devices attached to the system. Use the firmware command to verify that all duplicate firmware entries have been removed.
Как войти в среду восстановления Windows?
Чтобы запустить среду восстановления Windows, зажмите клавишу Shift
и щелкните по кнопке перезагрузки в меню Пуск.
Можно перезагрузить компьютер в режиме WinRE из командной строки с помощью параметра /o
в команде shutdown
:
shutdown /f /r /o /t 0
Есть еще одна команда для принудительного входа в среду восстановления при следующей загрузке:
Среда восстановления должна запустится автоматически, если возникают проблемы с нормальной загрузкой Windows. Так, например, если три предыдущие попытки нормальной загрузки Windows были неудачными — компьютер автоматически загружается в среде Windows Recovery Environment. Т.е. чтобы загрузить ваш компьютер в WinRE достаточно 3 раза подряд прервать загрузку Windows кнопкой питания.
Восстановление среды Windows Recovery Environment
Самый простой способ восстановить среду восстановления в Windows – просто отключить и включить WinRE с помощью команд:
reagentc /disable
reagentc /enable
Утилита должна обновить конфигурацию загрузчика BCD и добавить записи для среды WinRE.
При появлении ошибки “
REAGENTC.EXE: Unable to update Boot Configuration Data
”, исправьте сначала проблему с загрузчиком Windows (инструкция для UEFI
и BIOS
компьютеров).
Команда reagent может вернуть ошибку:
REAGENTC. EXE: The Windows RE image was not found.
REAGENT. EXE: образ среды восстановления Windows не найден.
Это обычно означает, что удален файл winre.wim или раздел System Restore. В этом случае вам нужно попробовать восстановить среду WinRE.
Проверьте, что в конфигурации загрузки BCD (Boot Configuratin Data) имеются корректные записи для загрузки среды WinRE.
bcdedit /enum all
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 11
locale en-US
inherit {bootloadersettings}
recoverysequence {e96410b6-71fb-11ed-926e-953e7d1b3836}
displaymessageoverride Recovery
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {e96410b4-71fb-11ed-926e-953e7d1b3836}
nx OptIn
bootmenupolicy Standard
Далее нужно найти секцию конфигурации загрузки, у которой значение идентификатора ( identifier
) равно полученному выше GUID, а в описании поля ( description
) указано Windows Recovery Environment
. This entry might look like this:
Windows Boot Loader
--------------------
identifier {e96410b6-71fb-11ed-926e-953e7d1b3836}
device ramdisk=[\Device\HarddiskVolume4]\Recovery\WindowsRE\Winre.wim,{e96410b7-71fb-11ed-926e-953e7d1b3836}
path\windows\system32\winload.efi
description Windows Recovery Environment
locale en-us
inherit {bootloadersettings}
displaymessage Recovery
osdevice ramdisk=[\Device\HarddiskVolume4]\Recovery\WindowsRE\Winre.wim,{e96410b7-71fb-11ed-926e-953e7d1b3836}
systemroot\windows
nx OptIn
bootmenupolicy Standard
winpe yes
The Device line contains the full path to the WIM image of the recovery environment. In our example, it is located on disk partition 4 (HarddiskVolume4) along the path \Recovery\WindowsRE\Winre.wim.
To force the path to the WIM image on this partition in the WinRE configuration, run the command:
REAGENTC.EXE /setreimage /path \\?\GLOBALROOT\device\harddisk\partition4\Recovery\WindowsRE
If this partition exists, you can bind this bootloader entry to boot WinRe as the recovery environment for the current system. Copy the GUID of the found entry and replace it in the following command:
Note
. If you are using multiboot, be aware that each OS will add its own entry to the Microsoft Boot Manager for the Windows Recovery Environment. It is important not to get confused here.
Make sure that the Winre.wim file is in the specified path. Typically, it is stored in one of the following locations (folders hidden
): directory C:\Windows\System32\Recovery, on a separate hidden Recovery Partition (or System Reserved), or on the manufacturer’s OEM recovery partition (make sure you didn’t delete the OEM recovery partition
). In our example, the path to the Recovery Partition.
Then check the path to the wim file, which is specified in the file ReAgent.xml
(located in the C:\Windows\System32\Recovery directory or in the Recovery directory on the recovery partition).
Open the configuration file with any editor and check the value of the attribute <WinreLocation path =
. If the path specified in the file does not exist (the original key has been removed), you can change the path to <ImageLocation path= "\Recovery\WindowsRE"), create the C:\Recovery\WindowsRE directory, and copy the Winre.wim file into it.
Disable and enable WinRE again:
reagentc /disable
reagentc /enable
What is UEFI secure boot?
After enabling this settings, the PC will only load drivers with Microsoft certificates. Secure boot detects tampering by verifying the boot loader, key operating system files, unauthorize option Rom, and their digital signatures, and they will stop running before an attack or infection of the system is detected.
Only when you enable secure boot on the Windows OS, can you run the latest version of Windows 11. Luckily, secure boot is widely supported. Please read on and learn how to enable UEFI secure boot in on this page.
How to make sure whether the PC supports UEFI secure boot?
▶ Method 1. Check system information tool
First, you can check the secure boot state in System information.
1. Press “Win+R” simultaneously, type msinfo32 and hit “ENTER”.
2. In the “System Information” window, select “System Summary” and look for “Secure Boot State” on the right side. If the value is “on”, the secure boot is enabled; if “off”, the secure boot isn’t enabled and you need to enable it for Windows 11.
▶ Method 2. Use CMD command
The built-in CMD is a basic way to see whether the secure boot is enabled. Let’s see how it works.
1. Press “Win+R” simultaneously to launch the “Run” window, Then, type “cmd” and hit “ENTER”.
3. Among the listed information, locate “path”. If the path show “winload.efi”, it means Windows has enabled UEFI secure boot; if the path show “winload.exe”, it means Windows has enabled the traditional way to boot.
▶ Method 3. Use PowerShell Cmdlet
The Windows PowerShell would help by checking the “path”.
2. Type “bcdedit” and hit “ENTER” to commit it. Now, locate “path” as what you do in Method 2. Then, check what is behind the path, “winload.efi” or “winload.exe”.
▶ Method 4. Check Windows Disk Management
Since the specific relationship of GPT and UEFI
, if the “Convert to GPT Disk” button greyed out, the PC is in UEFI secure boot mode, and vice versa.
1. Press “Win + R” to open the “Run” window, then, type “diskmgmt.msc” and hit the “ENTER” key.
2. Right-click on disk 0 and if there is the option of “Convert to GPT Disk”, it means your PC is running in the traditional way; if it shows “Convert to MBR Disk”, it means the PC is in the UEFI secure boot mode.
▶ Method 5. Check the motherboard’s production date
Besides, you can also view the production data of the motherboard in “BIOS Versions”, then judge whether the secure mode is enabled.
1. Press “Win + R” simultaneously to open the run window. Then, type “cmd” and hit “ENTER”.
2. In the window, type “systeminfo” and hit the “ENTER” key. Wait a moment before you can check the info of your PC. You can see the production data of the motherboard after the option of “BIOS Versions”.
Attention
: When you change the secure boot state, you may encounter some hardware failures. You can easily solve the problem by simply disconnecting the inoperable hardware from the PC after changing the secure boot state, and then reconnecting it.
Conclusion
This page focuses on showing you what is UEFI, and how to enable it for Windows 11 updates. There’re 5 methods for you to check whether your computer support UEFI Secure Boot. If your computer doesn’t support it, you can bypass UEFI detection with an installation disk, then execute Windows 11 installation; If you’ve enabled UEFI Secure Boot successfully, congratulations, you can turn to the next operation of Windows 11 upgrade.
