15 ms·

Microsoft suggests command line fiddling to get Windows 10 update installed

241 points by curiousObject 3y ago

mizaru 3y ago
Had a machine that was stuck on this update, the manual workaround resolved it.
- WarOnPrivacy 3y ago
  Hit this Sat on an install. Used MS's PS script; it needed 2 update files (matching the Win prod) to be downloaded first.
bdhcuidbebe 3y ago
The issue is the recovery partition is missing or not large enough. Since I dont need a recovery partition in my win10 vm, i deleted it after installation and can now no longer update my installation.
- robotbikes 3y ago
  I followed the instructions to disable the recovery partition as I don't think I had allocated any space to it and upon reboot I was able to upgrade to Windows 11 and hopefully I didn't create any further problems down the road. I really didn't want to mess around with resizing my system partition as the instructions alluded to as the next step. I guess YMMV but I find it amusing that this random bug I ran into is on the front page or Hacker news.
  - bdhcuidbebe 3y ago
    ok but i dont want win11 :) just keeping an installation around for gaming the reason its on here is that many was affected i guess
bjarneh 3y ago
> Unhelpful error codes, complex fixes ... When did Windows turn into Linux? Hmm
- bobim 3y ago
  That won’t be long now…
- sieste 3y ago
  Btw, I use Arch Windows.
- gumballindie 3y ago
  Yup. These are the people society put in charge with keeping us informed. They'll probably need to take jobs are janitors once ai replaces them, as they are prime candidates given how unreliable their writing is.
  - brettermeier 3y ago
    Why, it's a funny pun against Linux and it's true, so where's the problem with the writing?
ourmandave 3y ago
Surprised Windows 10 Home still has a command line option.
- jve 3y ago
  But it doesn't have BitLocker drive encryption.
  - MikusR 3y ago
    Home can read/write previously created Bitlocker protected drives. On systems that have proper modern standby/tpm (mainly laptops) it also supports whole disk encryption.
dijit 3y ago
> meant to address a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE). How can you screw up so badly that you even have the ability to bypass the entire reason for a security feature existing? Sorry to be mean to Microsoft, I am certain there's usability reasons for this, but sincerely: principle of least surprise please. I'd be incredibly surprised if Linux kept a copy of my unlock keys around somewhere that were available to anyone except me. That is a truly monumental fuck-up.
- smileybarry 3y ago
  It's possible partly by the user shotgunning their own foot. WinRE gets auto-decrypt access to your drive because upon setting up BitLocker, the user chose "automatically unlock this drive on startup" instead of a PIN unlock. (Which then utilizes the TPM to auto-unlock so it's not like your keys are on the storage device directly) If you use any non-auto unlock -- PIN, passphrase, network -- then WinRE can't magically access your data and needs that code to then retrieve a key from the TPM.
- dist-epoch 3y ago
  > I'd be incredibly surprised if Linux kept a copy of my unlock keys around somewhere that were available to anyone except me You can set it up to auto unlock: https://devicetests.com/decrypting-luks-encrypted-filesystem-ubuntu https://devicetests.com/decrypting-luks-encrypted-filesystem...
EspadaV9 3y ago
When installing the update, some users are finding themselves faced with an 0x80070643 error, a generic failure message. Unfortunately, according to Microsoft, "because of an error in the error code handling routine," this might not be the correct error. Error in the error code code is giving the wrong error code for the error. I'm curious how often the error code code needs touching that there is an error in there that hasn't been patched long ago. I would imagine it would be a set and forget kind of thing. Unless this error in the error code code has been there for a long time but unnoticed. In which case there might be a errors in the QA of the error code code.
- hulitu 3y ago
  > "because of an error in the error code handling routine," WinErr:013 Unexpected error - Huh ? This may be the famous "/* NOTREACHED*/".
- drsopp 3y ago
  Maybe it was caused by a bug in the debugger.
- berkes 3y ago
  This is why I am extra vigilant, pendantic and strict when writing or reviewing code that handles exception and error paths. More than happy-path code, I want this to be simple, rediculously easy and very loosely coupled. No inheritance, no abstractions, very shallow dependency trees and so on. Just once too often did a bug in exception handling cause a system to go down - It is often not or hardly covered in tests (Its exceptional after all) and very unpredictable: more than elsewhere do exceptions have the tendency to arise where you never expected them (it's in the definition, really).
  - JeffSnazz 3y ago
    This attitude seems a little silly to me—being "extra vigilant, pedantic and strict" about happy-path code would necessarily imply the same about "exception and error paths". Generally speaking, bugs mostly appear in a binary fashion and not in varying degrees—ie your code either reflect expected behavior or doesn't.
bheadmaster 3y ago
Glad to see that Microsoft is making Windows more and more similar to Linux by every passing day :)
- gchamonlive 3y ago
  You mean 90's Linux?
  - OsrsNeedsf2P 3y ago
    Hey! Some of us still use Linux the old "hacker command line" way
    - fsflover 3y ago
      It doesn't mean that you have to.
      - cesarb 3y ago
        It's hard to avoid. I know I can open the GUI file manager to look at a directory, and sometimes I try to force myself to do that, but way too often I quickly open a terminal and type a "ls" command. It's just what I got used to when I first started using computers back in the 1990s, and habits can be hard to break.
    - gchamonlive 3y ago
      I use arch btw, and even then with zsh, shell highlighting, annotations, fuzzy finder and vim on steroids, the "hacker way" can be really different from two decades ago.
  - jstummbillig 3y ago
    Are you claiming that using Linux in 2023 will not pretty much require "command line fiddling" to some unavoidable degree (unless you have somebody else do the setup for you and day to day just use what's there)? Because, if so, that would very much not be my experience. Broadly speaking, what advancements am I likely missing out on?
petee 3y ago
As daunting as the fix seems, I appreciate them offering any at all; couple years ago when an update broke ReFS arrays for more than a handful of people, we were never given a solution beyond rolling back, until the update eventually became required and uninstallable, necessitating rebuilding the array from scratch
- nehal3m 3y ago
  It's something, sure. But it is still a major fuck up, so them seeing fit to throw us some scraps (for a paid product!) is nothing to appreciate. Maybe I'm reading things into your comment that you didn't mean to say, in which case I apologise. We should hold Microsoft accountable for borking installs and coming up with a half-assed fix even if it is a complex problem. They're in the lead on the desktop OS market and make billions upon billions of dollars that way. They should do better.
londons_explore 3y ago
> a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE) I always wondered why the recovery environment seemed to let me have SYSTEM privileges to my auto-decrypted system drive... Thats been the case for years, and you can use it to dump the contents of a machine you've lost the login password to for example. I guess it wasn't supposed to!
- smileybarry 3y ago
  IIRC WinRE asks for a local administrator password before doing any recovery operations, no? Also, this is one of the reasons why "auto unlock" is generally a huge asterisk and PIN/password/network unlock are recommended instead, if possible. (Though they do force you to be a laptop nanny during update times and unlock it on every restart...)
  - londons_explore 3y ago
    > WinRE asks for a local administrator password before doing any recovery operations, no? Not for the "Shift+F10" command prompt option....
    - smileybarry 3y ago
      Are you sure the system drive you see is the real drive and not just the bootable WinRE partition? You technically have two "?:\Windows" roots in that state, one of WinRE that just booted and one of the system you're restoring.
- briHass 3y ago
  Only if you don't use a TPM PIN and/or have a <2.0 TPM. Bitlocker using TPM with PIN has no way to know your hard drive key without asking the TPM, which requires the PIN (and has anti-hammering/lockout built in.)
Zenst 3y ago
I've followed the instructions and understand that they may seem overwhelming for some users. Instead of using command line methods, I opted for Windows Disk Management to shrink the drive's partitions and create the necessary space. It's surprising that a script hasn't been provided for this process, which suggests the complexity and potential pitfalls involved. This leads me to believe that the absence of a scripted, simple double-click solution is due to the intricate nature of the task. Consequently, I'm not optimistic about a prompt Windows Update fix, as many had hoped for. However, I anticipate that third-party developers will soon release scripts or programs to automate this process.
- berkes 3y ago
  I'd expect that "automatic disk and partition changes" have a rather high risk of severe data-loss.
  - polonbike 3y ago
    It has, especially for non technical users who cannot double check the "automatic" parameters of the change
- currysausage 3y ago
  It looks like a PowerShell script is available now, but I don't think it's changing the partition size. Has anyone tried this out? https://support.microsoft.com/en-us/topic/kb5034957-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2024-20666-0190331b-1ca3-42d8-8a55-7fc406910c10 https://support.microsoft.com/en-us/topic/kb5034957-updating...
  - concerned_user 3y ago
    I can only see it using dism to apply the patch but there is no commands to manipulate partition size so if the cause is lack of free space it will fail same as update did.
jug 3y ago
Haha! Yes, this was a mess! I was called to help my concerned stepson with "an update error" this past weekend. I'm a software engineer but even I kind of balked at it at first, realizing how very easily an on-the-fly resizing of partitions can go wrong! Let's take it from the beginning. He pointed me to the "out of disk space" error code, which isn't in text form to begin with, but only something you find out by googling it. I thought that must be wrong, because the drive is like 30% full. Knowing how this particular error is sometimes thrown inaccurately, I dug deeper and ended up in a long winded forum thread about all sorts of people and skill levels having issues. Novice home users. Advanced users. SERVER ADMINS. It soon dawned upon me that the disk space error was correct; it was only talking about it from the perspective of a tiny Windows Recovery Environment partition! Or "tiny"... It was like 300 MB large but not enough. It wanted something like another 500 MB now. People yelled at MS for not pulling the patch and fixing it or bringing an automated post-patch fix. BUT if this HAS to be done, MS is in a tough spot now. Because it's inadvisible to resize partitions automatically. You usually want backups as it's a high risk operation where power loss or bad input will brick the OS install. I also think how and if it can be resized depends on the layout on the partition table. For example, I had to reduce the end of a former partition to increase the start of the recovery one. Fortunately, I had free space there. I can imagine a Microsoft script wizard would have his heart sink as he'd ship an automated partition resizing script to millions of systems and all their intricacies. So, I'm not sure how MS will end up fixing this to be honest. My only "fix" would be to rewrite the code so that it don't need a larger Windows RE partition anymore?? OR simply not installing this patch if it's too small. Otherwise, this can only really be "safely" fixed as part of a fresh Windows install with hard drive reformatting and the whole shebang. I ended up fixing it with a free partition resize tool (MiniTool Partition Wizard). MS advised me to the command line but to hell with that and their ancient DISKPART.EXE and having to input the correct partition # for your partitions when there were like five of them on the drive. I needed something more visual as assistance to hand hold me from making mistakes. But how on Earth could this even happen? Did MS just kind of forget that they have had previous, smaller Windows RE requirements in the past?
- actionfromafar 3y ago
  I thought they had many computers of various configurations they test on. And wasn't there a release note describing what could happen? So some part of the org knew what was going to happen.
Frivolous9421 3y ago
[dead]
BiteCode_dev 3y ago
There is a case to be made to not install all updates as soon as they are available.
- yreg 3y ago
  I do that (wait a bit) on macOS and iOS, but I wasn't able to explain to my Windows that I don't want to update automatically. Especially in the middle of some overnight computing task.
  - MacsHeadroom 3y ago
    This is a pro feature on windows. But you can enable it on home editions with some power shell commands or by side loading the program used to set the relevant settings on pro editions (group policy editor).
    - theyeenzbeanz 3y ago
      I have pro and it conveniently “forgets” my update settings and will still do it whenever if feels like. Microsoft doesn’t understand that no means no.
- calebegg 3y ago
  Do they dogfood these updates internally like Google does with Android and Chrome OS?
- Prickle 3y ago
  Did microsoft change that, or does Windows 10 Home still force users to install the latest updates immediately?
rvba 3y ago
Is it me or is Microsoft degrading user experience on Windows 10 with constant system breaking updates? It feels that most of them do nothing but slow the system down or change things for the sake of change (some project managers want to show they do something?). It feels like Microsoft is trying to "convince" users to switch to Windows 11 by making Windows 10 bad. At the same time Win 10 computers without this UEFI cannot be migrated to Win 11...
- dist-epoch 3y ago
  Or more likely they don't test for Windows 10 regressions as much.
  - richbell 3y ago
    I wonder what their testing looks like these days. My impression is that they fired their QA and never looked back... https://news.ycombinator.com/item?id=20557488 https://news.ycombinator.com/item?id=20557488
- chii 3y ago
  once you've paid for win10, you as a user is no longer a revenue but a cost. And you can obviously guess what happens to costs.
  - rvba 3y ago
    But why bother to change UI at all
    - lacrimacida 3y ago
      To make you buy what you currently have as a future feature
mariusmg 3y ago
Why do i get this faulty patch if i'm not even using Bitlocker ? Also how the heck does something like this happens ? Did MS forgot the size of the WinRE partion which THEY created ?
- cesarb 3y ago
  > Why do i get this faulty patch if i'm not even using Bitlocker ? You might not be using it now, but you might want to switch it on later. And more importantly, it prevents an exponential explosion on the amount of different variants of the code. If you allow people to not get this patch, and later another bug is fixed, either you force people to get this patch before getting the next one (leading to N different versions), or you'll have to develop a fix both for people who have and for people who don't have this patch (leading to 2^N different versions).
GTP 3y ago
Had the journalist tryied Linux, would have known that it gives much better error messages than some random looking number.
- brettermeier 3y ago
  It's about one-click-solutions what makes Windows a nice-to-use-tool, not the error messages.
- crimbles 3y ago
  Exit code 139. Hm.
  - GTP 3y ago
    That's usually not the full error message, and you can still easily find the number's meaning by opening the man page of wathever piece of software terminated with that exit code.
    - nullindividual 3y ago
      Likewise, if you knew about err.exe, you'd also know how to be able to get the error message behind the error code.
    - crimbles 3y ago
      Depends really. If it's some kind of runtime or VM you pretty much have zero idea what the exit code was. Python, CLR, JVM tend to leave you in this mire.
      - GTP 3y ago
        Yes, but remember that usually nowadays a piece of software also logs something to stderr instead of relying just on exit codes to signal error.
        crimbles 3y ago
brnt 3y ago
It's the year of the Linux desktop, everyone!
- boopmaster 3y ago
  Microsoft WinLinux 2024 Professional for 64bit extended systems Edition
  - sidewndr46 3y ago
    If Microsoft licensed Linux, they would have something like 2*128 SKUs to describe all the different versions
- ThrowawayR2 3y ago
  The monkey's paw curls and WSL is what the Year Of Linux On The Desktop turned out to be.
hknmtt 3y ago
i remember reading years ago about the reason windows updates since 8 or 10 were so bad was because MS fired all testers and scrapped their testing hardware and now they are testing virtually in cloud. I guess nothing has changed, still. cost cutting at its best.
- crimbles 3y ago
  McDonald’s methodology. Optimise for volume not flavour and quality with a veneer of marketing bullshit smeared on it.
- FirmwareBurner 3y ago
  >MS fired all testers and scrapped their testing hardware and now they are testing virtually in cloud Do you have any sources for this? AFAIK, according to the LTT wan show when he was duiscussing his conversation with MS baout Windows sleep issues, he laerned MS still uses plenty of bare metal HW for testing, especailly notebooks and in no way got rid of it.
  - toast0 3y ago
    The status quo was seperate software developers and software developers in test, and nearly equal numbers [1] (I haven't read this book, only the description, but seems authoritative). The new normal changed around 2014, as described in this Ars Technica article [2]. In order to ship more stuff, more quickly, Microsoft eliminated the developer in test roles, removing the bottleneck of a specific role in charge of quality and hoping to diffuse the responsibility. This addresses the 'fired all testers' part of your quote. I don't have references on the 'scrapped their testing hardware', but I imagine most testing hardware was maintained by developers in test, and when their positions were eliminated, they may not have had anyone to transfer the hardware to. [1] https://www.amazon.com/How-We-Test-Software-Microsoft/dp/0735624259 https://www.amazon.com/How-We-Test-Software-Microsoft/dp/073... [2] https://www.amazon.com/How-We-Test-Software-Microsoft/dp/0735624259 https://www.amazon.com/How-We-Test-Software-Microsoft/dp/073...
  - hknmtt 3y ago
    No, i just remember a comment from some former MS dev who knew something about the testing process in MS. I think it might have even been a comment in here actually.
pm2222 3y ago
My win10 kept giving me “bug check” reboot treatment and I had to go win11 reluctantly. Oh well, there goes my vertical taskbar.
- pm2222 3y ago
  If only there’s a way to transfer my win oem license which comes with my laptop, I’d totally switch around the host/guest setup and shrink my host windows to a guest vm.
  - WarOnPrivacy 3y ago
    Massgravel's MAS is an option. Not a license transfer but gets you an activated machine. HN appearances: https://hn.algolia.com/?query=massgravel&type=comment https://hn.algolia.com/?query=massgravel&type=comment
- ripdog 3y ago
  Note that there are tools to restore the win10 taskbar in 11. I use startisback, but there are more. Also be sure to use a privacy tweaker!
squarefoot 3y ago
FTA: "Showing an unhelpful error message and then requiring a user to delve into the world of the command line to fix things. What is this? Linux?" What did the author want, a button to push for each solution to every possible exotic error, even critical ones that would require to resize a system partition from a running OS? Seriously!? Of course one solve this through the command line. Or, if that wasn't what the author meant, then he may have to upgrade his Slackware 4.0 install, because a thing or two have changed in the Linux world.
- brettermeier 3y ago
  The beauty of Windows is that you have one-button-push-solutions that just work. If Linux would have that too, maybe even tech-unsavvy-users could handle it, but since Linux is made from freaks for freaks that won't happen. I mean, Linux people can't even see the problems of a not-one-click-solution, but for every normal user it's crystal clear. Command line is for tech users and really for nobody else. Nobody who isn't into tech want's to write in command shells, really, nobody!
  - iforgotpassword 3y ago
    Sure, and I wouldn't want it any other way, or I'd just use Windows in the first place. That said, on Linux I still get error messages, not a big number – an actual message that tells me what didn't work so if googling that error message doesn't yield a solution, I can go ahead and try do fix the issue myself. I still remember from the Windows days when you were unlucky enough to hit a more unusual error code, where googling it didn't immediately result in a dozen forum threads with people posting the same issue and then some dude replying with a fix where you don't even know how they possibly figured that out. If you didn't find a solution googling the error code it basically meant you can try random shit until you accidentally fix it, or reinstall. On Linux I could just ultimately look at the source code of whatever component is broken and track back from where the error is printed.
- graemep 3y ago
  Its typical flamebait The Register is very fond of. I have seen entirely unnecessary references to everything from Brexit to religion on The Register. it works too. Lots of comments both on their own site and here purely in response to mentioning Linux in the subheading.
theknocker 3y ago
[dead]
kemotep 3y ago
The issue with the WinRE environment and Bitlocker bypass exploit has been known since at least last year with a January 2023 KB addressing the issue, but the WinRE environment still needed to be updated manually. Looks like 12 months later if you hadn’t already dealt with it, another issue can arise according to this article? More information on the fix can be found discussed here: https://old.reddit.com/r/sysadmin/comments/10atdqe/is_bitlocker_forever_compromised/ https://old.reddit.com/r/sysadmin/comments/10atdqe/is_bitloc...
eterevsky 3y ago
"These instructions are not for the faint of heart. The first link requires the user to open a command prompt window with administrative privileges. It's downhill from there ..."
- 867-5309 3y ago
  sudo cmd.e×e | /bin/exorcise (edit: the actual extension triggered HN's blocker..)
ryzvonusef 3y ago
I also got this error... if I understand this correctly, they want a recovery partition of 250 MB... but I already have a recovery partition of 500 MB (acc to disk management, and lists it as 100% free)... so why am i getting this error? should I increase it by a further 250 MB (for a total of 750 MB), or are they just plain crazy?
- khaledh 3y ago
  The update requires 250 MB of _free_ recovery partition space, not the total size of the partition.
  - ryzvonusef 3y ago
    but my 500 MB partition is listed as 100% free by disk management is it that not accurate? how do i find out how much actually free space i have?
noufalibrahim 3y ago
"When there's a shell, there's a way".
kotaKat 3y ago
Can Microsoft just bring back a proper QA department instead of leaving it to unpaid "Insiders" who drink the Flavor-Aid and think Microsoft can't code a single thing wrong?
- zamadatix 3y ago
  Based on the feedback community I don't think that's a particularly accurate take of Insiders as a whole. That said it's been ~10 years now since they dumped the traditional QA department (which involved more than just leveraging external user validation) and I honestly can't say Windows is blowing up any more than it was the previous 10 years to that. I'd really like to see some actual measured statistics of e.g. patch issue outages at a health system over the last 20 years though.
  - deleted 3y ago
    [deleted]
  - deleted 3y ago
    [deleted]
  - salawat 3y ago
    Gee... Let me forward that request to our QA depart... Oh. Oops.
tussa 3y ago
Didn't Bill Gates "kill the command line" in a infamous video when Windows 95 came out?
- bni 3y ago
  I think it was DOS he killed. But I get what you mean. When Microsoft was completely dominating the IT landscape during the 2000's command lines was often sneered at by "Microsoft Certified Professionals"
- sp332 3y ago
  Sure but they released PowerShell in 2006, a few years after he stepped down as CEO.
keeganjw 3y ago
I had this update issue on a fresh install of Windows 11 at work. Then I went home and had it on my Windows 10 laptop... thank you Microsoft :|
dukeofdoom 3y ago
As former windows Dev, I remember getting supper frustrated with their Windows upgrade. You could no longer reliably write to your install folder. They started forcing you to write to the registry, then to data folder, then other places. So you had to split up the install "ten ways" how and where you kept your data. HKEY local machine, HKEY_Current_User, and so on .. then ask for elevation to install. I vaguely remember debugging a bug where I would delete a file in my install folder. But then found out windows was restoring an older version of it in the background. c:\program files was virtualized, and not really a directory anymore.
- tonyedgecombe 3y ago
  >You could no longer reliably write to your install folder. I think that came in with Windows XP and it was a good thing. Letting user programs write into a folder full of executables is terrible for security.
bitwize 3y ago
"I use Windows because I don't want to have to go to the command line to fix one simple thing." Yeah, join the club. Actually you've been in the club. A few years back I had Windows decide that I didn't have permission to access my own user directory anymore, resulting in a system with a glitchy Explorer and taskbar where nothing worked. To fix things I had to drop into an administrator console, create a new user, then move all my old files from the old user account to the new one and change ownership and permissions on them. So no, the idea that Windows is easier because graphical is BS. If the system is going to get into weird failure modes that I need to type commands to démerde myself out of anyway, I'm just going to stick with Linux and NetBSD.
merb 3y ago
btw. I got this error after installing windows 10pro 22h2. So it’s extremely stupid
fomine3 3y ago
Don't forget to run dism /online /cleanup-image /restorehealth ! /s

241 points by curiousObject 3y ago

mizaru 3y ago

Had a machine that was stuck on this update, the manual workaround resolved it.

WarOnPrivacy 3y ago
Hit this Sat on an install. Used MS's PS script; it needed 2 update files (matching the Win prod) to be downloaded first.

bdhcuidbebe 3y ago

The issue is the recovery partition is missing or not large enough. Since I dont need a recovery partition in my win10 vm, i deleted it after installation and can now no longer update my installation.

robotbikes 3y ago
I followed the instructions to disable the recovery partition as I don't think I had allocated any space to it and upon reboot I was able to upgrade to Windows 11 and hopefully I didn't create any further problems down the road. I really didn't want to mess around with resizing my system partition as the instructions alluded to as the next step. I guess YMMV but I find it amusing that this random bug I ran into is on the front page or Hacker news.
- bdhcuidbebe 3y ago
  ok but i dont want win11 :) just keeping an installation around for gaming the reason its on here is that many was affected i guess

bjarneh 3y ago

> Unhelpful error codes, complex fixes ... When did Windows turn into Linux? Hmm

bobim 3y ago
That won’t be long now…
sieste 3y ago
Btw, I use Arch Windows.
gumballindie 3y ago
Yup. These are the people society put in charge with keeping us informed. They'll probably need to take jobs are janitors once ai replaces them, as they are prime candidates given how unreliable their writing is.
- brettermeier 3y ago
  Why, it's a funny pun against Linux and it's true, so where's the problem with the writing?

ourmandave 3y ago

Surprised Windows 10 Home still has a command line option.

jve 3y ago
But it doesn't have BitLocker drive encryption.
- MikusR 3y ago
  Home can read/write previously created Bitlocker protected drives. On systems that have proper modern standby/tpm (mainly laptops) it also supports whole disk encryption.

dijit 3y ago

> meant to address a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE). How can you screw up so badly that you even have the ability to bypass the entire reason for a security feature existing? Sorry to be mean to Microsoft, I am certain there's usability reasons for this, but sincerely: principle of least surprise please. I'd be incredibly surprised if Linux kept a copy of my unlock keys around somewhere that were available to anyone except me. That is a truly monumental fuck-up.

smileybarry 3y ago
It's possible partly by the user shotgunning their own foot. WinRE gets auto-decrypt access to your drive because upon setting up BitLocker, the user chose "automatically unlock this drive on startup" instead of a PIN unlock. (Which then utilizes the TPM to auto-unlock so it's not like your keys are on the storage device directly) If you use any non-auto unlock -- PIN, passphrase, network -- then WinRE can't magically access your data and needs that code to then retrieve a key from the TPM.
dist-epoch 3y ago
> I'd be incredibly surprised if Linux kept a copy of my unlock keys around somewhere that were available to anyone except me You can set it up to auto unlock: https://devicetests.com/decrypting-luks-encrypted-filesystem-ubuntu https://devicetests.com/decrypting-luks-encrypted-filesystem...

EspadaV9 3y ago

When installing the update, some users are finding themselves faced with an 0x80070643 error, a generic failure message. Unfortunately, according to Microsoft, "because of an error in the error code handling routine," this might not be the correct error. Error in the error code code is giving the wrong error code for the error. I'm curious how often the error code code needs touching that there is an error in there that hasn't been patched long ago. I would imagine it would be a set and forget kind of thing. Unless this error in the error code code has been there for a long time but unnoticed. In which case there might be a errors in the QA of the error code code.

hulitu 3y ago
> "because of an error in the error code handling routine," WinErr:013 Unexpected error - Huh ? This may be the famous "/* NOTREACHED*/".
drsopp 3y ago
Maybe it was caused by a bug in the debugger.
berkes 3y ago
This is why I am extra vigilant, pendantic and strict when writing or reviewing code that handles exception and error paths. More than happy-path code, I want this to be simple, rediculously easy and very loosely coupled. No inheritance, no abstractions, very shallow dependency trees and so on. Just once too often did a bug in exception handling cause a system to go down - It is often not or hardly covered in tests (Its exceptional after all) and very unpredictable: more than elsewhere do exceptions have the tendency to arise where you never expected them (it's in the definition, really).
- JeffSnazz 3y ago
  This attitude seems a little silly to me—being "extra vigilant, pedantic and strict" about happy-path code would necessarily imply the same about "exception and error paths". Generally speaking, bugs mostly appear in a binary fashion and not in varying degrees—ie your code either reflect expected behavior or doesn't.

bheadmaster 3y ago

Glad to see that Microsoft is making Windows more and more similar to Linux by every passing day :)

gchamonlive 3y ago
You mean 90's Linux?
- OsrsNeedsf2P 3y ago
  Hey! Some of us still use Linux the old "hacker command line" way
  - fsflover 3y ago
    It doesn't mean that you have to.
    - cesarb 3y ago
      It's hard to avoid. I know I can open the GUI file manager to look at a directory, and sometimes I try to force myself to do that, but way too often I quickly open a terminal and type a "ls" command. It's just what I got used to when I first started using computers back in the 1990s, and habits can be hard to break.
  - gchamonlive 3y ago
    I use arch btw, and even then with zsh, shell highlighting, annotations, fuzzy finder and vim on steroids, the "hacker way" can be really different from two decades ago.
- jstummbillig 3y ago
  Are you claiming that using Linux in 2023 will not pretty much require "command line fiddling" to some unavoidable degree (unless you have somebody else do the setup for you and day to day just use what's there)? Because, if so, that would very much not be my experience. Broadly speaking, what advancements am I likely missing out on?

petee 3y ago

As daunting as the fix seems, I appreciate them offering any at all; couple years ago when an update broke ReFS arrays for more than a handful of people, we were never given a solution beyond rolling back, until the update eventually became required and uninstallable, necessitating rebuilding the array from scratch

nehal3m 3y ago
It's something, sure. But it is still a major fuck up, so them seeing fit to throw us some scraps (for a paid product!) is nothing to appreciate. Maybe I'm reading things into your comment that you didn't mean to say, in which case I apologise. We should hold Microsoft accountable for borking installs and coming up with a half-assed fix even if it is a complex problem. They're in the lead on the desktop OS market and make billions upon billions of dollars that way. They should do better.

londons_explore 3y ago

> a vulnerability that allowed attackers to bypass BitLocker encryption by using the Windows Recovery Environment (WinRE) I always wondered why the recovery environment seemed to let me have SYSTEM privileges to my auto-decrypted system drive... Thats been the case for years, and you can use it to dump the contents of a machine you've lost the login password to for example. I guess it wasn't supposed to!

smileybarry 3y ago
IIRC WinRE asks for a local administrator password before doing any recovery operations, no? Also, this is one of the reasons why "auto unlock" is generally a huge asterisk and PIN/password/network unlock are recommended instead, if possible. (Though they do force you to be a laptop nanny during update times and unlock it on every restart...)
- londons_explore 3y ago
  > WinRE asks for a local administrator password before doing any recovery operations, no? Not for the "Shift+F10" command prompt option....
  - smileybarry 3y ago
    Are you sure the system drive you see is the real drive and not just the bootable WinRE partition? You technically have two "?:\Windows" roots in that state, one of WinRE that just booted and one of the system you're restoring.
briHass 3y ago
Only if you don't use a TPM PIN and/or have a <2.0 TPM. Bitlocker using TPM with PIN has no way to know your hard drive key without asking the TPM, which requires the PIN (and has anti-hammering/lockout built in.)

Zenst 3y ago

I've followed the instructions and understand that they may seem overwhelming for some users. Instead of using command line methods, I opted for Windows Disk Management to shrink the drive's partitions and create the necessary space. It's surprising that a script hasn't been provided for this process, which suggests the complexity and potential pitfalls involved. This leads me to believe that the absence of a scripted, simple double-click solution is due to the intricate nature of the task. Consequently, I'm not optimistic about a prompt Windows Update fix, as many had hoped for. However, I anticipate that third-party developers will soon release scripts or programs to automate this process.

berkes 3y ago
I'd expect that "automatic disk and partition changes" have a rather high risk of severe data-loss.
- polonbike 3y ago
  It has, especially for non technical users who cannot double check the "automatic" parameters of the change
currysausage 3y ago
It looks like a PowerShell script is available now, but I don't think it's changing the partition size. Has anyone tried this out? https://support.microsoft.com/en-us/topic/kb5034957-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2024-20666-0190331b-1ca3-42d8-8a55-7fc406910c10 https://support.microsoft.com/en-us/topic/kb5034957-updating...
- concerned_user 3y ago
  I can only see it using dism to apply the patch but there is no commands to manipulate partition size so if the cause is lack of free space it will fail same as update did.

jug 3y ago

Haha! Yes, this was a mess! I was called to help my concerned stepson with "an update error" this past weekend. I'm a software engineer but even I kind of balked at it at first, realizing how very easily an on-the-fly resizing of partitions can go wrong! Let's take it from the beginning. He pointed me to the "out of disk space" error code, which isn't in text form to begin with, but only something you find out by googling it. I thought that must be wrong, because the drive is like 30% full. Knowing how this particular error is sometimes thrown inaccurately, I dug deeper and ended up in a long winded forum thread about all sorts of people and skill levels having issues. Novice home users. Advanced users. SERVER ADMINS. It soon dawned upon me that the disk space error was correct; it was only talking about it from the perspective of a tiny Windows Recovery Environment partition! Or "tiny"... It was like 300 MB large but not enough. It wanted something like another 500 MB now. People yelled at MS for not pulling the patch and fixing it or bringing an automated post-patch fix. BUT if this HAS to be done, MS is in a tough spot now. Because it's inadvisible to resize partitions automatically. You usually want backups as it's a high risk operation where power loss or bad input will brick the OS install. I also think how and if it can be resized depends on the layout on the partition table. For example, I had to reduce the end of a former partition to increase the start of the recovery one. Fortunately, I had free space there. I can imagine a Microsoft script wizard would have his heart sink as he'd ship an automated partition resizing script to millions of systems and all their intricacies. So, I'm not sure how MS will end up fixing this to be honest. My only "fix" would be to rewrite the code so that it don't need a larger Windows RE partition anymore?? OR simply not installing this patch if it's too small. Otherwise, this can only really be "safely" fixed as part of a fresh Windows install with hard drive reformatting and the whole shebang. I ended up fixing it with a free partition resize tool (MiniTool Partition Wizard). MS advised me to the command line but to hell with that and their ancient DISKPART.EXE and having to input the correct partition # for your partitions when there were like five of them on the drive. I needed something more visual as assistance to hand hold me from making mistakes. But how on Earth could this even happen? Did MS just kind of forget that they have had previous, smaller Windows RE requirements in the past?

actionfromafar 3y ago
I thought they had many computers of various configurations they test on. And wasn't there a release note describing what could happen? So some part of the org knew what was going to happen.

Frivolous9421 3y ago

[dead]

BiteCode_dev 3y ago

There is a case to be made to not install all updates as soon as they are available.

yreg 3y ago
I do that (wait a bit) on macOS and iOS, but I wasn't able to explain to my Windows that I don't want to update automatically. Especially in the middle of some overnight computing task.
- MacsHeadroom 3y ago
  This is a pro feature on windows. But you can enable it on home editions with some power shell commands or by side loading the program used to set the relevant settings on pro editions (group policy editor).
  - theyeenzbeanz 3y ago
    I have pro and it conveniently “forgets” my update settings and will still do it whenever if feels like. Microsoft doesn’t understand that no means no.
calebegg 3y ago
Do they dogfood these updates internally like Google does with Android and Chrome OS?
Prickle 3y ago
Did microsoft change that, or does Windows 10 Home still force users to install the latest updates immediately?

rvba 3y ago

Is it me or is Microsoft degrading user experience on Windows 10 with constant system breaking updates? It feels that most of them do nothing but slow the system down or change things for the sake of change (some project managers want to show they do something?). It feels like Microsoft is trying to "convince" users to switch to Windows 11 by making Windows 10 bad. At the same time Win 10 computers without this UEFI cannot be migrated to Win 11...

dist-epoch 3y ago
Or more likely they don't test for Windows 10 regressions as much.
- richbell 3y ago
  I wonder what their testing looks like these days. My impression is that they fired their QA and never looked back... https://news.ycombinator.com/item?id=20557488 https://news.ycombinator.com/item?id=20557488
chii 3y ago
once you've paid for win10, you as a user is no longer a revenue but a cost. And you can obviously guess what happens to costs.
- rvba 3y ago
  But why bother to change UI at all
  - lacrimacida 3y ago
    To make you buy what you currently have as a future feature

mariusmg 3y ago

Why do i get this faulty patch if i'm not even using Bitlocker ? Also how the heck does something like this happens ? Did MS forgot the size of the WinRE partion which THEY created ?

cesarb 3y ago
> Why do i get this faulty patch if i'm not even using Bitlocker ? You might not be using it now, but you might want to switch it on later. And more importantly, it prevents an exponential explosion on the amount of different variants of the code. If you allow people to not get this patch, and later another bug is fixed, either you force people to get this patch before getting the next one (leading to N different versions), or you'll have to develop a fix both for people who have and for people who don't have this patch (leading to 2^N different versions).

GTP 3y ago

Had the journalist tryied Linux, would have known that it gives much better error messages than some random looking number.

brettermeier 3y ago
It's about one-click-solutions what makes Windows a nice-to-use-tool, not the error messages.
crimbles 3y ago
Exit code 139. Hm.
- GTP 3y ago
  That's usually not the full error message, and you can still easily find the number's meaning by opening the man page of wathever piece of software terminated with that exit code.
  - nullindividual 3y ago
    Likewise, if you knew about err.exe, you'd also know how to be able to get the error message behind the error code.
  - crimbles 3y ago
    Depends really. If it's some kind of runtime or VM you pretty much have zero idea what the exit code was. Python, CLR, JVM tend to leave you in this mire.
    - GTP 3y ago
      Yes, but remember that usually nowadays a piece of software also logs something to stderr instead of relying just on exit codes to signal error.
      - crimbles 3y ago

brnt 3y ago

It's the year of the Linux desktop, everyone!

boopmaster 3y ago
Microsoft WinLinux 2024 Professional for 64bit extended systems Edition
- sidewndr46 3y ago
  If Microsoft licensed Linux, they would have something like 2*128 SKUs to describe all the different versions
ThrowawayR2 3y ago
The monkey's paw curls and WSL is what the Year Of Linux On The Desktop turned out to be.

hknmtt 3y ago

i remember reading years ago about the reason windows updates since 8 or 10 were so bad was because MS fired all testers and scrapped their testing hardware and now they are testing virtually in cloud. I guess nothing has changed, still. cost cutting at its best.

crimbles 3y ago
McDonald’s methodology. Optimise for volume not flavour and quality with a veneer of marketing bullshit smeared on it.
FirmwareBurner 3y ago
>MS fired all testers and scrapped their testing hardware and now they are testing virtually in cloud Do you have any sources for this? AFAIK, according to the LTT wan show when he was duiscussing his conversation with MS baout Windows sleep issues, he laerned MS still uses plenty of bare metal HW for testing, especailly notebooks and in no way got rid of it.
- toast0 3y ago
  The status quo was seperate software developers and software developers in test, and nearly equal numbers [1] (I haven't read this book, only the description, but seems authoritative). The new normal changed around 2014, as described in this Ars Technica article [2]. In order to ship more stuff, more quickly, Microsoft eliminated the developer in test roles, removing the bottleneck of a specific role in charge of quality and hoping to diffuse the responsibility. This addresses the 'fired all testers' part of your quote. I don't have references on the 'scrapped their testing hardware', but I imagine most testing hardware was maintained by developers in test, and when their positions were eliminated, they may not have had anyone to transfer the hardware to. [1] https://www.amazon.com/How-We-Test-Software-Microsoft/dp/0735624259 https://www.amazon.com/How-We-Test-Software-Microsoft/dp/073... [2] https://www.amazon.com/How-We-Test-Software-Microsoft/dp/0735624259 https://www.amazon.com/How-We-Test-Software-Microsoft/dp/073...
- hknmtt 3y ago
  No, i just remember a comment from some former MS dev who knew something about the testing process in MS. I think it might have even been a comment in here actually.

pm2222 3y ago

My win10 kept giving me “bug check” reboot treatment and I had to go win11 reluctantly. Oh well, there goes my vertical taskbar.

pm2222 3y ago
If only there’s a way to transfer my win oem license which comes with my laptop, I’d totally switch around the host/guest setup and shrink my host windows to a guest vm.
- WarOnPrivacy 3y ago
  Massgravel's MAS is an option. Not a license transfer but gets you an activated machine. HN appearances: https://hn.algolia.com/?query=massgravel&type=comment https://hn.algolia.com/?query=massgravel&type=comment
ripdog 3y ago
Note that there are tools to restore the win10 taskbar in 11. I use startisback, but there are more. Also be sure to use a privacy tweaker!

squarefoot 3y ago

FTA: "Showing an unhelpful error message and then requiring a user to delve into the world of the command line to fix things. What is this? Linux?" What did the author want, a button to push for each solution to every possible exotic error, even critical ones that would require to resize a system partition from a running OS? Seriously!? Of course one solve this through the command line. Or, if that wasn't what the author meant, then he may have to upgrade his Slackware 4.0 install, because a thing or two have changed in the Linux world.

brettermeier 3y ago
The beauty of Windows is that you have one-button-push-solutions that just work. If Linux would have that too, maybe even tech-unsavvy-users could handle it, but since Linux is made from freaks for freaks that won't happen. I mean, Linux people can't even see the problems of a not-one-click-solution, but for every normal user it's crystal clear. Command line is for tech users and really for nobody else. Nobody who isn't into tech want's to write in command shells, really, nobody!
- iforgotpassword 3y ago
  Sure, and I wouldn't want it any other way, or I'd just use Windows in the first place. That said, on Linux I still get error messages, not a big number – an actual message that tells me what didn't work so if googling that error message doesn't yield a solution, I can go ahead and try do fix the issue myself. I still remember from the Windows days when you were unlucky enough to hit a more unusual error code, where googling it didn't immediately result in a dozen forum threads with people posting the same issue and then some dude replying with a fix where you don't even know how they possibly figured that out. If you didn't find a solution googling the error code it basically meant you can try random shit until you accidentally fix it, or reinstall. On Linux I could just ultimately look at the source code of whatever component is broken and track back from where the error is printed.
graemep 3y ago
Its typical flamebait The Register is very fond of. I have seen entirely unnecessary references to everything from Brexit to religion on The Register. it works too. Lots of comments both on their own site and here purely in response to mentioning Linux in the subheading.

theknocker 3y ago

[dead]

kemotep 3y ago

The issue with the WinRE environment and Bitlocker bypass exploit has been known since at least last year with a January 2023 KB addressing the issue, but the WinRE environment still needed to be updated manually. Looks like 12 months later if you hadn’t already dealt with it, another issue can arise according to this article? More information on the fix can be found discussed here: https://old.reddit.com/r/sysadmin/comments/10atdqe/is_bitlocker_forever_compromised/ https://old.reddit.com/r/sysadmin/comments/10atdqe/is_bitloc...

eterevsky 3y ago

"These instructions are not for the faint of heart. The first link requires the user to open a command prompt window with administrative privileges. It's downhill from there ..."

867-5309 3y ago
sudo cmd.e×e | /bin/exorcise (edit: the actual extension triggered HN's blocker..)

ryzvonusef 3y ago

I also got this error... if I understand this correctly, they want a recovery partition of 250 MB... but I already have a recovery partition of 500 MB (acc to disk management, and lists it as 100% free)... so why am i getting this error? should I increase it by a further 250 MB (for a total of 750 MB), or are they just plain crazy?

khaledh 3y ago
The update requires 250 MB of _free_ recovery partition space, not the total size of the partition.
- ryzvonusef 3y ago
  but my 500 MB partition is listed as 100% free by disk management is it that not accurate? how do i find out how much actually free space i have?

noufalibrahim 3y ago

"When there's a shell, there's a way".

kotaKat 3y ago

Can Microsoft just bring back a proper QA department instead of leaving it to unpaid "Insiders" who drink the Flavor-Aid and think Microsoft can't code a single thing wrong?

zamadatix 3y ago
Based on the feedback community I don't think that's a particularly accurate take of Insiders as a whole. That said it's been ~10 years now since they dumped the traditional QA department (which involved more than just leveraging external user validation) and I honestly can't say Windows is blowing up any more than it was the previous 10 years to that. I'd really like to see some actual measured statistics of e.g. patch issue outages at a health system over the last 20 years though.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- salawat 3y ago
  Gee... Let me forward that request to our QA depart... Oh. Oops.

tussa 3y ago

Didn't Bill Gates "kill the command line" in a infamous video when Windows 95 came out?

bni 3y ago
I think it was DOS he killed. But I get what you mean. When Microsoft was completely dominating the IT landscape during the 2000's command lines was often sneered at by "Microsoft Certified Professionals"
sp332 3y ago
Sure but they released PowerShell in 2006, a few years after he stepped down as CEO.

keeganjw 3y ago

I had this update issue on a fresh install of Windows 11 at work. Then I went home and had it on my Windows 10 laptop... thank you Microsoft :|

dukeofdoom 3y ago

As former windows Dev, I remember getting supper frustrated with their Windows upgrade. You could no longer reliably write to your install folder. They started forcing you to write to the registry, then to data folder, then other places. So you had to split up the install "ten ways" how and where you kept your data. HKEY local machine, HKEY_Current_User, and so on .. then ask for elevation to install. I vaguely remember debugging a bug where I would delete a file in my install folder. But then found out windows was restoring an older version of it in the background. c:\program files was virtualized, and not really a directory anymore.

tonyedgecombe 3y ago
>You could no longer reliably write to your install folder. I think that came in with Windows XP and it was a good thing. Letting user programs write into a folder full of executables is terrible for security.

bitwize 3y ago

"I use Windows because I don't want to have to go to the command line to fix one simple thing." Yeah, join the club. Actually you've been in the club. A few years back I had Windows decide that I didn't have permission to access my own user directory anymore, resulting in a system with a glitchy Explorer and taskbar where nothing worked. To fix things I had to drop into an administrator console, create a new user, then move all my old files from the old user account to the new one and change ownership and permissions on them. So no, the idea that Windows is easier because graphical is BS. If the system is going to get into weird failure modes that I need to type commands to démerde myself out of anyway, I'm just going to stick with Linux and NetBSD.

merb 3y ago

btw. I got this error after installing windows 10pro 22h2. So it’s extremely stupid

fomine3 3y ago

Don't forget to run dism /online /cleanup-image /restorehealth ! /s