Blue Screen on RE Rescue Media


Author
Message
Dan Danz
Dan Danz
Macrium Hero
Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)
Group: Forum Members
Posts: 1.2K, Visits: 9.5K
2023-12-05  Major Update on the use of WinRE-10 as a base for Reflect Rescue Media (RM) builds.
On my Windows 10 Pro system, running MR 8.1.7784 on Win 10 22H2 19045.3693 I took these steps to install a dreaded Windows Update Preview fix.
  1. Created safety incr backup -01
  2. Verified that I had RM on a flash drive as well as WRBM in case the test to build new RM in WRBM format failed. I would have something that could be used to restore from the safety backup.
  3. Verified with REAGENTC /INFO that Recovery code is located in Partition 4 of my system disk
  4. Windows Update downloaded 2023-11 Cumulative Update Preview for Windows 10 Version 22H2 for X64 based Systems (KB5032278)
    The Windows 11 version of this Preview update had already been installed on my Win 11 Laptop without issues.
    (Preview Updates to Win 11 had never shown any problems, only Preview updates on Win 10 systems).
  5. Windows Update installed the majority of the update package, then required a system restart to install the remainder.
  6. Created safety incr backup -02
  7. Rebooted to finish the install of the Windows Update package
  8. Rebooted and now up and running updated Windows 10 22H2 19045.3758
  9. MR has not been changed yet -- it is still running version 8.1.7784 with WinRE from 19045.3693 but the OS is different.
  10. Verified with REAGENTC /INFO that the Recovery package is still in Partition 4 of my system disk.
  11. Forced WRBM rebuild - using MR 8.1.7784 with WinRE 10 with whatever changes have been made to the recovery partition.
  12. Rebooted to Rescue Media by booting the newly built RM
  13. RM loaded cleanly and ran without any problems. (Whew) I verified that I can see all disks, can view existing backups, and can browse one of those backups.
So, I think the recent cautionary attitude about Windows Update Preview patches can be relaxed, at least regarding the subject of this forum topic: Windows 10 BSOD's when booting RM with error 0x0504 and missing the ntoskernel.exe file.  I still recommend that any MR user ensure that backups are current especially BEFORE installing any update that Microsoft has designated as a Preview.  Some additional notes: If MR has not been updated since the last RM was built then after the Windows Update the Build of RM will have to be forced (hold the Ctrl key while selecting Build) to include the latest WinRE in RM.  In addition, any user that previously had a BSOD crash with RM built on WinPE should cautiously retest by rebuilding RM after installing this latest Windows 10 Preview update.

Edited to insert step 2 in the testing sequence.


L.W. (Dan) Danz, Overland Park KS
Reflect v8.1.7847+ on Windows 11 Home 23H2 22631.3085+ | Reflect v8.1.7853+ on Windows 10 Pro 22H2 19045.3996+
Reflect v8.1.7784+ on 2 systems Windows 10 Home 22H2 19045.3803+

Edited 5 December 2023 11:46 PM by Dan Danz
JL Arranz
JL Arranz
Talented Member
Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)
Group: Forum Members
Posts: 90, Visits: 235
Summary: I did a WinRE v8.1.8771 RM after installing KB5032278 and forcing WIM rebuild (iso file burned to cdrw, slightly different in size -=> changed file- from previous equivalent and also BSOD'ing one -WinRE v8.1.7771 too but before KB5032278-), but it does the ntoskrnl.exe BSOD as well.

Yesterday I installed KB5032278 in my Windows 10 pro system. Idk how "previews" are managed but my KB5032278 isn't a preview. My recent list of Windows updates until my latter "preview" is this (retranslated from Spanish, the text might not match exactly English versions):

12-06 KB5032278 2023-11 Cummulative update for Windows 10 version 22H2 x64 systems (*)
11-16 KB5032189 2023-11 Cummulative update for Windows 10 version 22H2 x64 systems
11-16 KB5032339 2023-11 Cummulative update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 version 22H2 x64
11-04 KB4023057 Update for Windows 10 version 22H2 x64 systems
10-27 KB5031445 2023-10 Cummulative update for Windows 10 version 22H2 x64 systems
10-27 KB5031904 2023-10 Preview version of the cummulative update of .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 version 22H2 x64

(*) It's "2023-11", not 12. Idk since when it was at my disposal as I went manually to Windows Update "yesterday" (although after 24:00) for the first time after 11-16 updates.

Windows update isn't reporting newer updates here, although I haven't clicked on "Search for updates".

I don't have a rule against previews. In Windows Vista times I had a list of "banned" (by me) updates that weren't compatible with one or other software, but since it I basically install any Windows Update that pops up.

My latter working WinRE RM is a v8.1.7638 iso done in September 6th.

I'm not installing v8.1.7784 version because some users have reported that its RM's default to rebooting after a restore. I've explained in "its" thread what do I have against an automatic (and likely unattended) reboot, although I don't consider it confirmed, it might be something of some systems. Baseline: I use traditional and simple MBR setups (except in Windows 11 where it's UEFI/GPT but simple too), so "modern enough" is enough for me and "latter" is desirable but not critical. If I see possible failures or drawbacks I don't update. In modern Windows versions you can delay but not stop or "ban" Windows Updates afaik.

typo editted

Edited 6 December 2023 10:55 AM by JL Arranz
dbminter
dbminter
Macrium Evangelist
Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)Macrium Evangelist (7.7K reputation)
Group: Forum Members
Posts: 4.8K, Visits: 52K
I've never done it, but there is a way to "blacklist" bad Windows Update updates.  You basically boot the Windows installation media where you can uninstall a bad update.  I don't know then if it's blacklisted there or you have to do it in Window proper, but I've read there is (Or used to be.) a way to prevent that bad update from being installed again.

Frank Esposito
Frank Esposito
Advanced Member
Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)Advanced Member (503 reputation)
Group: Forum Members
Posts: 353, Visits: 906
I don;t recall  where I got this  from  but 

wushowhide.diagcab

can be use to  stop the  install of an  update on win 10

Reflecting Mirror
Reflecting Mirror
Advanced Member
Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)Advanced Member (445 reputation)
Group: Forum Members
Posts: 248, Visits: 908
The method I have been using to avoid MS Preview OS patches is to pause updates until 1 day past the next production release which is always the second Tuesday of each month after 10 AM Pacific Time Zone in the USA.

Once I have completed all MS patching of the OS and manual update my Office software, in Windows 10 I perform the following:
  • Open Windows Settings
  • Click on Update & Security
  • Click on Advanced Options
  • Scroll down to the bottom to "Pause updates" and set the date for the next month to be one day after the second Tuesday of the next month which is the next production release.
When the next patch Tuesday arrives with the time being after 10 AM PT, I pad it about 10 - 15 minutes after 10 AM PT, and I am ready to patch my system, go into Settings > Update & Security to click on the button "Resume updates".

Once all patching is completed, setup the pause updates for the next month as shown above.
Edited 6 December 2023 3:51 PM by Reflecting Mirror
Dan Danz
Dan Danz
Macrium Hero
Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)
Group: Forum Members
Posts: 1.2K, Visits: 9.5K
JL Arranz - 6 December 2023 10:49 AM
<snip>
Yesterday I installed KB5032278 in my Windows 10 pro system. Idk how "previews" are managed but my KB5032278 isn't a preview. My recent list of Windows updates until my latter "preview" is this (retranslated from Spanish, the text might not match exactly English versions):

12-06 KB5032278 2023-11 Cummulative update for Windows 10 version 22H2 x64 systems (*)

Hi @JL Arranz -- I'm confused --- and maybe it's a translation problem when you translated the titles to English as you said above

I just did the same list of applied updates on my Windows 10 system Windows Update History, as you did and here is how it listed the update:

The word Preview is definitely present in the update title, and if you Google search for "KB5032278", every hit that comes back for that search has the word Preview in the title.  When the same fix(es) are released to the entire user community, it will be assigned a different KB number.  That will happen after the next Patch Tuesday Dec 12.  So I think you installed the KB5032278 Preview version , but as I posted this latest Preview did not damage the Recovery code, and Rescue Media built with WinRE is not damaged.   If you continue to get the BSOD with ntoskernel.exe missing when you boot rescue media, then you probably were infected iby installing one of the earlier bad Preview updates.   (You should look as far back as July 2023 in the update history -- the bad updates are KB503300 and KB5029331). 

Earlier, when this topic was first opened, two monthly PREVIEW updates damaged the ability to use Win RE when building Rescue Media. The damaging change that was present in the first Preview KB5029331 did not get carried forward in the next NON-PREVIEW (Patch Tuesday) updates, and instead reappeared in the next months PREVIEW KB503300, and again did not get carried into the next NON-PREVIEW version.   However, once anybody installed one or both of the PREVIEW versions, it had to be uninstalled (or the system restored from backup) to undo the damage to WinRE.  Any Rescue Media built based on WinRE with the bad Recovery partition will fail to boot.  It has to be rebuilt after any of the bad updates have been removed. 

Edited to correct this statement: Later Preview versions of updates (after KB503300) don't INTRODUCE the problem. Non-preview Cumulative updates AFTER 2023-09 appear to fix the problem with the recovery partition, and damaged RM built on WinRE 10 can be fixed by a Forced Rebuild after the Windows Update has been applied. 


L.W. (Dan) Danz, Overland Park KS
Reflect v8.1.7847+ on Windows 11 Home 23H2 22631.3085+ | Reflect v8.1.7853+ on Windows 10 Pro 22H2 19045.3996+
Reflect v8.1.7784+ on 2 systems Windows 10 Home 22H2 19045.3803+

Edited 12 December 2023 6:03 PM by Dan Danz
JL Arranz
JL Arranz
Talented Member
Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)Talented Member (104 reputation)
Group: Forum Members
Posts: 90, Visits: 235


In Spanish "preview" is much longer ("versión preliminar de", word by word except adjective/substantive order is "preview version of").

In my entire list I've only found that "preview", along with one update named in English ("2023-02 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5022834)") and others with typos ("sistemas basados enx64" instead of "sistemas basados en x64" -"x64-based Systems"-). Maybe there're interferences in the translating channel... Can the preview and not preview of the same share the same KB number? I might have installed KB5032278 quite late respect its first appearance somewhere or even in my own system. I read your previous post, went manually to Windows update, installed it manually, and did the failing iso.

For the records I don't blame any user for this Smile . I'm expert myself in many things, but I definitely don't dominate this. Uninstalling an update from months ago doesn't sound me correct, who knows how many billions of extremely small things could have developed on that everywhere. This system works well. If I were urged to get a very modern WinRE RM I'd try searching how to find the damaged *.ini or registry key or whatever and fix it manually, learning to dominate the issue at the same time. My situation in Spanish is called "like a goat in a garage". Where's the grass and etc (ini files, registry keys, executables that I might try to edit,...).

Edited 6 December 2023 10:04 PM by JL Arranz
Dan Danz
Dan Danz
Macrium Hero
Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)
Group: Forum Members
Posts: 1.2K, Visits: 9.5K
JL Arranz - 6 December 2023 9:26 PM


In Spanish "preview" is much longer ("versión preliminar de", word by word except adjective/substantive order is "preview version of").

In my entire list I've only found that "preview", along with one update named in English ("2023-02 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5022834)") and others with typos ("sistemas basados enx64" instead of "sistemas basados en x64" -"x64-based Systems"-). Maybe there're interferences in the translating channel... Can the preview and not preview of the same share the same KB number? I might have installed KB5032278 quite late respect its first appearance somewhere or even in my own system. I read your previous post, went manually to Windows update, installed it manually, and did the failing iso.

For the records I don't blame any user for this Smile . I'm expert myself in many things, but I definitely don't dominate this. Uninstalling an update from months ago doesn't sound me correct, who knows how many billions of extremely small things could have developed on that everywhere. This system works well. If I were urged to get a very modern WinRE RM I'd try searching how to find the damaged *.ini or registry key or whatever and fix it manually, learning to dominate the issue at the same time. My situation in Spanish is called "like a goat in a garage". Where's the grass and etc (ini files, registry keys, executables that I might try to edit,...).

I tested KB5022834.  It does not introduce a problem.  If you have the problem, it has to come from the two patches I mentioned in the post you responded to.


L.W. (Dan) Danz, Overland Park KS
Reflect v8.1.7847+ on Windows 11 Home 23H2 22631.3085+ | Reflect v8.1.7853+ on Windows 10 Pro 22H2 19045.3996+
Reflect v8.1.7784+ on 2 systems Windows 10 Home 22H2 19045.3803+

Dan Danz
Dan Danz
Macrium Hero
Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)Macrium Hero (2.7K reputation)
Group: Forum Members
Posts: 1.2K, Visits: 9.5K
Dan Danz - 6 December 2023 10:48 PM
JL Arranz - 6 December 2023 9:26 PM


In Spanish "preview" is much longer ("versión preliminar de", word by word except adjective/substantive order is "preview version of").

In my entire list I've only found that "preview", along with one update named in English ("2023-02 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5022834)") and others with typos ("sistemas basados enx64" instead of "sistemas basados en x64" -"x64-based Systems"-). Maybe there're interferences in the translating channel... Can the preview and not preview of the same share the same KB number? I might have installed KB5032278 quite late respect its first appearance somewhere or even in my own system. I read your previous post, went manually to Windows update, installed it manually, and did the failing iso.

For the records I don't blame any user for this Smile . I'm expert myself in many things, but I definitely don't dominate this. Uninstalling an update from months ago doesn't sound me correct, who knows how many billions of extremely small things could have developed on that everywhere. This system works well. If I were urged to get a very modern WinRE RM I'd try searching how to find the damaged *.ini or registry key or whatever and fix it manually, learning to dominate the issue at the same time. My situation in Spanish is called "like a goat in a garage". Where's the grass and etc (ini files, registry keys, executables that I might try to edit,...).

I tested KB5022834.  It does not introduce a problem.  If you have the problem, it has to come from the two patches I mentioned in the post you responded to.
 I answered your question earlier.  The preview version and the public version do NOT share a KB number.


L.W. (Dan) Danz, Overland Park KS
Reflect v8.1.7847+ on Windows 11 Home 23H2 22631.3085+ | Reflect v8.1.7853+ on Windows 10 Pro 22H2 19045.3996+
Reflect v8.1.7784+ on 2 systems Windows 10 Home 22H2 19045.3803+

RayG
RayG
Expert
Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)Expert (724 reputation)
Group: Forum Members
Posts: 349, Visits: 1.5K
Dan Danz - 5 December 2023 11:38 PM
2023-12-05  Major Update on the use of WinRE-10 as a base for Reflect Rescue Media (RM) builds.
On my Windows 10 Pro system, running MR 8.1.7784 on Win 10 22H2 19045.3693 I took these steps to install a dreaded Windows Update Preview fix.
  1. Created safety incr backup -01
  2. Verified that I had RM on a flash drive as well as WRBM in case the test to build new RM in WRBM format failed. I would have something that could be used to restore from the safety backup.
  3. Verified with REAGENTC /INFO that Recovery code is located in Partition 4 of my system disk
  4. Windows Update downloaded 2023-11 Cumulative Update Preview for Windows 10 Version 22H2 for X64 based Systems (KB5032278)
    The Windows 11 version of this Preview update had already been installed on my Win 11 Laptop without issues.
    (Preview Updates to Win 11 had never shown any problems, only Preview updates on Win 10 systems).
  5. Windows Update installed the majority of the update package, then required a system restart to install the remainder.
  6. Created safety incr backup -02
  7. Rebooted to finish the install of the Windows Update package
  8. Rebooted and now up and running updated Windows 10 22H2 19045.3758
  9. MR has not been changed yet -- it is still running version 8.1.7784 with WinRE from 19045.3693 but the OS is different.
  10. Verified with REAGENTC /INFO that the Recovery package is still in Partition 4 of my system disk.
  11. Forced WRBM rebuild - using MR 8.1.7784 with WinRE 10 with whatever changes have been made to the recovery partition.
  12. Rebooted to Rescue Media by booting the newly built RM
  13. RM loaded cleanly and ran without any problems. (Whew) I verified that I can see all disks, can view existing backups, and can browse one of those backups.
So, I think the recent cautionary attitude about Windows Update Preview patches can be relaxed, at least regarding the subject of this forum topic: Windows 10 BSOD's when booting RM with error 0x0504 and missing the ntoskernel.exe file.  I still recommend that any MR user ensure that backups are current especially BEFORE installing any update that Microsoft has designated as a Preview.  Some additional notes: If MR has not been updated since the last RM was built then after the Windows Update the Build of RM will have to be forced (hold the Ctrl key while selecting Build) to include the latest WinRE in RM.  In addition, any user that previously had a BSOD crash with RM built on WinPE should cautiously retest by rebuilding RM after installing this latest Windows 10 Preview update.

Edited to insert step 2 in the testing sequence.

I have just tried a different way to fix the issue.

I looked back through my backup archives and found on that was dated August 30th 2023. (before the faulty patch)
I got MR to restore JUST the recovery partition (partition 4)
Rebooted the system
Rebuilt the RE version for the boot menu
Rebooted and went into MR Recovery and it booted perfectly
The system also appears to be just fine when booted normally.

I assume that when the cumulative update for December is installed any discrepancies with the recovery partition will be fixed.
If that is not the case a repair install should also resolve the situation.

Any flaws in my process you can think of?

Regards
RayG
Windows10 Pro X64 V22H2 B19045.3803 MR v8.1.7784
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Reading This Topic

Login

Explore
Messages
Mentions
Search