Windows Recovery Environment explained

[Guest aaronlower]

The Windows Recovery Environment (WinRE) is a companion operating system installed alongside Windows 10, typically in a separate partition, that can help with troubleshooting, recovery, or booting from external media, such as a USB stick. WinRE is also used during the Windows update process to apply updates in specific paths or phases. (This process is sometimes referred to as SafeOS.)

 

In this post, we're going to walk you through the tools in WinRE, offer tips and tricks for using it effectively, and, while we're at it, clear up common misconceptions around WinRE. We’ll also show how WinRE can enable a Windows 10 device that might have issues starting or applying the latest updates, get back to a good state.

 

An overview of WinRE

 

 

When talking to IT pros, enthusiasts, and other Microsoft employees, I like to refer to WinRE as the “blue screen of life.” Some agree with me out of politeness, but I believe the phrase resonates with many people because, at the end of the day, WinRE is typically used to fix something.

 

WinRE is almost always located in a separate partition that immediately follows the main Windows partition. (For more details on the default partition layout for UEFI-based PCs, see our partition layout documentation.)

 

If you are familiar with Windows PE (WinPE), this may sound similar. Think of WinPE as the base OS and WinRE as the user interface with some recovery tools added.

 

When you launch WinRE, you may see these options: Continue (exit WinRE and continue to Windows 10), Use a device (use a USB drive, network connection, or Windows recovery DVD), Troubleshoot (reset your PC or use advanced options), and Turn off your PC.

 

 

Figure 1. Initial WinRE menu options

 

Accessing WinRE

 

 

You can access WinRE via multiple entry points:

 

• From the Start menu, select Power then select and hold down the Shift key while selecting Restart.
  
• In Windows 10, select Start > Settings > Update & Security > Recovery. Under Advanced startup, select Restart now.
  
• By booting to recovery media.
  
  • Note: an easy way to create recovery media is to use the Media Creation Tool or to create a recovery drive and uncheck the Back up system files to the recovery drive option.
    

  [*]A hardware recovery button (or button combination) configured by the OEM.

 

Here are two lesser-known ways to access WinRE:

 

• Use REAgentC. From Windows 10, run a command prompt as an administrator, then type reagentc /boottore. Restart the device and it will load WinRE instead of Windows 10.
  
• The shutdown command also has an entry point for WinRE. Run command prompt as an administrator and type shutdown /r /o.
  

 

Okay, so now that you’re in WinRE, what can you do?

 

Depending on how you started WinRE, the options may differ. For example, if you boot from a USB stick, the Reset this PC option does not appear. You can continue to Windows 10 or turn off your PC.

 

If the options presented are not desired, select Continue to start Windows 10. Likewise, the Turn off your PC option will shut down the device. If you have multiple operating systems installed, this would also be where you could select which OS to boot.

 

Use a device

 

 

This option helps you boot from another source such as USB, DVD, or even a network connection. This can be helpful as it is simpler than some BIOS/Unified Extensible Firmware Interface (UEFI) menus and provides a consistent experience.

 

Troubleshoot

 

 

WinRE has many troubleshooting tools to help you get devices back to a good state quickly and easily. For more information, see Use WinRE to troubleshoot common startup issues.

 

Now, let’s explore the options available in the Troubleshoot category.

 

Reset this PC

 

 

Resetting a PC reinstalls Windows 10, but lets you choose whether to keep your files or remove them before reinstalling Windows. Reset this PC is the most popular option and offers a few options. (You can also access Reset this PC from the Settings menu if you can successfully start Windows 10.) For more information on Reset this PC, see Recovery options in Windows 10. I'll also dive deeper into Reset this PC in future posts, so stay tuned!

 

 

Figure 2. The Advanced options menu

 

Startup Repair

 

 

If Windows fails to start twice, the third attempt will run Startup Repair automatically. This is also available as an option on the advanced options page of troubleshooting. Startup Repair can help fix a corrupt master boot record (MBR), partition table, or boot sector. Beginning with Windows 10, version 1809, automatic Startup Repair also removes the most recently installed update if that installation immediately preceded the startup failure.

 

Startup Settings

 

 

Another troubleshooting step is to change how Windows starts up. Enabling debugging or boot logging can help identify a specific issue. This is also where you can enable Safe Mode. Check out the support page on Startup Settings for more information.

 

Command Prompt

 

 

While not the most approachable tool for unfamiliar users, the command prompt is the most powerful and dynamic tool in WinRE. It can do everything from registry edits to copying files to running Deployment Image Servicing and Management (DISM) commands. Next, we’ll cover a few notable examples. (Note that while using Command Prompt in WinRE, it automatically runs with elevated administrator permissions.)

 

Copying files

 

If you need to copy a few files from your device before reinstalling Windows, using a USB drive or network share can be a quick way to do this using the command prompt within WinRE.

 

There is also a popular Notepad trick that makes it easier to copy files. I love it and wish I could take credit as it a big timesaver for visual people like me. !

 

Chkdsk

 

Running chkdsk is a common first step to help resolve issues. This process checks the file system and file system metadata of a volume for logical and physical errors. (While in WinRE, drive letters may be assigned differently than in Windows 10. You can run BCDEdit to get the correct drive letters.)

 

SFC

 

SFC scans and verifies the integrity of all protected system files and replaces incorrect versions with correct versions. If this command discovers that a protected file has been overwritten, it retrieves the correct version of the file, and then replaces the incorrect file.

 

Repair corrupt components using DISM

 

Windows system components may become corrupt from hard drive malfunctions or update issues. If you have a wired ethernet connection, you can turn on networking to then scan and repair corrupted content using Windows Update and the /Cleanup-Image switch in DISM.

 

From the command prompt, type wpeinit and Enter to turn on the networking stack then type the following command:

 

 

dism /image:c:\ /cleanup-image /restorehealth

 

 

Figure 3. Using DISM within the command prompt in WinRE

 

Registry Editor

 

Yes, you can use regedit within Windows RE, but warning: this is a powerful tool that can really mess things up if not used correctly! Keep in mind the X:\ drive is the WinRE OS and has its own registry. C:\ is likely where the Windows 10 registry is.

 

 

Figure 4. Launching the Registry Editor from the command prompt in WinRE

 

Uninstall Updates

 

 

Removing the latest updates recently installed to Windows 10 can be a good troubleshooting step if you are having trouble starting your PC or if you are having trouble uninstalling something within Windows 10. Simply select Uninstall latest quality update or Uninstall latest feature update to uninstall the desired update from WinRE with just a couple of steps. Please note; however, that you should reapply the latest updates as soon as possible to help keep your devices protected and productive.

 

 

Figure 5. The Uninstall Updates menu

 

UEFI Firmware Settings

 

 

This option makes it easy to boot into the UEFI menu to change firmware settings, especially as the many different devices offered by OEMs use different keyboard or button combinations to access UEFI. For example, some use volume buttons, function keys, the delete key, or a combination therein. WinRE provides a consistent method for accessing UEFI firmware settings across all devices.

 

System Restore and System Image Recovery

 

 

These two options can be useful if you are using legacy system restore features or image-based recovery. The System Restore option can restore your PC to a previous restore point which, for example, could undo the latest win32 application installation if you captured a restore point prior to the installation.

 

Recovery Drive

 

 

Creating a recovery drive is a built-in Windows ability that can easily create a USB drive with WinRE. Optionally, it can also “back up system files to the recovery drive,” a process that takes a while but will fully reinstall Windows onto that same system even if the hard drive is blank. This is often referred to as Bare Metal Recovery (BMR). When starting your system from a Recovery Drive, you will notice that is uses WinRE to perform the recovery. You will need to pick your language first and there will then be an option on the first screen to “Recover from a drive.”

 

Managing WinRE

 

 

WinRE can help devices recover back to Windows, but, if needed, it can be disabled by opening an elevated command prompt and using the reagentc /disable command. By disabling WinRE, however, some Windows 10 features may not work, including many outlined in this blog post. Additionally, WinRE will be re-enabled after a feature update is installed as it is a critical part of the update process.

 

Permission and authentication

 

 

If you are a Windows Insider taking flights, you may have seen a behavior change on Windows 10 Insider Preview Build 19536 and later, where the default authentication requirements for WinRE are different. Previously, most tools and actions required local admin credentials but were not able to use modern credentials like Windows Hello (face, PIN, fingerprint). This became a big problem with passwordless accounts and Azure Active Directory accounts that weren’t backed up with a local admin account. To address this, we changed the default behavior to no longer require local administrator authentication to access WinRE tools.

 

If you manage devices using mobile device management (MDM) solutions such as Microsoft Endpoint Manager, you can configure the Security/RecoveryEnvironmentAuthentication policy if you would like to require local administrator authentication to use WinRE components.

 

Other interesting things

 

Booting into RAM

 

 

WinRE can be installed in the same partition as Windows, but it is usually installed in the Recovery or WinRE tools partition. Regardless of where it is installed, it always runs in the RAM (or RAM disk boot) and is assigned the X:\ drive. This is important to note because any changes you make to X:\ will not be saved after a reboot.

 

BitLocker

 

 

Depending on the combination of your entry points to WinRE, how BitLocker is configured (auto-unlock), and what WinRE option you select, you may be prompted for the BitLocker recovery key to unlock your Windows partition. As an example, when launching a command prompt, you will be prompted to unlock BitLocker. If you skip the unlock process, the Windows installation drive will remain locked, but you will have access to the X:\ drive, where WinRE runs in RAM.

 

BootIM.exe

 

 

One potentially confusing thing about WinRE is the implementation of BootIM.exe. Most won’t see a difference, but I want to explain how this works. When using the entry point from the lock/login screen and holding the Shift key or Settings > Advanced Startup, Windows 10 is not rebooting into WinRE. Instead, it is entering pre-shutdown and showing the BootIM screen which looks exactly like WinRE. If you select an option that needs to change the boot flag like Use a device, it saves you one restart because you don't have to start WinRE to then restart the system again using a device.

 

You can see this functionality by running BootIM.exe from an elevated command prompt, but a quick tip is to open Task Manager beforehand so you can easily use the Alt + Tab combination and end the task when you are done. If you are a Windows Insider taking flights, you will see a behavior change beginning with Windows 10 Insider Preview Build 19577 to enable greater accessibility within this experience. As the pre-shutdown behavior doesn’t support Narrator or other accessibility features, BootIM will only be used if WinRE isn’t available. Otherwise, the system will restart directly to WinRE and skip BootIM.

 

Partition layout

 

 

Prior to Windows 10, the recommended partition layout was to place the recovery partition before the OS partition. Unfortunately, this made it difficult to update WinRE. For Windows 10, we updated the recommendation to always list WinRE immediately after the OS partition. Depending on how Windows was originally installed, your partitions may not have this layout.

 

Even with the updated recommendation, OEMs have the flexibility to choose a different partition layout for specific solutions. When installing from USB, the legacy layout was still being used by some partners until it was formally updated in Windows 10, version 20H1. For example, in this screenshot from a newer laptop, the OEM put an Recovery Partition where it needs to go, last in line.

 

 

Figure 6. A Disk Management partition layout example

 

Recovery partition labeling

 

 

The WinRE partition can have any volume label or no label, but the most common labels are WinRE tools, WinRE, or Recovery. The label is subject to change upon update. The status could also say OEM Partition or Recovery Partition.

 

The WinRE partition shouldn’t have a drive letter assigned and any folders or files should not be available for editing. A common misunderstanding is that the recovery partition contains a compressed copy of Windows and that this copy is what is restored during the reset process. This is not the case. This partition only contains WinRE and drivers. The size can vary depending on how it was configured by the OEM (e.g., what languages and drivers were included).

 

 

Figure 7. An example of labels within the Disk Management partition

 

Conclusion

 

 

In closing, I hope this information has been helpful and helps provide greater understanding about WinRE. As we continue to improve, we are always interested in your ideas and feedback, and ask that you please share them in Feedback Hub (<-- this is direct link to the Advanced startup category that includes WinRE).

 

If you have ideas or requests on other aspects of recovery you’d like us to share, please let us know in the comments section below.

 

Continue reading...