We may have been here before you and I. Your build has messed up. Partitions have been setup wrong. So not what? Your recovery partition is broken. This causes problems with encryption any much more.<\/p>\n\n\n\n
So what do we do? The solutions out there are generally fix the build and rebuild the device. Wow. Intrusive right?<\/p>\n\n\n\n
So\u2026 What other options are there? Rebuild it of course. Yes, you can do this.<\/p>\n\n\n\n
Firstly you need some http\/https source to store a few files.<\/p>\n\n\n\n
In particular :<\/p>\n\n\n\n
Wherever you get these from is your choice but these are what are needed.<\/p>\n\n\n\n
Now you have them you can rebuild your recovery partition. Chances are the recovery partition is too small. This seems to be the main reason from what I\u2019ve seen. In Intune, you can solve this using remediation scripts.<\/p>\n\n\n\n
Using a remediation script it will run the script over and over until it detects that everything is okay. You may want to add checks to make sure you don\u2019t end up with a tiny OS partition \ud83d\ude09<\/p>\n\n\n\n
Now I\u2019m not going to say this is the best solution out there. I\u2019m sure someone will be all like \u201coh but you could do this\u2026\u201d etc. but this DOES work.<\/p>\n\n\n\n
So\u2026 Firstly you need to have a Detection Script. This is easy enough. You can use reagentc <\/strong>and check for the results:<\/p>\n\n\n\n So this was easy right? Run a command and get the output. If it returns that WinRE is enabled then it\u2019s ok.<\/p>\n\n\n\n If it\u2019s not OK. Most people will tell you to rebuild, but wait a minute: we have Intune at our disposal. So let\u2019s actually fix it. Remediation scripts are the thing here. Detection will find the error and remediation will fix it.<\/p>\n\n\n\n So what does this do? OK. This was based on a script that someone else gave me (Andrew T) but this one works after much trial and error and testing. Essentially it searches for and deletes the recovery partition. Shrinks the OS partition and then it will recreate it correctly and copy the files necessary for it to be a recovery partition and set some gpt attributes so Windows will know that is what it is. Once this has one it\u2019s stuff and a reboot (obviously) happens then the recovery partition will show as ok.<\/p>\n\n\n\n This is not the most graceful of solutions but across multiple tenancies it works! It doesn\u2019t need a rebuild so if this is your problem then have a look at the above. It may help.<\/p>\n<\/body>","protected":false},"excerpt":{"rendered":" We may have been here before you and I. Your build has messed up. Partitions have been setup wrong. So not what? Your recovery partition is broken. This causes problems with encryption any much more. So what do we do? The solutions out there are generally fix the build and rebuild the device. Wow. Intrusive […]<\/p>\n","protected":false},"author":1,"featured_media":27,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[24,30,1],"tags":[],"class_list":["post-297","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-intune","category-remediation","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t$status2 = reagentc \/info
Try {
if ($status2 -match 'Enabled'){
Write-Output \"Compliant\"
Exit 0
}
Write-Warning \"Not Compliant\"
Exit 1
}
Catch {
Write-Warning \"Not Compliant\"
Exit 1
}<\/code><\/pre>\n\n\n\nStart-Transcript -Path C:\\temp\\RemediateWinRE.log\n\nwrite-host \"Rebuilding WinRE\"\n\n\t# Remove recovery files from the boot drive\n\tcd C:\\Windows\\System32\\Recovery\n\tattrib -r -a -s -h *.*\n\tdel *.*\n\n #Find the OS Partition\n $osdisk = get-partition | where-object Type -eq \"Basic\"\n #Record the partition number\n $ospartition = $osdisk.PartitionNumber\n #Find the current size\n $size = (get-partition -disknumber 0 -partitionnumber $ospartition).Size\n #Shrink by 200Mb\n $size2 = $size - 209715200\n #Shrink OS partition by 200Mb\n resize-partition -DiskNumber 0 -PartitionNumber $ospartition -Size $size2\n #Find recovery partition\n $recoverydisk = get-partition | where-object Type -eq \"Recovery\"\n #Record the partition number\n $recoverypartition = $recoverydisk.PartitionNumber\n #Delete the recovery partition\n Remove-Partition -disknumber 0 -partitionnumber $recoverypartition -confirm:$false\n #Create the Diskpart commands (powershell can't create a recovery partition)\n $diskpath = \"C:\\OSInst\\BuildLogs\\diskpart.txt\"\n if (-not(Test-Path -Path $diskpath -PathType Leaf)) {\n new-item -Path C:\\OSInst\\BuildLogs\\diskpart.txt\n }\n else {\n remove-item -Path $diskpath -Force\n new-item -Path C:\\OSInst\\BuildLogs\\diskpart.txt\n\n }\n #Don't change indentation here!\n $str = @'\nselect disk 0\ncreate partition primary\nformat quick fs=ntfs label=\"Recovery\"\nassign letter=\"X\"\nset id=\"de94bba4-06d1-4d40-a16a-bfd50179d6ac\"\ngpt attributes=0x8000000000000001\n'@\n #Write the Diskpart commands to the file\n $str | add-content C:\\OSInst\\buildlogs\\diskpart.txt\n #Run the Diskpart commands\n diskpart \/s C:\\OSInst\\buildlogs\\diskpart.txt\n\n #Create Directories on new partition\n new-item -path x: -Name 'Recovery' -type directory -Force\n new-item -path x:\\Recovery -Name 'WindowsRE' -type directory -Force\n #Copy the required files from the local disk\n $url1 = ##yourlocation##\/boot.sdi\"\n Invoke-WebRequest -Uri $url1 -OutFile \"x:\\Recovery\\WindowsRE\\boot.sdi\" -Method Get\n\n $url3 = \"##yourlocation##\/Winre.wim\"\n Invoke-WebRequest -Uri $url3 -OutFile \"x:\\Recovery\\WindowsRE\\Winre.wim\" -Method Get \n\n $url2 = \"##yourlocation##\/ReAgent.xml\"\n Invoke-WebRequest -Uri $url2 -OutFile \"x:\\Recovery\\WindowsRE\\ReAgent.xml\" -Method Get\n\n ##Copy to c:\\windows\\system32\\recovery as well\n if (-not(Test-Path -Path \"C:\\windows\\system32\\recovery\\ReAgent.xml\" -PathType Leaf)) {\n $url2 = \"##yourlocation#\/ReAgent.xml\"\n Invoke-WebRequest -Uri $url2 -OutFile \"C:\\Windows\\System32\\Recovery\\ReAgent.xml\" -Method Get\n }\n else {\n remove-item -Path \"C:\\Windows\\System32\\Recovery\\ReAgent.xml\" -Force\n $url2 = \"##yourlocation##\/ReAgent.xml\"\n Invoke-WebRequest -Uri $url2 -OutFile \"C:\\Windows\\System32\\Recovery\\ReAgent.xml\" -Method Get\n }\n if (-not(Test-Path -Path \"C:\\windows\\system32\\recovery\\boot.sdi\" -PathType Leaf)) {\n copy-item \"x:\\Recovery\\WindowsRE\\boot.sdi\" -Destination \"C:\\Windows\\System32\\Recovery\" -Force\n }\n else {\n remove-item -Path \"C:\\Windows\\System32\\Recovery\\boot.sdi\" -Force\n copy-item \"x:\\Recovery\\WindowsRE\\boot.sdi\" -Destination \"C:\\Windows\\System32\\Recovery\" -Force\n }\n if (-not(Test-Path -Path \"C:\\windows\\system32\\recovery\\winre.wim\" -PathType Leaf)) {\n copy-item \"x:\\Recovery\\WindowsRE\\winre.wim\" -Destination \"C:\\Windows\\System32\\Recovery\" -Force\n }\n else {\n remove-item -Path \"C:\\Windows\\System32\\Recovery\\winre.wim\" -Force\n copy-item \"x:\\Recovery\\WindowsRE\\winre.wim\" -Destination \"C:\\Windows\\System32\\Recovery\" -Force\n }\n\n #Set the file attributes on WinrE.wim and boot.sdi\n reagentc \/setreimage \/path X:\\Recovery\\windowsre\n #Enable WinRE\n reagentc \/enable\n\n write-host \"WinRE rebuild complete\"\n\nStop-Transcript<\/code><\/pre>\n\n\n\n