recovery partition Archives

Winsage

June 12, 2026

Microsoft’s bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits

Nightmare-Eclipse, also known as Chaotic-Eclipse, has introduced two new exploits: RoguePlanet and GreatXML. RoguePlanet exploits a vulnerability in Windows Defender, allowing attackers to gain SYSTEM user access privileges by tricking a user into executing a script. This access enables attackers to execute commands beyond standard Administrator capabilities, siphon sensitive data, and install malware. GreatXML provides a method for bypassing BitLocker encryption by creating a specially crafted "unattend.xml" file and a "Recovery" directory on the Windows recovery partition. Microsoft has shifted its stance from threatening legal action against Eclipse and is now monitoring the situation, while Eclipse has postponed a planned mass disclosure of zero-day Windows vulnerabilities initially set for July 14 due to delays in developing RoguePlanet.

Winsage

June 11, 2026

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Security researcher Chaotic Eclipse has released a Windows BitLocker bypass tool named GreatXML, following a previously disclosed exploit targeting Microsoft Defender. The discovery was made accidentally and took four hours. A critical vulnerability exists for users who have used the Windows Defender Offline Scan feature, making them susceptible to the BitLocker bypass. The exploit involves copying an XML file and a recovery folder to the recovery partition and rebooting into the Windows Recovery Environment (WinRE). If the Defender offline scan was not initiated, users must log in to start it or find a way to boot into WinRE in offline scan state. GreatXML is the second BitLocker bypass tool released by Chaotic Eclipse, following the earlier exploit known as YellowKey (CVE-2026-45585), which has been patched by Microsoft.

Winsage

June 11, 2026

Nightmare Eclipse drops claimed BitLocker bypass for Microsoft Windows

Nightmare Eclipse has released a new zero-day vulnerability exploit called GreatXML, which allows unrestricted access to BitLocker volumes on Windows systems that have previously run a Microsoft Defender Offline scan. This discovery was made in four hours and adds to Nightmare Eclipse's total of eight zero-day vulnerabilities. Microsoft is investigating the claims related to another exploit, RoguePlanet, but has not commented on GreatXML or provided a patch timeline. Nightmare Eclipse, rumored to be a former Microsoft employee, has faced backlash from the security community for previous disclosures and has vowed to continue releasing vulnerabilities. Security expert Will Dormann has raised concerns about the practicality of the GreatXML exploit, noting that it requires administrative access and questioning the accuracy of the instructions provided by Nightmare.

Winsage

September 29, 2025

I used DISM to create a Windows installer with all my apps, and here’s how it works

To back up a Windows 11 image, start with a fresh installation and use the Sysprep tool to generalize the system, avoiding Microsoft Store apps to prevent Sysprep failure. Prepare two external drives: one for storing the Windows image (minimum 8GB) and another bootable drive configured with Windows Preinstallation Environment (Windows PE). Download the Windows Assessment and Deployment Kit (ADK) and the Windows PE add-on to create the bootable USB drive. Enter Audit Mode by pressing Ctrl+Shift+F3 at the out-of-box experience screen, disable app updates, and install desired applications for the entire system. Use Sysprep to enter Out of Box Experience (OOBE), check Generalize, and select Shutdown. Boot from the Windows PE drive, use diskpart to identify drive letters, and capture the image with the DISM command. To apply the image on a new PC, create a diskpart script for partitioning and a batch script for applying the image. Boot the new PC from the Windows PE drive, run the diskpart script to create partitions, and execute the batch script to apply the image. This method is efficient for deploying consistent applications across multiple PCs.

Winsage

July 13, 2025

Microsoft reiterates it may never truly be able to fix Windows Update 0x80070643 error

In April, Microsoft released dynamic updates for Windows 10, including KB5057589, which was intended for the Windows Recovery Environment (WinRE). Users faced issues with the 0x80070643 error code despite having sufficient disk space. Microsoft decided not to reoffer this update to users who installed it and promised a more reliable update. In July 2025, Microsoft released a new WinRE update, KB5063523, which automatically applies the Safe OS Dynamic Update (KB5062691) to enhance recovery features. This update resolves the previous installation issue, although the error code may still appear. Additional dynamic updates released on July 8, 2025, include KB5062682, KB5062787, KB5062788, KB5062691, KB5062689, and KB5062692, all aimed at improving Windows setup and recovery environments. These updates will be automatically downloaded and installed via Windows Update.

Winsage

April 15, 2025

Windows Update fails successfully, says Microsoft

The April 2025 Windows Recovery Environment update, identified as KB5057589, has caused confusion among Windows 10 users due to an error message (0x80070643 – ERRORINSTALLFAILURE) encountered during installation. Microsoft clarified that this error is a nuisance and does not affect the update or device functionality. The update enhances recovery features for devices facing booting issues and is delivered through Windows Update. Users may see the error if the update is installed while another update is pending a reboot, but the update typically installs successfully after a restart. Microsoft is working on a resolution to address user concerns.

Winsage

April 1, 2025

Windows 11 PC won’t boot? Microsoft’s new tool tries to fix it before you even panic

Microsoft is introducing a new tool called Quick Machine Recovery (QMR) to address boot-up issues in Windows PCs, currently available for testing in the latest Windows 11 Insider build. QMR, designed for both IT administrators and home users, automates the recovery process by entering the Windows Recovery Environment (WinRE) when a critical boot-up error occurs. The PC will connect to the internet, send diagnostic data to Microsoft, and receive a tailored fix via Windows Update, allowing it to boot normally without further user intervention. QMR is part of Microsoft's Windows Resiliency Initiative and aims to simplify the recovery process for users.

Winsage

April 1, 2025

Windows 11 is getting a secret weapon for boot failures

Microsoft has introduced a new tool called Quick Machine Recovery (QMR) to address boot-up issues in Windows PCs, currently available for testing in the latest Windows 11 Insider build. QMR automates the recovery process by utilizing the Windows Recovery Environment (WinRE), allowing PCs to automatically enter recovery mode, connect to the internet, and send diagnostic data to Microsoft. Based on this data, a tailored fix is sent to the device through Windows Update. QMR is designed for both IT administrators and home users, with the latter having it enabled by default. It is part of Microsoft's Windows Resiliency Initiative, and the company is encouraging feedback from testers.

Winsage

March 28, 2025

How to easily create an unattended answer file for Windows 11

On Windows 11, an answer file named autounattend.xml can be created to streamline the installation process by bypassing setup steps. To create this file, users need to install the DISMTools application, which provides a wizard for generating the unattended file. The installation of DISMTools involves using Command Prompt to run the command: winget install CodingWondersSoftware.DISMTools.Preview. To create the unattended file, users launch DISMTools, navigate to the "Unattended answer file creator," and follow the wizard to configure settings such as system language, processor architecture, disk settings, product key, account settings, and network settings. The final step is saving the file as autounattend.xml. To integrate the answer file into Windows 11 installation media, users download the Media Creation Tool, select the USB flash drive option, and copy the autounattend.xml file to the USB drive. This prepares the USB for an unattended installation of Windows 11. The XML file may also appear as "unattend.xml" in other contexts.

Winsage

March 19, 2025

How to transfer your Windows 11 setup to a new hard drive — no extra app required

Users of Windows 11 may need to upgrade their hard drive due to space constraints or the drive nearing the end of its lifespan, typically within three to five years. They can create a system image backup using the Backup and Restore feature in Windows 11. To create a system image, users must access the Control Panel, navigate to System and Security, and select "Create a system image." The backup can be saved on a hard disk, and users can choose to include additional drives. To create a USB bootable media for recovery, users should visit the Windows 11 download page, download the Media Creation Tool, and follow the prompts to create a USB flash drive. Replacing the hard drive involves powering down the computer, removing the cover, disconnecting cables, and installing the new drive. After installation, users can restore the previous Windows 11 installation from the system image backup by booting from the USB drive and selecting "System Image Recovery." If the new drive has unallocated space, users can create a new partition or expand the existing setup partition. To create a data partition, users can access Settings, navigate to Storage, and create a new volume from unallocated space. To expand the setup partition, users must delete the recovery partition, extend the installation drive, and recreate the recovery partition using Command Prompt and Disk Management. Finally, users should re-enable BitLocker after completing these processes.