Failure to Install Windows 10 KB5034441 Security Update Due to 0x80070643 Errors

Windows 10 customers worldwide report issues putting in Microsoft’s January Patch Tuesday updates, getting 0x80070643 errors when trying to put in the KB5034441 safety replace for BitLocker.

Yesterday, as a part of Microsoft’s January 2024 Patch Tuesday, a safety replace (KB5034441) was launched for CVE-2024-20666, a BitLocker encryption bypass that permits customers to entry encrypted knowledge.

However, when trying to put in this replace, Windows 10 customers are reporting getting 0x80070643 errors and the set up failing.

On reboot, customers might be greeted with a Windows Update display stating that an error occurred and to attempt once more later.

“There had been some issues putting in updates, however we’ll attempt once more later. If you retain seeing this and wish to search the online or contact assist for data, this may increasingly assist: (0x80070643),” reads the Windows Update error.

In a assist bulletin additionally revealed yesterday, Microsoft warns that when putting in the KB5034441, customers are presupposed to see the “Windows Recovery Environment servicing failed, (CBS_E_INSUFFICIENT_DISK_SPACE)” error when the Windows Recovery Partition will not be massive sufficient to assist the replace.

However, a coding error causes the Windows Update to mistakenly show the generic “0x80070643 – ERROR_INSTALL_FAILURE” error message as an alternative.

WinRE partition too small

When putting in the KB5034441 safety replace, Microsoft is putting in a brand new model of the Windows Recovery Environment (WinRE) that fixes the BitLocker vulnerability.

Unfortunately, Windows 10 creates a restoration partition, normally round 500 MB, which isn’t massive sufficient to assist the brand new Windows RE picture (winre.wim) file, inflicting the 0x80070643 error when trying to put in the replace.

In a take a look at by BleepingComputer this morning, a model new set up of Windows 10 utilizing the most recent ISO from Microsoft created a 522MB WinRE partition. However, even this new set up has a partition that’s too small, inflicting the KB5034441 safety replace to not set up and show a 0x80070643 error.

The solely answer Microsoft has supplied at this level is to create a bigger Windows Recovery Partition so there’s sufficient room for the safety replace to put in.

As the Windows Recovery Partition is created on the identical disk because the C: partition, you have to shrink the C: partition by 250 MBs and use that newly unallocated area to create an even bigger Recovery Partition.

Microsoft had beforehand shared a assist bulletin describing the best way to shrink the C: partition by 250 MB and create a brand new Recovery Partition utilizing the reagentc.exe and dispart.exe command line utilities to accommodate WinRE safety updates.

Reagentc.exe is a command line software for managing the Windows Recovery Environment, and diskpart.exe is a command line software to handle the machine’s disk partition and volumes.

However, in case you are not snug utilizing command line applications, we strongly counsel you maintain off on performing these steps because the vulnerability requires bodily entry to your machine, minimizing its influence.

Instead, it’s best to watch for an answer from Microsoft, which can supply an automatic option to recreate a bigger Windows Recovery partition.

Furthermore, there’s at all times the danger of damaging partitions when shrinking and increasing them, so it’s strongly suggested that you simply again up your knowledge earlier than continuing.

Below is the answer supplied by Microsoft:

1. Open a Command Prompt window (cmd) as admin. BleepingComputer has an article explaining the best way to open a command immediate as admin.

2. To examine the WinRE standing, run reagentc /data. If the WinRE is put in, there must be a “Windows RE location” with a path to the WinRE listing. An instance is, “Windows RE location: (file://%3f/GLOBALROOT/machine/harddisk0/partition4/Recovery/WindowsRE)?GLOBALROOTdeviceharddisk0partition4RecoveryWindowsRE.” Here, the quantity after “harddisk” and “partition” is the index of the disk and partition WinRE is on.

3. To disable the WinRE, run reagentc /disable

4. Shrink the OS partition and put together the disk for a brand new restoration partition.

   1. To shrink the OS, run diskpart

   2. Run disk checklist

   3. To choose the OS disk, run cell disk This must be the identical disk index as WinRE.

   4. To examine the partition below the OS disk and discover the OS partition, run checklist half

   5. To choose the OS partition, run sel half

   6. Run shrink desired=250 minimal=250

   7. To choose the WinRE partition, run sel half

   8. To delete the WinRE partition, run delete partition override

5. Create a brand new restoration partition.

   1. First, examine if the disk partition type is a GUID Partition Table (GPT) or a Master Boot Record (MBR). To try this, run disk checklist. Check if there’s an asterisk character

      1. within the “Gpt” column. If there’s an asterisk character , then the drive is GPT. Otherwise, the drive is MBR. If your disk is GPT, run create partition major id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

      2. adopted by the command gpt attributes = 0x80000000000000001

   2. If your disk is MBR, run create partition major id=27

   3. To format the partition, run format fast fs=ntfs label=”Windows RE instruments”

   4. To verify that the WinRE partition is created, run checklist vol

   5. To exit from diskpart, run exit

   6. To re-enable WinRE, run reagentc /allow

   To verify the place WinRE is put in, run

   reagentc /data

   After finishing these steps, reboot Windows and examine for updates in Windows Update to try to set up the KB5034441 safety replace once more.

Unfortunately, BleepingComputer has been informed by a Windows 10 person that this replace failed on their machine even with a Windows RE partition that’s 1 GB in measurement. Therefore, there isn’t a assure that these steps will resolve the problem.As beforehand stated, in case you are uncomfortable performing these steps, it’s best to wait to see if Microsoft affords a better, automated answer sooner or later that permits the replace to be put in.