Windows Recovery Environment (Windows RE) | Microsoft Learn

Windows Recovery Environment (WinRE) is a recovery environment based on Windows PE that helps repair common causes of unbootable Windows installations. It can be customized with drivers, languages, Windows PE optional components, and diagnostic tools. WinRE is included by default in Windows 10/11 desktop editions and Windows Server 2016 and later.

What’s new

Windows 11
- Most WinRE tools can run without selecting an administrator account and entering its password; encrypted files remain inaccessible without the decryption key.
- Advanced startup now boots directly to WinRE so Ease of Access features (for example, Narrator) can be enabled at restart.
- (link) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference?view=windows-11#whats-new-with-winre-for-windows-11
Windows 10
- Imaging & Configuration Designer (ICD) installs create a dedicated WinRE tools partition (UEFI & BIOS) located immediately after the Windows partition.
- Custom tools added to the Advanced startup menu must only rely on optional components present in default WinRE and must be placed in \Sources\Recovery\Tools to persist through updates.
- Adding languages for push-button reset requires the WinPE-HTA optional component.
- (link) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference?view=windows-11#whats-new-with-winre-for-windows-10

Tools included

Automatic repair and other troubleshooting features (see Windows RE Troubleshooting Features: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features?view=windows-11)
Push-button reset (desktop editions) — user-friendly repair while preserving data (see Push-Button Reset Overview: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/push-button-reset-overview?view=windows-11)
System image recovery (Windows Server editions) — full drive restore (see Recover the Operating System or Full Server: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc755163(v=ws.11))
You can build custom recovery solutions using the Windows Imaging API or DISM API.

Entry points into WinRE

Users can launch Advanced startup (which restarts into WinRE) via:

Shift + Restart from the sign-in screen.
Start > Settings > Update & Security > Recovery > Advanced startup > Restart now.
Booting from recovery media.
OEM-configured hardware recovery button/combo. WinRE also auto-starts after certain failures (e.g., two consecutive failed boots, certain unexpected shutdown/reboot patterns, Secure Boot or BitLocker errors on touch-only devices). (link) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference?view=windows-11#entry-points-into-winre

Allows users to:

Start recovery/troubleshooting tools
Boot from a device (UEFI only)
Access UEFI Firmware menu
Choose an OS when multiple are installed Note: You can add one custom tool to the Advanced startup menu. (link) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-tool-to-the-windows-re-boot-options-menu?view=windows-11

Security considerations

If Advanced startup is launched from Windows and a WinRE tool is selected, users must supply credentials of a local administrator account.
Many WinRE tools can run without selecting an admin account and password; encrypted files remain inaccessible without the proper key.
Networking is disabled by default; enable only when needed for security.

Customizing WinRE

You can add Windows PE optional components, languages, drivers, and custom tools. The base WinRE image includes components such as:

Microsoft-Windows-Foundation-Package, WinPE-EnhancedStorage, WinPE-Scripting, WinPE-HTA (added in Windows 10), etc. Note: Limit added packages/languages/drivers for performance—memory available on the PC constrains what can be included. (link) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-add-packages--optional-components-reference?view=windows-11

Hard drive partitions

When installed via Windows Setup, WinRE is configured as follows:

During Windows Setup

Windows prepares the hard drive partitions to support WinRE.

Initial placement

Windows initially places winre.wim in the Windows partition at \Windows\System32\Recovery. You can modify or replace this file before delivery to add languages, drivers, or packages.

Specialized pass

During the specialize configuration pass, the WinRE image is copied into the recovery tools partition so the device can boot WinRE even if the Windows partition is damaged.

If you deploy by applying images you must configure partitions manually. WinRE must be on an NTFS partition.
Recommended: store winre.wim in a separate recovery tools partition immediately after the Windows partition so WinRE remains available if Windows is BitLocker-encrypted and so future resizing is easier. (links) https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions?view=windows-11 and https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-biosmbr-based-hard-drive-partitions?view=windows-11

Memory requirements

To boot WinRE from memory (RAM disk boot), a contiguous block of RAM large enough to hold winre.wim must be available. Manufacturers should reserve memory regions (start or end of physical address space) to optimize use.

Updating the on-disk WinRE

WinRE can be updated as part of OS rollup updates; the process replaces the winre.wim with a newer image and injects/migrates:
- Boot-critical and input device drivers from the full OS.
- Customizations under \Sources\Recovery from the mounted winre.wim.
The update does NOT migrate:
- Drivers present only in the existing WinRE image but not in the full OS.
- Windows PE optional components not in the default WinRE.
- Language packs for WinPE and optional components.
If the updated image doesn't fit the existing recovery partition, Windows will try to shrink the Windows partition and expand or recreate the recovery partition; in some cases the new image may be installed on the Windows partition and the old recovery partition orphaned. Important: Customizations must not depend on optional components not in the default WinRE image (for example, WinPE-NetFX). WinPE-HTA was added to default WinRE in Windows 10 to help customizations persist.

Known issue (expandable)

Restoring System in WinRE can fail when "Block Microsoft accounts" GPO is enabled

If the Group Policy "Accounts: Block Microsoft accounts" is set to "User can’t add or log with Microsoft account", System Restore in WinRE can fail with: "You need to sign in as an administrator to continue, but there aren't any administrator accounts on this PC."

Workarounds:

Don't set the GPO to block Microsoft accounts, or
Set the MDM policy Security/RecoveryEnvironmentAuthentication to 2.