• Re: Why is my 4th partition almost full. Do I care?

    From =?UTF-8?B?Li4ud8Khw7HCp8KxwqTDsQ==?=@winstonmvp@gmail.com to alt.comp.os.windows-11 on Fri Apr 17 10:42:12 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/15/2026 7:55 AM, micky wrote:


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines. >>
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info

    Much appreciated. Well take care of this when I get home next week,
    after my visit to my brother. At home there's another computer if
    something goes wrong!!!


    You also have the ability in an admin Powershell or Command.com to
    determine the current build number and creation date of the existing
    Windows Recovery files.

    Copy the following command and paste into and admin session of
    Powershell or Command.com for your devices Disk 0, Windows Recovery
    partition #4:

    DISM /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE\winre.wim
    /index:1

    The latest Build is:
    ServicePack Build : 8235

    The results will also show the Created and Modified date.
    Fyi - Windows Recovery files were released/included in the monthly
    Windows 11 update in each of the last two months(March and April 2026).
    The April build for Windows 11 was 8235(as noted above)
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From micky@NONONOmisc07@fmguy.com to alt.comp.os.windows-11 on Fri Apr 17 20:32:41 2026
    From Newsgroup: alt.comp.os.windows-11

    In alt.comp.os.windows-11, on Tue, 14 Apr 2026 10:40:06 -0700,
    ...wi+o#n+ <winstonmvp@gmail.com> wrote:

    On 4/14/2026 8:17 AM, micky wrote:
    In alt.comp.os.windows-11, on Mon, 13 Apr 2026 00:58:30 -0400, Paul
    <nospam@needed.invalid> wrote:


    Does anyone care whether their WinRE.wim works ?
    I would care, if it had a good track record.
    It would be interesting, to see what the Microsoft
    field statistics are, for successful repair via the Recovery Partition.

    IIUC the recovery partition will put the box back to the way it was when
    it was sold. But if you have an image, you can put it back to the way
    it was when you last imaged it. Isn't that a lot better? So yeah,
    the recovery partition seems only of value to those who have no images.
    ??

    One could always restore a disk image, including restoring an undersized >Windows Recovery partition..
    ...but, since Windows Recovery files and partition updates are
    included(have been since June 2023) in the monthly Windows update that >monthly update(Windows and the Recovery update) due to insufficient
    space existing in the Windows Recovery Partition.

    The solution to prevent both from failing
    Enlarge the size of the Recovery partition to have a minimum of 250
    MB free space(in your case, increasing it by 904 MB from 1.41 to 2 GB
    will provide 958 GB of free space )is the right path to take and
    providing more than sufficient free space for the foreseeable future.

    You've two routes, already suggested to accomplish/fix the Recovery free >space problem - 3rd party(e.g. MiniTool Partition Wizard or
    Diskpart(the latter, step by step instructions provided in an earlier >post/reply).

    Once done, then image your device for all partitions present on your
    Disk 0(System/EFI, MSR, Windows, Windows Recovery).

    Will do. I'll be home Tuesday night and probably do it Wednesday.
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From micky@NONONOmisc07@fmguy.com to alt.comp.os.windows-11 on Wed Apr 29 02:00:40 2026
    From Newsgroup: alt.comp.os.windows-11

    In alt.comp.os.windows-11, on Mon, 13 Apr 2026 10:36:06 -0700,
    ...wi+o#n+ <winstonmvp@gmail.com> wrote:

    On 4/12/2026 11:42 AM, micky wrote:
    Powershell

    PS C:\Users\mmm> get-volume
    Remaining Size
    C Dell-2025-Laptop NTFS Fixed Healthy OK 615.69 GB 952.34 GB
    D LITTLE-SD FAT32 Removable Healthy OK 28.31 GB 28.96 GB
    NTFS Fixed Healthy OK 53.98 MB 1.41 GB

    Macrium Reflect Free
    1 NO NAME (none) Primary Fat32 (LBA) 73.7MB used out of 100MB
    2 (none) Primary Unformatted 16MB used out of 16MB
    (but it's not marked in red even though it's full.
    Normal = its not formatted, i.e. ignore that its not red.
    3 Dell-2025-Laptop (C:) Primary NTFS 332.59 GB used out of 952.34GB
    4 (none) Primary NTFS 1.36 used out of 1.41GB (and marked in red)
    Yes, as reported earlier.
    plus another line for a little removeable SD card
    Not pertinent to your issue

    Windows Disk Managerment
    (Disk 0 Parition 1) Simple Basic Healthy (EFI system partition)
    100MB 100MB 100% free Macrium says 74% used!
    Normal, as expected
    (Disk 0 Partition 4) Simple Basic Healthy (Recovery Partition)
    1.41GB used, 1.41GB Free Sapce 100% free -- That's not right. >It's right. Disk Management doesn't calc free space for this(Windows >Recovery) partition

    Dell-2025-Laptop (C:) Simple Basic Healthy (Boot, Page File, Crash Dump,
    Basic Data Partition) 952.34 GB 617.72GB 65% Free
    Good, consistent with get-volume and Macrium

    Little-SD, not important, right?
    Yes, not important to your issue


    Do you think I have to worry about Minitool Parition Wizard damaging
    anything? I've liked how it works, but I could change to another.

    With your above info, you should see that your:
    Disk number is Disk 0
    Windows is partition #3 on Disk 0
    Windows Recovery is partition #4 on Disk 0
    - exactly where it should be, to the right and adjacent to Windows
    partition

    One could use Minitool Partition Wizard but I don't recommend it for
    Windows Recovery. I prefer to use the method MSFT prescribes for
    enlarging the Windows Recovery partition using DiskPart in Powershell or >Command.com admin mode.

    Better is an increase in size of Windows Recovery partition to 2 GB
    (2048 MB) is better
    an increase of 904 MB
    1143.8 + 905 = 2047.8 MB = ~ 2 GB

    Note: See below(end of this message) for how to do in DiskPart.
    Prior to doing anything.
    Disable all Restore Points
    Open Windows Update and toggle off Advanced/Recieve updates for other >Microsoft products.
    Run DiskCleanup in admin mode, select all options, OK to run(wait for it
    to finish, do not interrupt), when done.
    Shutdown and Power on the device and boot back into Windows 25H2



    p.s. For analysis reasons, the 4th partition GB sizes in MB are
    1.36 GB = 1392.64 MB used
    1.41 GB = 1443.84 MB total size
    ==>> Which indicates 51.2 MB free space (~3.5% remaining)

    So I could take, say, 0.15GB, or more, from the adjacent Data/Windows
    partition and give it to this partition, right?

    The windows partition has 620GB that are empty. Maybe I should take
    more, 2GB sounds better. Then I'll be good for years.


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines.

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=oWindows REo

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more information."

    I'm in the Event Viewer. It doesn't say what part of the Event Log to
    look in, and so far the only thing at this time that I see is called
    Audit Success and doesn't look like an error. I don't think Im looking
    in the right place.

    All I see is
    Audit Success date/time Microsoft Windows security auditing 4798
    User acccount managerment
    Subject:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025
    Logon ID: 0x4CC05
    User:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025

    Process Information:
    Process ID: 0x25f4
    Process Name: C:\Windows\explorer.exe
    System
    - Provider
    [ Name] Microsoft-Windows-Security-Auditing
    [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

    EventID 4798
    Version 0
    Level 0
    Task 13824
    Opcode 0
    Keywords 0x8020000000000000
    - TimeCreated
    [ SystemTime] 2026-04-29T05:48:50.3108347Z
    EventRecordID 1916350
    - Correlation
    [ ActivityID] {5427f638-d790-0002-07f8-275490d7dc01}
    - Execution
    [ ProcessID] 1348
    [ ThreadID] 9556
    Channel Security
    Computer Laptop-Dell2025
    Security

    - EventData
    TargetUserName mmm
    TargetDomainName LAPTOP-DELL2025
    TargetSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserName mmm
    SubjectDomainName LAPTOP-DELL2025
    SubjectLogonId 0x4cc05
    CallerProcessId 0x25f4
    CallerProcessName C:\Windows\explorer.exe


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and
    it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Successfully?? Despite the bad parameter? And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.

    Minitool Wizard says the File System is Other.

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753770(v=ws.11)#syntax
    Lists quick as a valid parameter,
    and also fs=ntfs and label=oWindows REo .

    And https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.

    When I leave in quick and take out the label parameter, but leave in fs,
    I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I
    get the same error message.

    I didn't do these things yet: Help!!!
    exit
    reagentc /enable
    reagentc /info
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Wed Apr 29 16:39:45 2026
    From Newsgroup: alt.comp.os.windows-11

    On Wed, 4/29/2026 2:00 AM, micky wrote:
    In alt.comp.os.windows-11, on Mon, 13 Apr 2026 10:36:06 -0700, ...w-i|#-o-#-n|# <winstonmvp@gmail.com> wrote:

    On 4/12/2026 11:42 AM, micky wrote:
    Powershell

    PS C:\Users\mmm> get-volume
    Remaining Size >>> C Dell-2025-Laptop NTFS Fixed Healthy OK 615.69 GB 952.34 GB
    D LITTLE-SD FAT32 Removable Healthy OK 28.31 GB 28.96 GB
    NTFS Fixed Healthy OK 53.98 MB 1.41 GB

    Macrium Reflect Free
    1 NO NAME (none) Primary Fat32 (LBA) 73.7MB used out of 100MB
    2 (none) Primary Unformatted 16MB used out of 16MB
    (but it's not marked in red even though it's full.
    Normal = its not formatted, i.e. ignore that its not red.
    3 Dell-2025-Laptop (C:) Primary NTFS 332.59 GB used out of 952.34GB
    4 (none) Primary NTFS 1.36 used out of 1.41GB (and marked in red)
    Yes, as reported earlier.
    plus another line for a little removeable SD card
    Not pertinent to your issue

    Windows Disk Managerment
    (Disk 0 Parition 1) Simple Basic Healthy (EFI system partition)
    100MB 100MB 100% free Macrium says 74% used!
    Normal, as expected
    (Disk 0 Partition 4) Simple Basic Healthy (Recovery Partition)
    1.41GB used, 1.41GB Free Sapce 100% free -- That's not right.
    It's right. Disk Management doesn't calc free space for this(Windows
    Recovery) partition

    Dell-2025-Laptop (C:) Simple Basic Healthy (Boot, Page File, Crash Dump, >>> Basic Data Partition) 952.34 GB 617.72GB 65% Free
    Good, consistent with get-volume and Macrium

    Little-SD, not important, right?
    Yes, not important to your issue


    Do you think I have to worry about Minitool Parition Wizard damaging
    anything? I've liked how it works, but I could change to another.

    With your above info, you should see that your:
    Disk number is Disk 0
    Windows is partition #3 on Disk 0
    Windows Recovery is partition #4 on Disk 0
    - exactly where it should be, to the right and adjacent to Windows
    partition

    One could use Minitool Partition Wizard but I don't recommend it for
    Windows Recovery. I prefer to use the method MSFT prescribes for
    enlarging the Windows Recovery partition using DiskPart in Powershell or
    Command.com admin mode.

    Better is an increase in size of Windows Recovery partition to 2 GB
    (2048 MB) is better
    an increase of 904 MB
    1143.8 + 905 = 2047.8 MB = ~ 2 GB

    Note: See below(end of this message) for how to do in DiskPart.
    Prior to doing anything.
    Disable all Restore Points
    Open Windows Update and toggle off Advanced/Recieve updates for other
    Microsoft products.
    Run DiskCleanup in admin mode, select all options, OK to run(wait for it
    to finish, do not interrupt), when done.
    Shutdown and Power on the device and boot back into Windows 25H2



    p.s. For analysis reasons, the 4th partition GB sizes in MB are
    1.36 GB = 1392.64 MB used
    1.41 GB = 1443.84 MB total size
    ==>> Which indicates 51.2 MB free space (~3.5% remaining)

    So I could take, say, 0.15GB, or more, from the adjacent Data/Windows >>>>> partition and give it to this partition, right?

    The windows partition has 620GB that are empty. Maybe I should take >>>>> more, 2GB sounds better. Then I'll be good for years.


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines. >>
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more information."

    I'm in the Event Viewer. It doesn't say what part of the Event Log to
    look in, and so far the only thing at this time that I see is called
    Audit Success and doesn't look like an error. I don't think Im looking
    in the right place.

    All I see is
    Audit Success date/time Microsoft Windows security auditing 4798
    User acccount managerment
    Subject:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025
    Logon ID: 0x4CC05
    User:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025

    Process Information:
    Process ID: 0x25f4
    Process Name: C:\Windows\explorer.exe
    System
    - Provider
    [ Name] Microsoft-Windows-Security-Auditing
    [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

    EventID 4798
    Version 0
    Level 0
    Task 13824
    Opcode 0
    Keywords 0x8020000000000000
    - TimeCreated
    [ SystemTime] 2026-04-29T05:48:50.3108347Z
    EventRecordID 1916350
    - Correlation
    [ ActivityID] {5427f638-d790-0002-07f8-275490d7dc01}
    - Execution
    [ ProcessID] 1348
    [ ThreadID] 9556
    Channel Security
    Computer Laptop-Dell2025
    Security

    - EventData
    TargetUserName mmm
    TargetDomainName LAPTOP-DELL2025
    TargetSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserName mmm
    SubjectDomainName LAPTOP-DELL2025
    SubjectLogonId 0x4cc05
    CallerProcessId 0x25f4
    CallerProcessName C:\Windows\explorer.exe


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and
    it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Successfully?? Despite the bad parameter? And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.

    Minitool Wizard says the File System is Other.

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753770(v=ws.11)#syntax
    Lists quick as a valid parameter,
    and also fs=ntfs and label=rCYWindows RErCY .

    And https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.

    When I leave in quick and take out the label parameter, but leave in fs,
    I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I
    get the same error message.

    I didn't do these things yet: Help!!!
    exit
    reagentc /enable
    reagentc /info

    reagentc /info # ... only if it is Enabled, can we Disable it.

    reagentc /disable # This is supposed to store the "goods" on C: so they don't get damaged.
    # That can only work, if the current Recovery Partition is in a working state.
    # If it were already Disabled, disabling it again cannot work.

    diskpart.exe
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary # This creates a "RAW" Basic Data Partition, NoFS

    format quick fs=ntfs label="Windows RE" # When this fails, use Disk Management, assign a drive letter
    # to that partition, then select "Format" in Disk Management.

    # Now, go back to Disk Management again and remove that drive letter
    # using the GUI for it.

    # This terminal session can remain running while you do this.
    # Now, carry on with this recipe.

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001

    detail partition # It should be getting a lot closer to a Recovery Partition by now.

    list vol
    exit # We're now out of diskpart, and back to the shell in the terminal.

    reagentc /enable # If this works, it'll be a miracle. Trust me.
    reagentc /info # Reagentc is bomb squad material, never twice the same.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Wed Apr 29 22:09:39 2026
    From Newsgroup: alt.comp.os.windows-11

    On Wed, 4/29/2026 4:39 PM, Paul wrote:
    On Wed, 4/29/2026 2:00 AM, micky wrote:
    In alt.comp.os.windows-11, on Mon, 13 Apr 2026 10:36:06 -0700,
    ...w-i|#-o-#-n|# <winstonmvp@gmail.com> wrote:

    On 4/12/2026 11:42 AM, micky wrote:
    Powershell

    PS C:\Users\mmm> get-volume
    Remaining Size >>>> C Dell-2025-Laptop NTFS Fixed Healthy OK 615.69 GB 952.34 GB >>>> D LITTLE-SD FAT32 Removable Healthy OK 28.31 GB 28.96 GB >>>> NTFS Fixed Healthy OK 53.98 MB 1.41 GB >>>>
    Macrium Reflect Free
    1 NO NAME (none) Primary Fat32 (LBA) 73.7MB used out of 100MB
    2 (none) Primary Unformatted 16MB used out of 16MB
    (but it's not marked in red even though it's full.
    Normal = its not formatted, i.e. ignore that its not red.
    3 Dell-2025-Laptop (C:) Primary NTFS 332.59 GB used out of 952.34GB
    4 (none) Primary NTFS 1.36 used out of 1.41GB (and marked in red)
    Yes, as reported earlier.
    plus another line for a little removeable SD card
    Not pertinent to your issue

    Windows Disk Managerment
    (Disk 0 Parition 1) Simple Basic Healthy (EFI system partition)
    100MB 100MB 100% free Macrium says 74% used!
    Normal, as expected
    (Disk 0 Partition 4) Simple Basic Healthy (Recovery Partition)
    1.41GB used, 1.41GB Free Sapce 100% free -- That's not right. >>> It's right. Disk Management doesn't calc free space for this(Windows
    Recovery) partition

    Dell-2025-Laptop (C:) Simple Basic Healthy (Boot, Page File, Crash Dump, >>>> Basic Data Partition) 952.34 GB 617.72GB 65% Free
    Good, consistent with get-volume and Macrium

    Little-SD, not important, right?
    Yes, not important to your issue


    Do you think I have to worry about Minitool Parition Wizard damaging
    anything? I've liked how it works, but I could change to another.

    With your above info, you should see that your:
    Disk number is Disk 0
    Windows is partition #3 on Disk 0
    Windows Recovery is partition #4 on Disk 0
    - exactly where it should be, to the right and adjacent to Windows
    partition

    One could use Minitool Partition Wizard but I don't recommend it for
    Windows Recovery. I prefer to use the method MSFT prescribes for
    enlarging the Windows Recovery partition using DiskPart in Powershell or >>> Command.com admin mode.

    Better is an increase in size of Windows Recovery partition to 2 GB
    (2048 MB) is better
    an increase of 904 MB
    1143.8 + 905 = 2047.8 MB = ~ 2 GB

    Note: See below(end of this message) for how to do in DiskPart.
    Prior to doing anything.
    Disable all Restore Points
    Open Windows Update and toggle off Advanced/Recieve updates for other
    Microsoft products.
    Run DiskCleanup in admin mode, select all options, OK to run(wait for it >>> to finish, do not interrupt), when done.
    Shutdown and Power on the device and boot back into Windows 25H2



    p.s. For analysis reasons, the 4th partition GB sizes in MB are
    1.36 GB = 1392.64 MB used
    1.41 GB = 1443.84 MB total size
    ==>> Which indicates 51.2 MB free space (~3.5% remaining)

    So I could take, say, 0.15GB, or more, from the adjacent Data/Windows >>>>>> partition and give it to this partition, right?

    The windows partition has 620GB that are empty. Maybe I should take >>>>>> more, 2GB sounds better. Then I'll be good for years.


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines.

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more
    information."

    I'm in the Event Viewer. It doesn't say what part of the Event Log to
    look in, and so far the only thing at this time that I see is called
    Audit Success and doesn't look like an error. I don't think Im looking
    in the right place.

    All I see is
    Audit Success date/time Microsoft Windows security auditing 4798
    User acccount managerment
    Subject:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025
    Logon ID: 0x4CC05
    User:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025

    Process Information:
    Process ID: 0x25f4
    Process Name: C:\Windows\explorer.exe
    System
    - Provider
    [ Name] Microsoft-Windows-Security-Auditing
    [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

    EventID 4798
    Version 0
    Level 0
    Task 13824
    Opcode 0
    Keywords 0x8020000000000000
    - TimeCreated
    [ SystemTime] 2026-04-29T05:48:50.3108347Z
    EventRecordID 1916350
    - Correlation
    [ ActivityID] {5427f638-d790-0002-07f8-275490d7dc01}
    - Execution
    [ ProcessID] 1348
    [ ThreadID] 9556
    Channel Security
    Computer Laptop-Dell2025
    Security

    - EventData
    TargetUserName mmm
    TargetDomainName LAPTOP-DELL2025
    TargetSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserName mmm
    SubjectDomainName LAPTOP-DELL2025
    SubjectLogonId 0x4cc05
    CallerProcessId 0x25f4
    CallerProcessName C:\Windows\explorer.exe


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and
    it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Successfully?? Despite the bad parameter? And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.

    Minitool Wizard says the File System is Other.

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753770(v=ws.11)#syntax
    Lists quick as a valid parameter,
    and also fs=ntfs and label=rCYWindows RErCY .

    And
    https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.

    When I leave in quick and take out the label parameter, but leave in fs,
    I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I
    get the same error message.

    I didn't do these things yet: Help!!!
    exit
    reagentc /enable
    reagentc /info

    reagentc /info # ... only if it is Enabled, can we Disable it.

    reagentc /disable # This is supposed to store the "goods" on C: so they don't get damaged.
    # That can only work, if the current Recovery Partition is in a working state.
    # If it were already Disabled, disabling it again cannot work.

    diskpart.exe
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary # This creates a "RAW" Basic Data Partition, NoFS

    format quick fs=ntfs label="Windows RE" # When this fails, use Disk Management, assign a drive letter
    # to that partition, then select "Format" in Disk Management.

    # Now, go back to Disk Management again and remove that drive letter
    # using the GUI for it.

    # This terminal session can remain running while you do this.
    # Now, carry on with this recipe.

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001

    detail partition # It should be getting a lot closer to a Recovery Partition by now.

    list vol
    exit # We're now out of diskpart, and back to the shell in the terminal.

    reagentc /enable # If this works, it'll be a miracle. Trust me.
    reagentc /info # Reagentc is bomb squad material, never twice the same.


    Optional:

    Say it doesn't work. How did Paul get his working ?
    ( I fixed my test donkey about an hour ago. )

    If it seems you've lost all your copies of Winre.wim , do not panic, as the ISO for Windows
    has copies.

    I use 7ZIP to do random access inside ISO files. The reason I have to do this, is the ISO file has "install.wim" , which is a compressed archive of its own, and if you just copied the "install.wim" out, you'd still have to do something like use DISM to mount the WIM. 7ZIP can do this, without leaving that single tool.
    And when 7ZIP extracts a file, it can extract it to a destination you have trouble with.

    Folder "6" in this example, is the Windows Pro install folder, but all the folders are likely to have similar contents for WinRE. The ISO9660 file was copied to
    partition F: for dissection. I navigated to the "sources" folder, where I
    would find the really big "install.wim". I select "open inside" to
    descend the contents. I used folder "6" because it matched the Pro test install I was running on at the time. Once in folder "6", I visit Windows and System32 to find the Recovery partition on the ISO.

    We could use three files total.

    F:\Win10_22H2_English_x64v1.iso\sources\install.wim\6\Windows\System32\ boot.sdi 3170304 bytes

    F:\Win10_22H2_English_x64v1.iso\sources\install.wim\6\Windows\System32\Recovery\
    ReAgent.xml 837 bytes
    Winre.wim 441,202,504


    In an Administrator window, I used diskpart, and selected my Partition 3, which is my Recovery Partition. This snippit picks up after

    select disk 0
    list partition
    select partition 3 # This setup doesn't have a Microsoft Reserved.
    ...

    DISKPART> assign letter=k <=== Assign a letter to the hidden Recovery partition

    DiskPart successfully assigned the drive letter or mount point.

    DISKPART> detail part <=== Notice I've already applied my decorations, so
    the partition is "ready for business" Partition 3
    Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac <=== That's the Recovery Partition type
    Hidden : Yes
    Required: Yes
    Attrib : 0X8000000000000001
    Offset in Bytes: 532603207680

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 K WindowsRE NTFS Partition 2009 MB Healthy Hidden <=== Letter K: assigned

    Then, I use 7ZIP, to "extract" the three files, and I put them in K:\Recovery\WindowsRE

    Now, if your K: didn't have any structure at all inside it yet (which is likely),
    you could do this to establish the folders needed inside. "md" is MakeDir.

    K:
    md Recovery
    cd Recovery
    md WindowsRE

    and then use 7ZIP to directly extract the three files and put them in K:\Recovery\WindowsRE

    In an Administrator Command Prompt window, once the files are in place, you "close the door behind them". Before I do this sequence, there's no security to speak of in there. We pretty it up a bit, to pretend this somehow helps
    the security. If we don't do this, maybe ReagentC blows up and ERASES THE FUCKING FILES :-)
    Then you have to extract them again. I'm not doing this for fun, this one is for the bomb squad.

    K:
    cd Recovery
    cd WindowsRE
    attrib +s +h * # Make boot.sdi , ReAgent.xml , and Winre.wim be both System and Hidden attribute
    cd .. # up a level
    attrib +s +h WindowsRE # Make WindowsRE hidden and system.
    cd .. # up a level
    attrib +s +h Recovery # Make Recovery hidden and system.
    C: # Now, K: is all tidy, so we switch back to C:

    In the diskpart session, where our last change was

    assign letter=k

    we now do the corresponding removal of K: (as we don't want this kicking around in "mountvol" forever).

    remove letter=k
    exit

    We're done with loading up the Recovery Partition.

    How will reagentc know where to find its Christmas Present ?

    This command provides a pointer to the third partition. Since I
    am on Disk 0 and Partition 3 was where we were loading up our materials,
    I know this is the right place for it, and I don't have to use a
    reference such as K:\Recovery\WindowsRE . I can just use the more
    physical level namespace.

    PS > reagentc /setreimage /path \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE /logpath C:\TEMP\out.log
    Directory set to: \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE

    REAGENTC.EXE: Operation Successful.

    PS > reagentc /enable # It's reading the PBR version of ReAgent.xml 837 bytes now
    REAGENTC.EXE: Operation Successful.

    PS > reagentc /info
    Windows Recovery Environment (Windows RE) and system reset configuration Information:

    Windows RE status: Enabled
    Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: 4a593772-4417-11f1-8fe5-d82b2751a2e1
    Recovery image location:
    Recovery image index: 0
    Custom image location:
    Custom image index: 0

    REAGENTC.EXE: Operation Successful.

    And I'm done like dinner.

    The first time you do this, it will seem like an epic adventure.
    The 20th time you've done this, you'll be wanting to be kicking
    the ass of a dev at MSFT, for making you do all this work for nothing.
    As this stuff never remains stable for all that long. One slip,
    and you have to do one of the Push Button Reset things AGAIN.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From ....winston@winstonmvp@gmail.com to alt.comp.os.windows-11 on Thu Apr 30 00:35:15 2026
    From Newsgroup: alt.comp.os.windows-11

    On 29-Apr-26 2:00 AM, micky wrote:


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines. >>
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more information."

    Not going to find much following that path. The info in the admin
    command console was the pertinent information.


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and
    it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Well, doing commands later in the sequence(setting the id and gpt
    attributes) after quick format failure and before formatting is not recommended.

    Successfully?? Despite the bad parameter? And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.
    RAW is the correct format after formatting and before setting the id and
    gpt attributes.

    Minitool Wizard says the File System is Other.


    MiniTool Partition Wizard would only report as 'Other' if not formatted
    as NTFS.
    i.e. the it can only be other if not formatted as NTFS or not created
    as a primary partition(ie. empty and unallocated space)

    https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.
    Yes
    format quick fs=ntfs label=rCYWindows RE toolsrCY
    or as I indicated with a shorter label name
    format quick fs=ntfs label=rCYWindows RErCY

    When I leave in quick and take out the label parameter, but leave in fs,
    I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I
    get the same error message.
    Not a good idea...

    I didn't do these things yet: Help!!!
    exit
    reagentc /enable
    reagentc /info

    Here's what was suggested to be done:
    ---------------
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info
    -------------------

    The error you see is almost always related to one or more of these:
    1. Not running Powershell or Command.com in an Admin mode
    2. Not disabling the Windows Recovery partition
    reagentc /disable
    3. Not entering or mistyping the 'override' command properly
    delete partition override
    4. Mistyping the quick format command
    format quick fs=ntfs label="Windows RE"

    It would have been more helpful if you had captured and posted the
    actual admin console sequence of the completed steps up to and including
    the last command that failed.

    If you've run Powershell or Command in admin mode and successfully
    followed the steps through 'delete partition override', you can try
    exiting diskpart and Powershell and repeat specific steps.

    But first you should verify two conditions
    a. Get-Volume
    Run in a Powershell admin console, to show the size of new larger
    Recovery partition
    b. If the the second command moved the Recovery file (Winre.wim) to
    correct Windows folder
    reagentc /disable
    - which moves the files to C:\Windows\System32\Recovery
    ***Note*** to see the file File Explorer's folder View tab needs to be configured to 'Show hidden files, folders and drives', Uncheck 'Hide Extensions for known file types' and Uncheck 'Hide protected operating
    system files'

    Once you verify the size of partition 4 and the location of WinRe.wim
    and other files are resident in the correct folder
    C:\Windows\System32\Recovery
    ...then you can proceed by reporting what should be present. Once,
    verified, I'll post what steps you can repeat...until then, you should
    not do any other tampering with any other application(Mini Tool, Disk Management, etc.)
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From ....winston@winstonmvp@gmail.com to alt.comp.os.windows-11 on Thu Apr 30 01:03:47 2026
    From Newsgroup: alt.comp.os.windows-11

    On 29-Apr-26 10:09 PM, Paul wrote:
    On Wed, 4/29/2026 4:39 PM, Paul wrote:
    On Wed, 4/29/2026 2:00 AM, micky wrote:
    In alt.comp.os.windows-11, on Mon, 13 Apr 2026 10:36:06 -0700,
    ...w-i|#-o-#-n|# <winstonmvp@gmail.com> wrote:

    On 4/12/2026 11:42 AM, micky wrote:
    Powershell

    PS C:\Users\mmm> get-volume
    Remaining Size >>>>> C Dell-2025-Laptop NTFS Fixed Healthy OK 615.69 GB 952.34 GB >>>>> D LITTLE-SD FAT32 Removable Healthy OK 28.31 GB 28.96 GB >>>>> NTFS Fixed Healthy OK 53.98 MB 1.41 GB >>>>>
    Macrium Reflect Free
    1 NO NAME (none) Primary Fat32 (LBA) 73.7MB used out of 100MB
    2 (none) Primary Unformatted 16MB used out of 16MB
    (but it's not marked in red even though it's full.
    Normal = its not formatted, i.e. ignore that its not red.
    3 Dell-2025-Laptop (C:) Primary NTFS 332.59 GB used out of 952.34GB >>>>> 4 (none) Primary NTFS 1.36 used out of 1.41GB (and marked in red)
    Yes, as reported earlier.
    plus another line for a little removeable SD card
    Not pertinent to your issue

    Windows Disk Managerment
    (Disk 0 Parition 1) Simple Basic Healthy (EFI system partition)
    100MB 100MB 100% free Macrium says 74% used!
    Normal, as expected
    (Disk 0 Partition 4) Simple Basic Healthy (Recovery Partition)
    1.41GB used, 1.41GB Free Sapce 100% free -- That's not right. >>>> It's right. Disk Management doesn't calc free space for this(Windows
    Recovery) partition

    Dell-2025-Laptop (C:) Simple Basic Healthy (Boot, Page File, Crash Dump, >>>>> Basic Data Partition) 952.34 GB 617.72GB 65% Free
    Good, consistent with get-volume and Macrium

    Little-SD, not important, right?
    Yes, not important to your issue


    Do you think I have to worry about Minitool Parition Wizard damaging >>>>> anything? I've liked how it works, but I could change to another.

    With your above info, you should see that your:
    Disk number is Disk 0
    Windows is partition #3 on Disk 0
    Windows Recovery is partition #4 on Disk 0
    - exactly where it should be, to the right and adjacent to Windows >>>> partition

    One could use Minitool Partition Wizard but I don't recommend it for
    Windows Recovery. I prefer to use the method MSFT prescribes for
    enlarging the Windows Recovery partition using DiskPart in Powershell or >>>> Command.com admin mode.

    Better is an increase in size of Windows Recovery partition to 2 GB
    (2048 MB) is better
    => an increase of 904 MB
    1143.8 + 905 = 2047.8 MB = ~ 2 GB

    Note: See below(end of this message) for how to do in DiskPart.
    Prior to doing anything.
    Disable all Restore Points
    Open Windows Update and toggle off Advanced/Recieve updates for other
    Microsoft products.
    Run DiskCleanup in admin mode, select all options, OK to run(wait for it >>>> to finish, do not interrupt), when done.
    Shutdown and Power on the device and boot back into Windows 25H2



    p.s. For analysis reasons, the 4th partition GB sizes in MB are >>>>>>>> 1.36 GB = 1392.64 MB used
    1.41 GB = 1443.84 MB total size
    ==>> Which indicates 51.2 MB free space (~3.5% remaining)

    So I could take, say, 0.15GB, or more, from the adjacent Data/Windows >>>>>>> partition and give it to this partition, right?

    The windows partition has 620GB that are empty. Maybe I should take >>>>>>> more, 2GB sounds better. Then I'll be good for years.


    Open Powershell or Command.com in an admin mode and enter each line at >>>> the prompt, press return after each entry, repeat until done with all lines.

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more
    information."

    I'm in the Event Viewer. It doesn't say what part of the Event Log to
    look in, and so far the only thing at this time that I see is called
    Audit Success and doesn't look like an error. I don't think Im looking >>> in the right place.

    All I see is
    Audit Success date/time Microsoft Windows security auditing 4798
    User acccount managerment
    Subject:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025
    Logon ID: 0x4CC05
    User:
    Security ID: LAPTOP-DELL2025\mmm
    Account Name: mmm
    Account Domain: LAPTOP-DELL2025

    Process Information:
    Process ID: 0x25f4
    Process Name: C:\Windows\explorer.exe
    System
    - Provider
    [ Name] Microsoft-Windows-Security-Auditing
    [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

    EventID 4798
    Version 0
    Level 0
    Task 13824
    Opcode 0
    Keywords 0x8020000000000000
    - TimeCreated
    [ SystemTime] 2026-04-29T05:48:50.3108347Z
    EventRecordID 1916350
    - Correlation
    [ ActivityID] {5427f638-d790-0002-07f8-275490d7dc01}
    - Execution
    [ ProcessID] 1348
    [ ThreadID] 9556
    Channel Security
    Computer Laptop-Dell2025
    Security

    - EventData
    TargetUserName mmm
    TargetDomainName LAPTOP-DELL2025
    TargetSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserSid S-1-5-21-3938773431-1370412602-3320186881-1002
    SubjectUserName mmm
    SubjectDomainName LAPTOP-DELL2025
    SubjectLogonId 0x4cc05
    CallerProcessId 0x25f4
    CallerProcessName C:\Windows\explorer.exe


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and >>> it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Successfully?? Despite the bad parameter? And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.

    Minitool Wizard says the File System is Other.

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753770(v=ws.11)#syntax
    Lists quick as a valid parameter,
    and also fs=ntfs and label=rCYWindows RErCY .

    And
    https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.

    When I leave in quick and take out the label parameter, but leave in fs, >>> I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I >>> get the same error message.

    I didn't do these things yet: Help!!!
    exit
    reagentc /enable
    reagentc /info

    reagentc /info # ... only if it is Enabled, can we Disable it.

    reagentc /disable # This is supposed to store the "goods" on C: so they don't get damaged.
    # That can only work, if the current Recovery Partition is in a working state.
    # If it were already Disabled, disabling it again cannot work.

    diskpart.exe
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary # This creates a "RAW" Basic Data Partition, NoFS

    format quick fs=ntfs label="Windows RE" # When this fails, use Disk Management, assign a drive letter
    # to that partition, then select "Format" in Disk Management.

    # Now, go back to Disk Management again and remove that drive letter
    # using the GUI for it.

    # This terminal session can remain running while you do this.
    # Now, carry on with this recipe. >>
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001

    detail partition # It should be getting a lot closer to a Recovery Partition by now.

    list vol
    exit # We're now out of diskpart, and back to the shell in the terminal.

    reagentc /enable # If this works, it'll be a miracle. Trust me.
    reagentc /info # Reagentc is bomb squad material, never twice the same.


    Optional:

    Say it doesn't work. How did Paul get his working ?
    ( I fixed my test donkey about an hour ago. )

    If it seems you've lost all your copies of Winre.wim , do not panic, as the ISO for Windows
    has copies.

    I use 7ZIP to do random access inside ISO files. The reason I have to do this,
    is the ISO file has "install.wim" , which is a compressed archive of its own, and if you just copied the "install.wim" out, you'd still have to do something
    like use DISM to mount the WIM. 7ZIP can do this, without leaving that single tool.
    And when 7ZIP extracts a file, it can extract it to a destination you have trouble with.

    Folder "6" in this example, is the Windows Pro install folder, but all the folders are likely to have similar contents for WinRE. The ISO9660 file was copied to
    partition F: for dissection. I navigated to the "sources" folder, where I would find the really big "install.wim". I select "open inside" to
    descend the contents. I used folder "6" because it matched the Pro test install
    I was running on at the time. Once in folder "6", I visit Windows and System32
    to find the Recovery partition on the ISO.

    We could use three files total.

    F:\Win10_22H2_English_x64v1.iso\sources\install.wim\6\Windows\System32\ boot.sdi 3170304 bytes

    F:\Win10_22H2_English_x64v1.iso\sources\install.wim\6\Windows\System32\Recovery\
    ReAgent.xml 837 bytes
    Winre.wim 441,202,504


    In an Administrator window, I used diskpart, and selected my Partition 3, which
    is my Recovery Partition. This snippit picks up after

    select disk 0
    list partition
    select partition 3 # This setup doesn't have a Microsoft Reserved. ...

    DISKPART> assign letter=k <=== Assign a letter to the hidden Recovery partition

    DiskPart successfully assigned the drive letter or mount point.

    DISKPART> detail part <=== Notice I've already applied my decorations, so
    the partition is "ready for business" Partition 3
    Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac <=== That's the Recovery Partition type
    Hidden : Yes
    Required: Yes
    Attrib : 0X8000000000000001
    Offset in Bytes: 532603207680

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 K WindowsRE NTFS Partition 2009 MB Healthy Hidden <=== Letter K: assigned

    Then, I use 7ZIP, to "extract" the three files, and I put them in K:\Recovery\WindowsRE

    Now, if your K: didn't have any structure at all inside it yet (which is likely),
    you could do this to establish the folders needed inside. "md" is MakeDir.

    K:
    md Recovery
    cd Recovery
    md WindowsRE

    and then use 7ZIP to directly extract the three files and put them in K:\Recovery\WindowsRE

    In an Administrator Command Prompt window, once the files are in place, you "close the door behind them". Before I do this sequence, there's no security to
    speak of in there. We pretty it up a bit, to pretend this somehow helps
    the security. If we don't do this, maybe ReagentC blows up and ERASES THE FUCKING FILES :-)
    Then you have to extract them again. I'm not doing this for fun, this one is for the bomb squad.

    K:
    cd Recovery
    cd WindowsRE
    attrib +s +h * # Make boot.sdi , ReAgent.xml , and Winre.wim be both System and Hidden attribute
    cd .. # up a level
    attrib +s +h WindowsRE # Make WindowsRE hidden and system.
    cd .. # up a level
    attrib +s +h Recovery # Make Recovery hidden and system.
    C: # Now, K: is all tidy, so we switch back to C:

    In the diskpart session, where our last change was

    assign letter=k

    we now do the corresponding removal of K: (as we don't want this kicking around in "mountvol" forever).

    remove letter=k
    exit

    We're done with loading up the Recovery Partition.

    How will reagentc know where to find its Christmas Present ?

    This command provides a pointer to the third partition. Since I
    am on Disk 0 and Partition 3 was where we were loading up our materials,
    I know this is the right place for it, and I don't have to use a
    reference such as K:\Recovery\WindowsRE . I can just use the more
    physical level namespace.

    PS > reagentc /setreimage /path \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE /logpath C:\TEMP\out.log
    Directory set to: \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE

    REAGENTC.EXE: Operation Successful.

    PS > reagentc /enable # It's reading the PBR version of ReAgent.xml 837 bytes now
    REAGENTC.EXE: Operation Successful.

    PS > reagentc /info
    Windows Recovery Environment (Windows RE) and system reset configuration Information:

    Windows RE status: Enabled
    Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition3\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: 4a593772-4417-11f1-8fe5-d82b2751a2e1
    Recovery image location:
    Recovery image index: 0
    Custom image location:
    Custom image index: 0

    REAGENTC.EXE: Operation Successful.

    And I'm done like dinner.

    The first time you do this, it will seem like an epic adventure.
    The 20th time you've done this, you'll be wanting to be kicking
    the ass of a dev at MSFT, for making you do all this work for nothing.
    As this stuff never remains stable for all that long. One slip,
    and you have to do one of the Push Button Reset things AGAIN.

    Paul
    Way too much effort at this time.
    Op needs to verify if:
    1. C:\Windows\System32\Recovery contains the Recovery partition and
    'before doing anything else'
    2. Size of Recovery partition using Get_Volume
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Thu Apr 30 01:43:40 2026
    From Newsgroup: alt.comp.os.windows-11

    On Thu, 4/30/2026 12:35 AM, ....winston wrote:
    On 29-Apr-26 2:00 AM, micky wrote:


    Open Powershell or Command.com in an admin mode and enter each line at
    the prompt, press return after each entry, repeat until done with all lines.

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more
    information."

    Not going to find much following that path. The info in the admin command console was the pertinent information.


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and
    it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Well, doing commands later in the sequence(setting the id and gpt attributes) after quick format failure and before formatting is not recommended.

    Successfully??-a Despite the bad parameter?-a-a And it's still listed as
    RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.
    RAW is the correct format after formatting and before setting the id and gpt attributes.

    Minitool Wizard says the File System is Other.


    MiniTool Partition Wizard would only report as 'Other' if not formatted as NTFS.
    -ai.e. the it can only be other if not formatted as NTFS or not created as a primary partition(ie. empty and unallocated space)

    https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.
    -aYes
    -aformat quick fs=ntfs label=rCYWindows RE toolsrCY
    or as I indicated with a shorter label name
    -aformat quick fs=ntfs label=rCYWindows RErCY

    When I leave in quick and take out the label parameter, but leave in fs,
    I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I
    get the same error message.
    Not a good idea...

    I didn't do these things yet:-a-a Help!!!
    exit
    reagentc /enable
    reagentc /info

    Here's what was suggested to be done:
    ---------------
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info
    -------------------

    The error you see is almost always related to one or more of these:
    1. Not running Powershell or Command.com in an Admin mode
    2. Not disabling the Windows Recovery partition
    -areagentc /disable
    3. Not entering or mistyping the 'override' command properly
    -adelete partition override
    4. Mistyping the quick format command
    -aformat quick fs=ntfs label="Windows RE"

    It would have been more helpful if you had captured and posted the actual admin console sequence of the completed steps up to and including the last command that failed.

    If you've run Powershell or Command in admin mode and successfully followed the steps through 'delete partition override', you can try exiting diskpart and Powershell and repeat specific steps.

    But first you should verify two conditions
    -aa. Get-Volume
    -a Run in a Powershell admin console, to show the size of new larger Recovery partition
    -ab. If the the second command moved the Recovery file (Winre.wim) to correct Windows folder
    -areagentc /disable
    -a - which moves the files to C:\Windows\System32\Recovery
    ***Note*** to see the file File Explorer's folder View tab needs to be configured to 'Show hidden files, folders and drives', Uncheck 'Hide Extensions for known file types' and Uncheck 'Hide protected operating system files'

    Once you verify the size of partition 4 and the location of WinRe.wim and other files are resident in the correct folder
    C:\Windows\System32\Recovery
    ...then you can proceed by reporting what should be present. Once, verified, I'll post what steps you can repeat...until then, you should not do any other tampering with any other application(Mini Tool, Disk Management, etc.)


    I reproduced his problem. It failed for me as well.
    No, it does not generate an Eventvwr.msc error. To check
    that, I did a "success" operation and THAT got logged
    (how fucking clever) in the expected place. The failure case does not
    generate a log event.

    The partition in this case, CAN be successfully formatted, if...

    1) Use Disk Management.
    2) Assign the RAW partition a drive letter (like K: )
    3) Then, issue a format request in Disk Management, which completes.
    4) You should then remove the letter K: while in Disk Management,
    as you do not want K: hanging around as a side effect of this project.
    It should be removed immediately, before the next step, so you
    don't forget to do it.

    Then, return to the diskpart session and complete the mission.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From ....winston@winstonmvp@gmail.com to alt.comp.os.windows-11 on Thu Apr 30 12:49:25 2026
    From Newsgroup: alt.comp.os.windows-11

    On 30-Apr-26 1:43 AM, Paul wrote:
    On Thu, 4/30/2026 12:35 AM, ....winston wrote:
    On 29-Apr-26 2:00 AM, micky wrote:


    Open Powershell or Command.com in an admin mode and enter each line at >>>> the prompt, press return after each entry, repeat until done with all lines.

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY

    I made it okay to this line and I got "DiskPart has encountered an
    error: The parameter is incorrect. See the System Event Log for more
    information."

    Not going to find much following that path. The info in the admin command console was the pertinent information.


    But I still ran commands you had later:

    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

    And I still did the line above and it worked.

    gpt attributes=0x8000000000000001

    and so did the line above.

    list vol

    But the partition is still listed as RAW.

    So I took out the word quick and it took 2 minutes 10 seconds to run and >>> it said " 100 percent completed
    DiskPart has encountered an error: The parameter is incorrect.
    See the System Event Log for more information.

    DiskPart successfully formatted the volume."

    Well, doing commands later in the sequence(setting the id and gpt attributes) after quick format failure and before formatting is not recommended.

    Successfully??-a Despite the bad parameter?-a-a And it's still listed as >>> RAW, but also says 2555MB, which is about right, plus Healthy and
    Hidden.
    RAW is the correct format after formatting and before setting the id and gpt attributes.

    Minitool Wizard says the File System is Other.


    MiniTool Partition Wizard would only report as 'Other' if not formatted as NTFS.
    -ai.e. the it can only be other if not formatted as NTFS or not created as a primary partition(ie. empty and unallocated space)

    https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf
    says to use the same command.
    -aYes
    -aformat quick fs=ntfs label=rCYWindows RE toolsrCY
    or as I indicated with a shorter label name
    -aformat quick fs=ntfs label=rCYWindows RErCY

    When I leave in quick and take out the label parameter, but leave in fs, >>> I get the same errror message.
    When I leave in quick and take out the fs parameter but leave in label I >>> get the same error message.
    Not a good idea...

    I didn't do these things yet:-a-a Help!!!
    exit
    reagentc /enable
    reagentc /info

    Here's what was suggested to be done:
    ---------------
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info
    -------------------

    The error you see is almost always related to one or more of these:
    1. Not running Powershell or Command.com in an Admin mode
    2. Not disabling the Windows Recovery partition
    -areagentc /disable
    3. Not entering or mistyping the 'override' command properly
    -adelete partition override
    4. Mistyping the quick format command
    -aformat quick fs=ntfs label="Windows RE"

    It would have been more helpful if you had captured and posted the actual admin console sequence of the completed steps up to and including the last command that failed.

    If you've run Powershell or Command in admin mode and successfully followed the steps through 'delete partition override', you can try exiting diskpart and Powershell and repeat specific steps.

    But first you should verify two conditions
    -aa. Get-Volume
    -a Run in a Powershell admin console, to show the size of new larger Recovery partition
    -ab. If the the second command moved the Recovery file (Winre.wim) to correct Windows folder
    -areagentc /disable
    -a - which moves the files to C:\Windows\System32\Recovery
    ***Note*** to see the file File Explorer's folder View tab needs to be configured to 'Show hidden files, folders and drives', Uncheck 'Hide Extensions for known file types' and Uncheck 'Hide protected operating system files'

    Once you verify the size of partition 4 and the location of WinRe.wim and other files are resident in the correct folder
    C:\Windows\System32\Recovery
    ...then you can proceed by reporting what should be present. Once, verified, I'll post what steps you can repeat...until then, you should not do any other tampering with any other application(Mini Tool, Disk Management, etc.)


    I reproduced his problem. It failed for me as well.
    No, it does not generate an Eventvwr.msc error. To check
    that, I did a "success" operation and THAT got logged
    (how fucking clever) in the expected place. The failure case does not generate a log event.

    The partition in this case, CAN be successfully formatted, if...

    1) Use Disk Management.
    2) Assign the RAW partition a drive letter (like K: )
    3) Then, issue a format request in Disk Management, which completes.
    4) You should then remove the letter K: while in Disk Management,
    as you do not want K: hanging around as a side effect of this project.
    It should be removed immediately, before the next step, so you
    don't forget to do it.

    Then, return to the diskpart session and complete the mission.

    Paul

    Errors from Diskpart re: Recovery Partition are not normally logged in
    Event Viewer. When the Recovery partition is properly created,
    re-nabled and WinRe.wim moved back Windows usually has enough knowledge
    for logging.

    The op still needs to verify:
    WinRe.wim resides in C:\Windows\System32\Recovery
    and
    Get-Volume results/status
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Andy Burns@usenet@andyburns.uk to alt.comp.os.windows-11 on Thu Apr 30 17:50:54 2026
    From Newsgroup: alt.comp.os.windows-11

    "....winston" wrote:

    The op still needs to verify:

    Hasn't the O/P given up?

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Andy Burns@usenet@andyburns.uk to alt.comp.os.windows-11 on Thu Apr 30 17:55:22 2026
    From Newsgroup: alt.comp.os.windows-11

    Andy Burns wrote:

    "....winston" wrote:

    The op still needs to verify:

    Hasn't the O/P given up?
    Sorry, the micky thread and the Lars thread had got muddled in my brain ...

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From micky@NONONOmisc07@fmguy.com to alt.comp.os.windows-11 on Thu Apr 30 23:15:15 2026
    From Newsgroup: alt.comp.os.windows-11

    In alt.comp.os.windows-11, on Thu, 30 Apr 2026 00:35:15 -0400,
    "....winston" <winstonmvp@gmail.com> wrote:


    Here's what was suggested to be done:
    ---------------
    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rC?Windows RErC?
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info
    -------------------

    The error you see is almost always related to one or more of these:
    1. Not running Powershell or Command.com in an Admin mode

    I ran it from an icon pinned to the taskbar, but the icon in the desktop
    that I copied Powershell from is in admin mode.

    2. Not disabling the Windows Recovery partition
    reagentc /disable

    I sure thought I did that, that I did everything in order, but now I
    dont have a specific recolleciton of doing it.

    3. Not entering or mistyping the 'override' command properly
    delete partition override

    I copied and pasted it from your post, and it said something like
    "partition deleted", or something that sounded appropriate.

    4. Mistyping the quick format command
    format quick fs=ntfs label="Windows RE"

    I copied and pasted that too, and I examined it after it didn't work. I thought maybe Agent used diffent symbols for the quotes, so I deleted
    the quotes, typed new ones, and ran it again with the same result.

    Aha, this did not happen when I replied to earlier posts -- I'll check
    later if I quoted the two line that start with Mistyping, but this time
    Agent "The following characters cannot be sent correctly using any of
    the charsets sellected for English (American). But then it doesn't show
    any characters. It also says it will suggest a charset but it shows an
    empty box. The only option it gives is to post with the current
    settings. We'll see what that looks like.

    It would have been more helpful if you had captured and posted the
    actual admin console sequence of the completed steps up to and including
    the last command that failed.

    I left the window open, but later there was nothing there. Maybe it
    slept or restarted when I wasn't thinking about this. Don't know. If
    it had restarted, I don't think there would have been an open Powershell window.

    If you've run Powershell or Command in admin mode and successfully
    followed the steps through 'delete partition override', you can try
    exiting diskpart and Powershell and repeat specific steps.

    But first you should verify two conditions
    a. Get-Volume
    Run in a Powershell admin console, to show the size of new larger
    Recovery partition

    That shows it as unknown file structure, fixed, healthy, unknown status,
    0 remaining, and 0 size.
    But Minitool Wizard shows it as 2.50GB and 2.50GB used, and calls it GPT (Recovery Partition)
    OTOH, Minitool Wizard doesn't show the Explore option for this partition
    even though it does for the first partition, the EFI System partition,
    and the 3rd, the data, which implies to me that this last one is empty
    even if it says it's used all 2.50GB!

    b. If the the second command moved the Recovery file (Winre.wim) to
    correct Windows folder
    reagentc /disable

    When I tried that just now, it said it could only be done from an
    elevated command prompt, which implies I didn't have that last time,
    despite that the shortcut in the desktop is elevated. So I dragged the shortcut to a different part of the task bar, and it doesn't look the
    same as the first one. The new one is blue and taller. The one I used
    before is black and squat.
    So I ran reagentc /disable and it says Windows RE is already disabled.
    - which moves the files to C:\Windows\System32\Recovery
    ***Note*** to see the file File Explorer's folder View tab needs to be >configured to 'Show hidden files, folders and drives', Uncheck 'Hide >Extensions for known file types' and Uncheck 'Hide protected operating >system files'

    I did all that immediately after getting the computer, on this and every computer.

    Once you verify the size of partition 4 and the location of WinRe.wim
    and other files are resident in the correct folder >C:\Windows\System32\Recovery
    ...then you can proceed by reporting what should be present. Once,
    verified, I'll post what steps you can repeat...until then, you should
    not do any other tampering with any other application(Mini Tool, Disk >Management, etc.)

    Okay, won't do anything, I'll wait for your post. Thanks.

    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From ....winston@winstonmvp@gmail.com to alt.comp.os.windows-11 on Sat May 2 02:05:30 2026
    From Newsgroup: alt.comp.os.windows-11

    Ok.
    Top posting this and starting fresh from this point with specific
    requests to verify current condition.
    1. Based on info, you may have not used an admin console.
    One of the reasons for diskpart command entry failure.
    2. In the future, ***please do Not" edit any commands
    - do not remove terms or quotes
    Tampering should be avoided, since it adds more complexity and unknown
    for anyone trying to help and it may create other issues that no one can resolve. Only do what was asked, nothing more.
    3. In the future, it may be better for you, to copy any diskpart
    commands to a Notepad text file and paste from that text file rather
    than copy paste from agent.
    4. Please follow instructions and answer questions.


    Instructions/Questions.

    1. First answer what I previously asked.

    Q1. What is the current SizeRemaining and Size of the Recovery partition?
    The command I initially recommended was to shrink C by 904 MB for
    resizing the 1443 MB old Recovery Partition to 2GB (2048 MB).
    You recently reported that the size of that partition was 2555 MB

    Please verify this again.
    Powershell admin console
    GET-VOLUME
    => ensure you run Powershell in admin mode. If you do not know how, ask.

    Look at the results and then answer Q1.


    Q2. Is the WinRE.wim file located in C:\Windows\System32\Recovery?
    Reagentc /disable moves it to the C: drive in this folder:
    C:\Windows\System32\Recovery

    Ensure File Explorer is configured as requested(now, not what you did
    in the past).
    File Explorer's Options and the View tab needs to be configured to
    'Show hidden files, folders and drives', Uncheck 'Hide Extensions for
    known file types' and Uncheck 'Hide protected operating system files'
    Verify the File Explorer is configured properly and WinRE.wim is
    present in C:\Windows\System32\Recovery.

    Look at the results and then answer Q2.


    Q3. What are the partition numbers, type, and size of **all** Disk 0 partitions?

    Powershell admin console.
    Enter the following

    Diskpart
    list disk
    sel disk 0
    list part

    Look at the result and then answer Q3.
    -Note: I want to know the partition number, type and size for every
    single partition on Disk 0.

    Note, you can copy the results from the Powershell window and paste or
    type in each result manually.


    Do nothing else until you reply with the answers to questions Q1, Q2,
    and Q3.



    "....winston" <winstonmvp@gmail.com> wroteThis was the original request to be done in a Powershell admin console
    and using Diskpart. It is only for reference, not for use!!!!!

    reagentc /info
    reagentc /disable

    diskpart
    list disk
    sel disk 0
    list part
    sel part 3
    shrink desired=904 minimum=904
    sel part 4
    delete partition override
    create partition primary
    format quick fs=ntfs label=rCYWindows RErCY
    set id=de94bba4-06d1-4d40-a16a-bfd50179d6ac
    gpt attributes=0x8000000000000001
    list vol
    exit
    reagentc /enable
    reagentc /info
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2