Waethorn on Nostr: Weird issue with a Windows install.... have you ever tried to wipe a recently new OEM ...
Weird issue with a Windows install.... have you ever tried to wipe a recently new OEM Windows install on a brand name computer, and after using diskpart -> clean, Windows Setup fails to install with "Window Setup failed to re-initialize the deployment engine"?
I figured out that this was a BitLocker problem on new PC's. I had read that new brand name machines are all getting BitLocker encrypted by default, but it used to be that it wasn't complete until a user used a Microsoft Account to fully lock it and to log a recovery key online. I guess their OEM policy changed.
The way I detected it was because I inspected the partition layout and saw that after Windows Setup creates the partition layout, the large partition meant for the install had an "Unknown" file system. For some reason, even when the partition table is wiped out, when Windows recreates the partition table, Windows Setup can detect some leftover BitLocker stuff and it throws off the ability to reformat it correctly.
I could be wrong, but I don't believe SSD's run TRIM in Windows Setup/PE. It usually is scheduled by the disk defragmenter in Windows, but Windows Setup doesn't run those scheduled tasks. This is likely why there's still some encryption metadata stored on the disk even after you wipe the partition table.
The solution to the problem is to manually format the partition using diskpart if your Windows Setup already created it (though you'll need to reboot to relaunch Windows Setup because when it throws an error, you can't go back). You need to use the OVERRIDE parameter after selecting the right one. Here's a full set of instructions if you got this error while trying to wipe the drive and reinstall, such as the common method of using a USB thumb drive:
Reboot as the error prompt requires, and relaunch your installation media.
When you get to the disk partitioning screen, don't erase the current partitions - they're fine.
Hit Shift-F10 to open a Command Prompt.
Type the following commands (not the comments):
diskpart <ENTER>
list disk <ENTER>
(check by the size which disk is the disk you're installing onto - on a single drive system it's probably disk 0 but YMMV)
select disk 0 <ENTER>
list partition <ENTER>
(look for the big primary partition - it's probably the third and final one on the disk, but again, YMMV)
select partition 3 <ENTER>
format quick override <ENTER>
exit <ENTER>
exit <ENTER>
(once for diskpart, and again for Command Prompt)
Now you'll be back to the disk partitioning screen again. Hit F5 to refresh the display, and then choose that same partition again that you did with diskpart. Windows Setup probably won't let you select any other unless you had multiple drives in your machine.
I'm not opposed to the idea of having drives encrypted by default, just that I hate that Microsoft requires that you sign in via a Microsoft Account so that there's a recovery key for the encryption - and they don't tell you that you should go and make a printed copy of it in case something goes wrong with the encryption or with the bootloader. AND IT HAS HAPPENED BEFORE WITH BIOS OR BOOTLOADER UPDATES! For anybody with only a single PC, this is a really poor recovery scenario. Also the fact that Microsoft mandates alternative login security methods instead of your Microsoft Account password to sign into the machine, which is breeding a new generation of users that just tend to forget their online password to be able to sign in on a friends computer and retrieve said BitLocker decryption key....
Thankfully, they haven't completely locked out the ability to bypass Microsoft Accounts altogether. Although they've started removing the bits that enable you to open a Command Prompt during the OOBE (the handy Shift-F10 as mentioned above for Windows Setup is getting taken out in recent builds), they still have the option to bypass the online login mandate via unattended installs. I'll publish my method in another note at a later date.
Oh, and Linux fans: disk encryption there really sucks bad. I haven't seen a single distro installer with LUKS encryption that easily integrates with TPM keys.
The solution is just this:
1) when the OS is installing with **optional** encryption, use the TPM keystore
2) tell the user WITH A BIG WARNING: "Write down this decryption key and keep it some place safe for emergencies, or lose your data!!" with multiple checkboxes that they've confirmed that they followed the instructions
3) make the user create a strong password to unlock the PC (not the same as the decryption key), or use biometrics or some method like a simple PIN, but don't require online access
4) use the TPM to do regular day-to-day decryption
Any OS vendor can follow this plan.
FYI: BitLocker slows down standard drives, especially SSD's, by a lot. The best drives for BitLocker are TCG OPAL/IEEE 1667 drives following Microsoft's eDrive specification, which do hardware encryption and don't slow down much.
I figured out that this was a BitLocker problem on new PC's. I had read that new brand name machines are all getting BitLocker encrypted by default, but it used to be that it wasn't complete until a user used a Microsoft Account to fully lock it and to log a recovery key online. I guess their OEM policy changed.
The way I detected it was because I inspected the partition layout and saw that after Windows Setup creates the partition layout, the large partition meant for the install had an "Unknown" file system. For some reason, even when the partition table is wiped out, when Windows recreates the partition table, Windows Setup can detect some leftover BitLocker stuff and it throws off the ability to reformat it correctly.
I could be wrong, but I don't believe SSD's run TRIM in Windows Setup/PE. It usually is scheduled by the disk defragmenter in Windows, but Windows Setup doesn't run those scheduled tasks. This is likely why there's still some encryption metadata stored on the disk even after you wipe the partition table.
The solution to the problem is to manually format the partition using diskpart if your Windows Setup already created it (though you'll need to reboot to relaunch Windows Setup because when it throws an error, you can't go back). You need to use the OVERRIDE parameter after selecting the right one. Here's a full set of instructions if you got this error while trying to wipe the drive and reinstall, such as the common method of using a USB thumb drive:
Reboot as the error prompt requires, and relaunch your installation media.
When you get to the disk partitioning screen, don't erase the current partitions - they're fine.
Hit Shift-F10 to open a Command Prompt.
Type the following commands (not the comments):
diskpart <ENTER>
list disk <ENTER>
(check by the size which disk is the disk you're installing onto - on a single drive system it's probably disk 0 but YMMV)
select disk 0 <ENTER>
list partition <ENTER>
(look for the big primary partition - it's probably the third and final one on the disk, but again, YMMV)
select partition 3 <ENTER>
format quick override <ENTER>
exit <ENTER>
exit <ENTER>
(once for diskpart, and again for Command Prompt)
Now you'll be back to the disk partitioning screen again. Hit F5 to refresh the display, and then choose that same partition again that you did with diskpart. Windows Setup probably won't let you select any other unless you had multiple drives in your machine.
I'm not opposed to the idea of having drives encrypted by default, just that I hate that Microsoft requires that you sign in via a Microsoft Account so that there's a recovery key for the encryption - and they don't tell you that you should go and make a printed copy of it in case something goes wrong with the encryption or with the bootloader. AND IT HAS HAPPENED BEFORE WITH BIOS OR BOOTLOADER UPDATES! For anybody with only a single PC, this is a really poor recovery scenario. Also the fact that Microsoft mandates alternative login security methods instead of your Microsoft Account password to sign into the machine, which is breeding a new generation of users that just tend to forget their online password to be able to sign in on a friends computer and retrieve said BitLocker decryption key....
Thankfully, they haven't completely locked out the ability to bypass Microsoft Accounts altogether. Although they've started removing the bits that enable you to open a Command Prompt during the OOBE (the handy Shift-F10 as mentioned above for Windows Setup is getting taken out in recent builds), they still have the option to bypass the online login mandate via unattended installs. I'll publish my method in another note at a later date.
Oh, and Linux fans: disk encryption there really sucks bad. I haven't seen a single distro installer with LUKS encryption that easily integrates with TPM keys.
The solution is just this:
1) when the OS is installing with **optional** encryption, use the TPM keystore
2) tell the user WITH A BIG WARNING: "Write down this decryption key and keep it some place safe for emergencies, or lose your data!!" with multiple checkboxes that they've confirmed that they followed the instructions
3) make the user create a strong password to unlock the PC (not the same as the decryption key), or use biometrics or some method like a simple PIN, but don't require online access
4) use the TPM to do regular day-to-day decryption
Any OS vendor can follow this plan.
FYI: BitLocker slows down standard drives, especially SSD's, by a lot. The best drives for BitLocker are TCG OPAL/IEEE 1667 drives following Microsoft's eDrive specification, which do hardware encryption and don't slow down much.