Several devices in my organization have recently started booting directly into the Windows Recovery Environment, possibly after receiving updates. Selecting Continue simply returns them to the same recovery screen. Startup Repair, uninstalling quality and feature updates, Safe Mode, DISM, and SFC have all failed. Is there a way to repair these systems remotely without reinstalling Windows? Also, how can I identify which updates were recently deployed to an affected device through Intune?
3 Answers
One possible cause is that the EFI or Windows Recovery partitions are too small for a newer feature update. From bootable recovery media, you may be able to shrink the OS partition and recreate or enlarge those partitions to the required sizes. This is a fairly advanced repair, so make sure you have a backup and verify the partition layout before changing anything.
If the partition layout and boot files can’t be repaired, the practical options are an offline repair or a full reload. A reload is often quicker and more reliable when several recovery options have already failed, but confirm that user data is backed up first.
For the update history, check the device’s Windows Update and quality-update status in Intune, along with update-ring assignments and Windows Update reporting. Compare the deployment and installation dates with the time each device first entered recovery. Intune may show what was targeted and reported, but local Windows event logs or update history can provide more detail if the device is still accessible.
That matches what we’ve seen. Expanding the partitions hasn’t been very successful for us, and redeploying the affected machines has usually been faster.