Motherboard failure after trying to boot WinPE

[Vortex]

Hello,

I am experiencing a very strange case. I have a batch file adding Win10XPE to the boot menu of Windows 10. The purpose is to boot from a .wim file extracted from Win10XPE after restarting the computer. Generally, this method works fine but after restart , some computers failed - the motherboards went broken. This happened three times. The .wim file extracted from Win10XPE cannot harm the hardware but I suspect it's the updated BCD store damaging the computers. Anyone who experienced such a weird case?

All the failed systems are UEFI and secure boot is enabled.

The batch file :

[code]bcdedit /export C:\Bcdbackup.bin

bcdedit /create {ramdiskoptions} /d "Win10XPE-64bit"

bcdedit /set {ramdiskoptions} ramdisksdidevice partition=C:

bcdedit /set {ramdiskoptions} ramdisksdipath \winpe\boot\boot.sdi

FOR /F "tokens=3" %%a in ('bcdedit -create /d "Win10XPE-64bit" /application OSLOADER') do SET GUID=%%a

echo %GUID% > C:\Win10PE-GUID.txt

echo bcdedit /delete %GUID% > C:\DelWin10PE.bat

bcdedit /set %GUID% device ramdisk=[C:]\winpe\sources\boot.wim,{ramdiskoptions}

bcdedit /set %GUID% path \windows\system32\winload.efi

bcdedit /set %GUID% osdevice ramdisk=[C:]\winpe\sources\boot.wim,{ramdiskoptions}

bcdedit /set %GUID% systemroot \windows

bcdedit /set %GUID% winpe yes

bcdedit /set %GUID% detecthal yes

REM bcdedit /displayorder %GUID% /addlast

bcdedit /bootsequence %GUID%[code]

[Noel-Blanc]

Hi Vortex
That is an interesting question. I have never implemented this method (I always start winpe from a VHD, on physical PC as in a VM).
In your case (adding a new entry for winpe in the BCD of a hard drive on a working PC), you say you had 3 failures.
Please, can you describe a little more the error messages, the visual elements that make you say that "the motherboard went broken".
Do the 3 failed PCs have any peculiarities that differentiate them from other PCs?
I am delighted to meet a BCDEDIT user
I don't understand English and I use a translator. Please, write very short sentences, avoid ambiguities, translators have limits (me too)
Regards

[Noel-Blanc]

Hi Vortex,
I se you post into reboot.pro...and give some details.
Because your bach works on many computers
Because my bcd use "\windows\system32\winload.efi" and not "...boot...."
Because i notice in the first link you give :
"What does the .sdi do and what is it for?"
Because the reply is : it's the code which plays with ramdisk
My new question is : did you put this "boot.sdi" file in the good place ?
the second link notice "copy D:\boot\boot.sdi C:\sources\"
By the way, when i worked,i used winpe in hard disk type MBR for 10 years and i migrated 30,000 computers from XP to W7.
I'm sure UEFI is not the culprit.
Noel

[Vortex]

Salut Noel,

About the file boot.sdi :

[quote]
Step 2: Create the RAMDISK. The RAMDISK itself involves two parts: a disk (volume) image and a file-system. The \boot\boot.sdi file, stored on the RemoteInstall folder during the initial configuration of the server, serves both of these functions. The .sdi file is a disk image that has been formatted with the NTFS file system. The process of booting from RAMDISK involves placing the Boot.sdi file into memory and pointing the loader at that file as if it were an actual disk. The operating system loader contains code to mount the volume and search the NTFS file system for a .wim file that contains the boot image.[/quote]

https://docs.m....ft. com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771845(v=ws.10)

I am sure about the location of the boot.sdi file, it's extracted from the .iso file with 7-Zip :

[code]C:\winpe\boot\boot.sdi[/code]

copy D:\boot\boot.sdi C:\sources\" , I didn't perform this operation as the .iso file is already providing the necessary file and folder hierarchy.

All the three notebooks are UEFI systems. All of them are running Windows 10. What is weird is that you cannot predict the failure of the motherboard.

The reporter here mentions about the start and stop of the computer, the same things happened to me :

https://docs.m....ft. com/en-us/answers/questions/563319/setup-bcd-to-boot-pe-from-ram. html

Ne vous inquiétez pas au sujet de l'Anglais, il ya long time que je ne parle pas le Français. Ma langue maternelle n'est pas l'Anglais come vous.

I often use bcdedit but this experiments started to be very painful as I cannot tolerate another motherboard failure. Better to continue with UEFI grub4dos ( secure boot turned off )

WinPE from RAM is a good method to install \ maintain Windows from remote locations. UEFI may not be the culpirit but some OS updates can be the reason, not sure.

[Vortex]

Hi Noel,

Here is the list of the files extracted from the .iso file with 7-Zip :

C:\>dir /b /s C:\winpe

C:\winpe\boot
C:\winpe\sources
C:\winpe\boot\bcd
C:\winpe\boot\bcd.LOG
C:\winpe\boot\bcd.LOG1
C:\winpe\boot\bcd.LOG2
C:\winpe\boot\boot.sdi
C:\winpe\boot\bootsect.exe
C:\winpe\boot\en-US
C:\winpe\boot\etfsboot. com
C:\winpe\boot\Fonts
C:\winpe\boot\memtest.exe
C:\winpe\boot\en-US\bootmgr.exe.mui
C:\winpe\boot\en-US\bootsect.exe.mui
C:\winpe\boot\en-US\memtest.exe.mui
C:\winpe\boot\Fonts\chs_boot.ttf
C:\winpe\boot\Fonts\cht_boot.ttf
C:\winpe\boot\Fonts\jpn_boot.ttf
C:\winpe\boot\Fonts\kor_boot.ttf
C:\winpe\boot\Fonts\malgunn_boot.ttf
C:\winpe\boot\Fonts\malgun_boot.ttf
C:\winpe\boot\Fonts\meiryon_boot.ttf
C:\winpe\boot\Fonts\meiryo_boot.ttf
C:\winpe\boot\Fonts\msjhn_boot.ttf
C:\winpe\boot\Fonts\msjh_boot.ttf
C:\winpe\boot\Fonts\msyhn_boot.ttf
C:\winpe\boot\Fonts\msyh_boot.ttf
C:\winpe\boot\Fonts\segmono_boot.ttf
C:\winpe\boot\Fonts\segoen_slboot.ttf
C:\winpe\boot\Fonts\segoe_slboot.ttf
C:\winpe\boot\Fonts\wgl4_boot.ttf
C:\winpe\sources\boot.wim

[Noel-Blanc]

Hi Vortex,
Ok, you know why boot.sdi is necessary. And it is present on the 3 failed pc before the crash...
I think you use the "tool" for a remote action and i understand that failed activity is "forbiden".

When i automatically migrate 30,000 PC, this is 4 or 5 % of failed : too many origine, hard disk failure, motherboard...
The test phase lasted 1 year. I was forced to add the test of each element, each important file (md5 ...) before the last reboot
I tested on many and many VM ni hyperV.

If the hardware is not the culprit, VM can be good.
if you think the BCD file was broken, test it before the last commande/reboot.
If you think it's an upgade of the W10 which is the culprit, you can stop/disable the all services "update" before the last command/reboot.
You can also use the Winre which is present in W10 and replace the boot.wim by yours.
The only one activity that can't be intercepted when update is running is the activity of POQexec.exe, a part of the CBS mecanism, which display "don't stop your PC" or some thing like that before a reboot. And in this case, the BCD can be modified but i never intercept this to see in depth.
How was repaired the 3 failed PC ? With a boot from an USB disk and Winpe to change BCD ? The investigation post-mortem was a good way to understand. Can you do that?

The case is very interesting.
I hope you get the good result.
Noel
Ps : sorry for my english, i didn't use translator here because it's time to go to bed for me. I'm an old man.

[Noel-Blanc]

Hi Vortex,
Very very quikly....this nigth i remember your fle list...
Your file list seems to be needed only for MBR disk ! not for UEFI and GPT disk !
BCD file is in ...\EFI\microsoft\boot... or something like that.
And it is contained in the "system" partition fs=fat32.
You can modify the BCD from the runing OS But the running os doesn't give a letter to the "System" volume/partition in a GPT disk.
Were the "good" computers MBR or UEFI ?

I hope you get the good "tree" for UEFI.
Noel

[Vortex]

Bonsoir Noel,

Thanks for your support. I am using Win10XPE to perform remote maintenance and installation operations in a remote office. I also can do the same job over a VPN connection.

The migration of 30000 computers is a huge job and it's normal to encounter some difficulties. How many members did you have in your team to complete the project?

VM is not an option for me as my job is to maintain physical systems. I need a simple method to boot WinPE from hard drive and a batch file is qualified for this job.

It's very difficult to deal with all those MS updates. I have different backups of Windows 10 updated in different periods.

Me too, I was thinking of replacing the default WinRE file but I have some issues at this point. First of all, my boot.wim file is large and it cannot fit the recovery partition. WinRE is slim build of WinPE. Second, the sysprep operation is moving the WinRE to the folder C:\Windows\system32\Recovey folder and the OS disables the WinRE option after sysprep. You can check it with command bcdedit -enum all -v

The motherboard failure is a very serious problem as the power button of the system does not respond. If the motherboard goes kaput, you cannot not turn on the computer as all the system is already gone. At this point, a USB stick is not an option at all. The only solution is to send the failed device to the repair shop for a motherboard replacement under warranty. The first returned back after reparation and the second will be fixed. I am not sure about the fate of the last computer. The motherboard failure is very annoying and I am not in the position to lose more credits in my work place.

You wrote :

Your file list seems to be needed only for MBR disk ! not for UEFI and GPT disk !
BCD file is in ...\EFI\microsoft\boot... or something like that.
And it is contained in the "system" partition fs=fat32.
You can modify the BCD from the runing OS But the running os doesn't give a letter to the "System" volume/partition in a GPT disk.
Were the "good" computers MBR or UEFI ?

I guess you are mixing the organization of the files in Win10XPE.iso with the one located in the FAT32 partition. The boot partition of an UEFI system ( FAT32 ) contains only the \EFI folder and not the files in WinPE. The list I presented above informs about the internals of the iso file.

You would like to check GRUB4DOS for UEFI thread in the other forum, it's very informative. UEFI grub4dos does not have to manipulate the BCD store of the operation system of the computer.

[Noel-Blanc]

Bonjour Vortex,
I better undestand your situation.
Some details...Before i am retired, i worked in a big compagny. For automatic migration from xp to W7, i was alone to build the process and tools/scripts. The small test team was took in the resources of the service. It's difficult to know the number because it was one work between many other for testing peoples. The problem at this time/years was the small link between the 14,000 offices. We needed to send a CD to bring the big files. In the scripts, i tried to identify all "dangerous" events but...After many issues with CD, devices to read CD, supply, disk....and humain actions. Nevermain, it was an old time.

For your case, i can't imagine that modify BCD is dangerous for the motherboard: almost each update of MS do that and sometimes many times for a one update.

When i spoke VM, test presence of file, etc, i spoke only for the test phase. I think in VM you can emulate the "coming" of update, and no migrate if update is coming.
Loop of tests are more easy with VM but need time and resources...and to be quiet in the mind to construct.

The link you posted spoke about this file boot.sdi and it seemed to be absent for the "guy". I don't verify where this file must be stocked, in the same directory of BCD or not. And in the case of UEFI, in the first "system" partition (fat32).

About UEFI and NVRAM, i find this :
https://docs.microsoft.com/en-us/window ... -efi-nvram
an extract :
"To configure features related to driver debugging and testing on EFI-based systems running Windows XP, Windows Server 2003 and their predecessors, you must edit the boot options in NVRAM. The following sections briefly describe the boot options in EFI NVRAM and explain the aspects of boot options that are specific to systems that use this technology.
On Windows Vista and later versions of Windows, boot options on BIOS-based and EFI-based computers are stored in Boot Configuration Data (BCD), a firmware-independent configuration and storage system for boot options."
I don't read that BCD data were copied in NVRAM for new computers. But was the need of nvram in newly computers? i don't know.
I read on a dell support ( last update june 2021, perhaps change fr-fr to en-us in the link ) but no news about which data are stored in nvram.
https://www.dell.com/support/kbdoc/fr-f ... e-mes-dell
i find this : https://social.technet.microsoft.com/Fo ... y-in-nvram
Modify BCD, even modify NVRAM and motherboard broken ... Can't boot, i understand and if a clear jumper exists for that...So i'm in the doubt.

which data are stored in nvram?

Recently, I built a GPT disk to add my Winpe. The UEFI computer boots from a VHD which contains my winpe. 10GB : Big File, yes ! not for PXE. I modify BCD in the first partition, the one that diskmgmt.msc doesn't show but visible with diskpart. In fact, i use Poweshell. So no need of boot.sdi.

I understand i don't give you some help.

Thank you to point to me GRUB4DOS for UEFI. i'll read...
Noel

Ps : sorry for my poor english

[Vortex]

Bonjour Noel,

Managing such a big project to coordinate 14000 offices is very impressive. You did a great job. Exchanging CDs surely did the job as slow network connections can be problematic.

I am probably out of lack. It's really very strange. Booting from LAN or USB stick does not pose any problem but when it comes to update the BCD records with a batch file, the consequence can be grave. It's impossible to predict the failure.

Virtual machines are good for software testing, I agree with you. UEFI BIOS in may case cannot "virtualized" as the internals of BIOS depends on the manufacturer.

Don't worry, you helped as your replies are moral support for me. Thanks. I will keep posting in this thread about the tests with UEFI grub4dos.

[Noel-Blanc]

Bonsoir Vortex,
Thank you for your kind words.

A last thing.... in the company, we decided on the purchase of microcomputers.
And we had limited the number of different models. When a model was too old it was replaced by a new one.
The stock grew over the years. But the number of models remained very limited.
A test phase made it possible to choose the new model. One month to choose a model
Perhaps this is another approach to dealing with an imprevisible anomaly (why not a bcd test ?).

PXE ?
Need humain action on the computer. Deal with a big file, network connections are better... infrastructure not too complex...

You have chosen grub4dos. Thus....

I would be happy to read your review on grub4dos.

Cheer up.

PS : I read a book about viruses and UEFI but forgot the title. And UEFI is very well described. I'll look for the title...no reference to nvram but it's the point of view of programmer...
And also if you get some news about NVRAM and BCD... ( at this time, i don't believe a link ).

[Vortex]

Bonsoir Noel,

Nowadays, it's practically not possible to limit the number of models before purchasing new hardware, especially when it's the case of laptops. That makes more dificult some testings.

The result of UEFI grub4dos is affirmative for me at least for the moment.

- In your BIOS settings, turn off Secure Boot

- Assign a letter to the FAT32 partition of your UEFI system, for example S:

- Rename S:\EFI\Microsoft\Boot\bootmgfw.efi to S:\EFI\Microsoft\Boot\bootmgfw10.efi

As you know, bootmgfw.efi is the boot manager of UEFI Windows.

- Rename BOOTX64.EFI extracted from grub4dos-for_UEFI-2021-11-16.7z to bootmgfw.efi and move this file to S:\EFI\Microsoft\Boot

- Create a folder named S:\EFI\grub and save your custom menu.lst file here.

S:\EFI\grub\menu.lst :

color blue/green yellow/red white/magenta white/magenta
timeout 30
default /default

title Windows 10

chainloader /EFI/Microsoft/Boot/bootmgfw10.efi

title Win10XPE

find --set-root /Win10XPE_x64.iso
map --mem /Win10XPE_x64.iso (0xff)
chainloader (0xff)

title Winpe_amd64

find --set-root /winpe_amd64.iso
map --mem /winpe_amd64.iso (0xff)
chainloader (0xff)

Both of the iso files are can be on C:\ or D:\ ( or another partition )

When you are done, don't forget to delete\rename bootmgfw.efi ( renamed from BOOTX64.EFI ) and rename bootmgfw10.efi to bootmgfw.efi

The advantage of this method is that it bypasses the Windows boot manager and no need to manipulate the BCD store with bcdedit or any other tool. Of course, instead of the renaming method above, you could use BootIce if you wish to create a new entry in the UEFI startup list.

[Noel-Blanc]

Hi Vortex,
Thank you for all this information about grub4dos. I did not know this evolution for UEFI.
This is a very effective solution.
Disabling the "Secure Boot" remains a manual "local" operation (I prefer complete automatisms).

But this effective, robust and simple solution is a good thing in your context.
Thanks for sharing.
Best regards.
Noel

[Vortex]

Hi Noel,

The adventures continued today. The HP notebook arrived back to my office. The repair shop's report indicated the motherboard replacement. I tested again the batch file and everything went OK, Win10XPE booting successfully. Same hardware , the operating system intact with the same securiy software, nothing modified. Later, I installed Windows 2021 H1 to remove the extra software shipped with the computer. Updated the BCD file with my batch file and boot to WinPE was succesful.

[Noel-Blanc]

Hi Vortex,
thank you for the feedback.
Computer science is highly deterministic. But the mosquito flies every day.
In my previous work, the statistics were tough. Part of defect related to heavily used materials, part related to unknown human interventions...
In your case, I guess you had a bit of anxiety during the new test.
The mystery will always remain unsolved.
Having traced with procmon, I found that the BCD was changed at each logon.
I don't believe MS would take a risk if "the" hardware (nvram?) were fragile.
Congratulations for your perseverance and thank you for sharing.
Noel

Ps: By the way, what about "I installed Windows 2021 H1 to remove the extra software shipped with the computer"? can you give some link on this point, i really don't know.
Ps : i find the title book about UEFI virus : "Rootkits and Bootkits" (reversing Modern Malware and Next Generation Threats"
by Alex Mastrosov, Eugene Rodionov and Sergey Bratus in 2019( one gives me a link on web ....)

[Vortex]

Hi Noel,

About the Windows 10 2021 H1 setup, it's simply formatting the hard drive which came with Windows 10 2020 H2. I wanted to get rid of all that extra branded software.

Computer science is highly deterministic, true but in the same time, it became very complicated and difficult. Chances to face weird situations is becoming higher day by day.

Probably, I will prefer UEFI grub4dos later as I would not take the risk of damaging expensive hardware involuntarily.