Windows users left to fend for themselves after BitLocker patch bungle

Microsoft has decided that there will be no automatic resolution for a problem with some Windows 10 devices as they attempted to install a BitLocker security vulnerability patch. The issue cropped up in January and was related to a patch for a BitLocker bypass vulnerability and the Windows Recovery Environment. Windows Update …

[Anonymous Coward]

This is where managed vendors come in ...

When the MS printing patch borked everything (I know, which one ?) my company had a 3rds line support contract with an MS reseller.

When the fix was released and reseller called me up to tell me "what you need to do is ..." I reminded them that what *they* needed to do was ....

We had quite a ding dong. Apparently that's "not how it works". Which lead to a lively delve into what exactly we were getting for our x% ....

[Pascal Monett]

Re: This is where managed vendors come in ...

First rule of software vendors : it's not their problem.

Second rule of software vendors : if they do actually do something, you should be eternally grateful and kiss their feet whilst performing whatever acrobatics they deemed necessary to prevent them from too much work.

Third rule of software vendors : do as little as possible once everything is 80% working because, anything after that and they might be liable whereas, if you're happy with 80%, well everything's peachy, right ?

[ecofeco]

Re: This is where managed vendors come in ...

I've had bosses who reined me in when I went trying to enforce vendor obligations.

Which taught me many, many things about incompetence, corruption, my loyalty to any company and effort I should give.

I've also been reined in when trying to fulfill my employer's obligation to clients.

Both of these examples, more than once.

[b1k3rdude]

Re: This is where managed vendors come in ...

indeed, f*ck M$ and thier B$. Anytime I have 'EVER' had to log a support ticket with a TPV, I have ended up having to find a workaround myself.

[Ken Moorhouse]

Re: This is where managed vendors come in ...

I would read that as "we don't feel competent enough to do it for you".

[captain veg]

Re: This is where managed vendors come in ...

Makes you wonder what the advantage is, exactly, over FOSS alternatives.

I remember well when a colleague solemnly informed me that a Microsoft product was going out of support, suggesting that we would have to stop using it. Reflecting, I realised that I couldn't remember the last time that we had actually used Microsoft support, let alone the last time that they had anything useful to say. We continued using it.

-A.

[loops]

We have a recurring issue where Microsoft Office regularly pops up a warning that Macros are blocked (damn right they are!) which we can't suppress, and end users see the error regularly.

We contacted Microsoft Support, they replied and said Microsoft Office issues running on a Microsoft Operating System, connected to the Microsoft Azure, running Microsoft 365, utilising Microsoft SharePoint, controlled by Microsoft Intune is "out of band for Microsoft support".

What can you say to that?

[Anonymous Coward]

How about Goodbye Microshaft and hello Unix. No, I know it won't be either easy nor cheap but neither is staying with the scammers. Sorry, Microsoft.

[loops]

I'd be happy with that (my employer less so, unfortunately we're invested in MS).

[Doctor Syntax]

"unfortunately we're invested in MS"

Try to find an explanation of the sunk cost fallacy in words simple enough for manglement to understand. I know that in this case "invested" will largely mean time and effort but after all, time is money.

[A. Coatsworth]

>>in words simple enough for manglement to understand

Not sure I can source enough crayons and glitter for that to happen...

[ecofeco]

I recommend The Expert Series

https://www.youtube.com/@LaurisB

(hint, you can never explain it to them)

[Jou (Mxyzptlk)]

That is a typo. It should read "infected". Believe me, 'cause I am.

[Zardoz2293]

AND continue to RE-INVEST $$$ Annually in the same tech. Perhaps time to change your viewpoint and sing a different song.

[Anonymous Coward]

"Hello Unix"

Because Unix has so much 'in-band' available support.

Sorry, your bias is showing.

[Mike 137]

@loops

Is this any use?

[loops]

Thanks. We've blocked it by policy already, with no notifications.

The recurring error we get is "The function you are attempting to run contains macros or content that requires macro language support."

It's a well documented error across Microsft sites going back 15 years (with a new post as recent as yesterday).

We worked our way through the first few pages of Google results (trying everything short of disabling the policy that blocks macros, including disabling all add ons, office repair, uninstall/reinstall, install 32 bit instead of 64 bit, deleting various files/folders, different versions, complete system reinstall, etc..). Nothing seems to solve it.

It's weird, because it only happens in certain scenarios. You can launch Word, and do file, new, and it opens a new document (this works fine, as expected). However, if you launch Word then open a file, then do file, new, it generates the above error. Another example; tying some equations seems to trigger it, but not others.

This happens on every single PC. The second it pulls down the Intune profile/security baselines/attack surface reduction rules, it starts with the above error.

We've all but given up on finding a solution. Microsoft are simply not interested in trying to help fix this issue, despite it apparently being incredibly widespread (I think they simply don't have a fix for it, so bat people off).

/shrug

[David 132]

I know this is a band-aid kludge rather than an actual proper solution, but could you use a simple AutoIt script that sits in the background waiting for the error window to appear, and then instantly closes it before the user sees it?

Something like (it’s been a while since I used AutoIt so syntax may not be 100% correct)

$WindowTitle=“Error” ; COMMENT: put actual title here

$WindowText=“The function you are attempting”

While true

; COMMENT WinWait function polls every 250ms, doesn't busy-loop

WinWait($WindowTitle,$WindowText)

WinClose($WindowTitle,$WindowText)

Wend

Yeah, I know, it’s merely a workaround, but from what you say the problem is an annoyance more than a serious issue, so maybe…?

[Ken Moorhouse]

Re: a band-aid kludge

Trouble is that when the error needs to appear, it will be suppressed.

[Dan 55]

We contacted Microsoft Support, they replied and said Microsoft Office issues running on a Microsoft Operating System, connected to the Microsoft Azure, running Microsoft 365, utilising Microsoft SharePoint, controlled by Microsoft Intune is "out of band for Microsoft support".

What can you say to that?

Well that's your problem, isn't it?

[loops]

Indeed, that seems to be the way.

[ecofeco]

Say to that? What I usually say in my role as global enterprise support: fuck Microsoft.

I come across the same issues weekly for the same reason: the Rube Goldberg banger that is Microsoft.

[captain veg]

What can you say to that?

When it comes to Intune, I say "fuck right off".

-A.

[Tron]

Inevitable.

The only way Microsoft can force people to upgrade to their even more dreadful new releases is to break the old ones. Expect more of this.

Get some retail RISC OS Pi systems out there asap.

[Doctor Syntax]

Re: Inevitable.

I think that would really be a step too unfamiliar.

[Dan 55]

Re: Inevitable.

Remember when MS broke Windows Update on Windows 7 after Windows 10 launched, it could sometimes get in a state where it took hours to work unless you rolled back certain patches then installed other patches in a certain order?

Well, that was MS playing nice. Now they just break your computer.

[Doctor Syntax]

Re: Inevitable.

This zombie patch keeps trying and failing to install itself even on computers that don't use Bitlocker.

[Dan 55]

Re: Inevitable.

If you're lucky enough to be able download and run wushowhide.diagcab and it allows you to hide the January update, from then on it appears to pretend that it was installed and not try again.

Only there was more to that update apart from the bit which screws up partitions. I guess they weren't important after all...

[ecofeco]

Re: Inevitable.

LOL! And THEN they broke the Win 10 updates shortly after THAT. I saw many a Win 10 install update bricked with no resolution except a new install to the old version.

I had quite a few unhappy users.

[jpennycook]

Re: Inevitable.

I remember one of the NT4 service packs which accidentally broke PDA sync and Lotus Notes from working. By an amazing coincidence, Microsoft were pushing their own Windows CE devices and Exchange/Outlook products.

[ecofeco]

Re: Inevitable.

And 30 years of documented evidence say no lies detected.

[Anonymous Coward]

Do Microsoft's instructions even work if partitions are laid out in the "wrong" order?

[Anonymous Coward]

They don't, which they hint at, but without offering any solution in that case.

[biddibiddibiddibiddi]

A standard installation shouldn't result in them being laid out in the wrong order. (I thought they stopped doing it that way during install a long time ago.) If they're in the wrong order, you modified it. So if you've already futzed around with your system in a way that isn't supported by Microsoft, they're not going to bother trying to give you instructions to fix the problem when they don't have any way of knowing every possible way that people may have modified their systems and then testing out instructions for them all. The reason they can't fix it within the update is because they can't go making such drastic changes to partitions within an update.

For me, I moved my recovery partition towards the beginning of the drive, in front of C, because I got tired of Microsoft automatically changing around my partitions when I was trying to leave space unprovisioned (for SSD overprovisioning). Trying to fix this recovery partition issue involved using partitioning programs to resize things. And of course, that didn't actually resolve the problem and eliminate the error code, so them blaming the partition size for the failure of the update is false.

They need to do one of two things (or both): One is to make the update simply check for the recovery partition being an issue, and if it is, then mark the update as "uninstallable" and never list it or try to install it again without the user going in and unflagging it (in case they follow the instructions to resize). They'd have to have some way to still indicate to the user that it failed, but having it fail and display an obscure error code EVERY SINGLE TIME UPDATES ARE INSTALLED is stupid. It should return a message like "an option update didn't install correctly, here are instructions if you want to try to fix it, but it's not a big deal since you're not using BitLocker". At the very least, actual information should be given instead of an error code that users may not even see and probably won't understand or know how to research.

The other option is to eliminate the partition entirely, since the recovery environment doesn't entirely depend on it. The update and just set it up to run without the partition. The only thing that is possibly lost is the ability to "reset" Windows, and they can add instructions into the Reset process for dealing with that if it becomes necessary (click here to create a USB installer). If the Recovery partition is broken or can't be properly serviced, what good is it doing anyway?

Of course, the real fix is to make the update not require a larger recovery partition in the first place. Work within what the standard install of a current version of the OS will have available.

[Dan 55]

With update installs through Windows 7, 8, 8.1, and 10, different OEM installs, and dual boot installs it would be a very brave person who claims there is a standard installation with one true partition order for Windows.

And they appear to work at Microsoft.

[Doctor Syntax]

"A standard installation shouldn't result in them being laid out in the wrong order."

A standard installation should be supported by subsequent patches.

[Roland6]

> if partitions are laid out in the "wrong" order?

From doing W7/W8 upgrades to W10 and comparing partition order etc. with identical systems which had a clean install (ie. Disk reformat and Windows installer imposed partitions), I’m unsure if there is a wrong or even a right order.

[Wade Burchette]

No. Because like all software designers today, they are incapable of thinking things can be any different. They understand the new Windows 11; therefore, you do too. They have very powerful computers with very fast internet; therefore, you do too. They use Google Chrome; therefore, you do too. Listen to the customer? That sort of thinking left in the 1990's.

"What do you mean you don't understand it? I understand it, and I am special. I've been told that all my life. I even have the trophies to prove how special I am. You don't understand it? Just be like me and you will. I don't need to listen to you because your ideas are not special."

"What do you mean the website doesn't work? It works for me and I use Chrome. So just be like me. I am special, after all. I was told that all my life. I don't understand why you don't have ultrafast internet either. Where I live I have several choices for internet. How could you not have fast internet? I can afford it, so can you too."

[Bebu]

I can guess what "special" means here

What do you mean you don't understand it? I understand it, and I am special. I've been told that all my life. I even have the trophies to prove how special I am. You don't understand it? Just be like me and you will. I don't need to listen to you because your ideas are not special.

and its not genius or talent. More like the special where everyone gets a trophy in the solo three legged race or the current UK cabinet or the Tory party generally.

[captain veg]

Wrong order

We're talking about PCs here. That's PC meaning Personal Computer. It's mine. My personal property. If I want to partition the disk my way, that's my prerogative.

-A.

[Anonymous Coward]

I just tried the manual steps yesterday. They're definitely not for those not used to CLI. Also, there's that little detail that's difficult to notice. It won't work if the recovery partition is located *before* the OS partition, since the space freed from the latter is not contiguous with the former.

Which is unfortunately the case for me, and since I've got a vanilla install, probably for a lot of people too.

[navarac]

A Disgrace

This is just disgraceful. W10 is still in support, Microsoft, in case you have f**king forgotten. SatNad needs sacking as he has lost his grip on Microsoft (unless it has AI attached, of course).

[biddibiddibiddibiddi]

Re: A Disgrace

Being in support doesn't mean that every problem CAN be fixed.

[navarac]

Re: A Disgrace

>>Being in support doesn't mean that every problem CAN be fixed.<<

True but in this instance the bastards have decided not to bother. I consider this an affront to their users.

[biddibiddibiddibiddi]

Re: A Disgrace

The wording doesn't exclude the possibility of it being something they really can't fix, not without a huge amount of effort and risk to user's data (especially if it's actually encrypted with BitLocker; modifying partitions with that enabled has a higher chance of making stuff completely unrecoverable, or the fix might require fully decrypting then re-encrypting), but there is still never any guarantee that a company WILL fix every bug that is ever found in software. There are plenty of application and OS bugs that the developers decide are not high-risk enough, or affect too small a user-base, to bother putting the effort into fixing. This one is medium risk but it requires physical access to the machine, and MS likely downplays the risk.

It's possible they can't fix the recovery partition issue on Win11 and Server 2022 as well, but if they don't actually SAY that, then they leave open the hope that it will be fixed, giving some tiny bit of boost to the appearance of Win11 being better, without actually committing to it. It may also just not be an issue with those due to some change in the way the recovery partition works, I don't know.

Of course, if they find a way to fix it on Windows 11 and Server 2022 with their respective updates, but don't fix it on 10, then they would be clearly making a decision based on marketing and forced obsolescence/insecurity since the underlying functionality is exactly the same and the code is probably identical. That's their right but also will draw much ire from the small but vocal percentage of users that will notice.

[John Brown (no body)]

Re: A Disgrace

"Being in support doesn't mean that every problem CAN be fixed."

Maybe not, but MS caused this issue. The OS is no longer "of merchantable quality" because they have admitted "design and manufacturing defects present at point of sale" and have said they will not rectify it.

[biddibiddibiddibiddi]

Re: A Disgrace

Well, Microsoft doesn't sell Windows 10 anymore, so... If you buy a system with it, or buy a copy from a reseller, complain to them. (I suppose they still sell Windows 10 in some special cases like volume licensing with downgrades, but I'd bet that a fresh, clean drive installation of the versions that are still in support will result in a layout that doesn't run into this problem.)

[captain veg]

Re: A Disgrace

Bollox. Microsoft can't just abandon a product which is not of merchantable quality.

-A.

[captain veg]

Re: A Disgrace

Bollox. It's software, It can be fixed.

-A.

[Roland6]

Re: A Disgrace

What is particularly weird, is that MS aren’t saying an upgrade to W11 resolves the problem on W10 systems…

[John Brown (no body)]

Re: A Disgrace

I suspect it won't since unless doing a wipe and clean install, the recovery partition is still going to be too small.

[biddibiddibiddibiddi]

Re: A Disgrace

But the recovery partition is going to be completely wiped and rebuilt using the Windows 11 version, and if the build you're installing already contains this update, then there is no problem. I don't think the problem is that the installation suddenly bloats the partition's ongoing space requirement by 250MB; it just needs that much space during the update's installation because of it involving BitLocker, which has to continue to function throughout the process and may involve the recovery partition somehow during the reboot with this update. So I suspect it's doing something like an "active/standby" configuration inside the recovery partition during the update install, writing the new data to it but not removing the old version, then rebooting with the new version as the active build, and deleting the old data if everything worked properly. The final configuration ends up being pretty much the same size as before. That may be what it always did, but there have just been very few major updates to the recovery partition.

Too bad dynamic disks weren't commonly used (now deprecated anyway). Then the C drive could be shrunk and the free space allocated to the recovery partition even if it wasn't contiguous, reducing the risk of data loss since there would be less need to move data around. With SSDs, non-contiguous allocations don't even incur a performance hit. The update process probably still wouldn't do it for you, but at least it would be easier for those doing it manually.

[ecofeco]

Bitlocker?

Well see, there's your first problem.

Do not use. Ever.

[biddibiddibiddibiddi]

Re: Bitlocker?

You don't have to be using BitLocker for this to be a problem. The update still fails to install, so there is an error every time updates are being run, and it's an error that can't be eliminated AND doesn't matter yet makes people think there's a problem.

[ecofeco]

Re: Bitlocker?

I had to deal with this back in January. For many users.

Oddly, it eventually faded away. If anyone is still having problems, then they are many, many updates behind. Which sadly, is far to common.

Your right, it had nothing to with the user having Bitlocker, I just hate Bitlocker because it sucks. And this is just another reason.

[Jou (Mxyzptlk)]

Re: Bitlocker?

You misunderstood the problem. The problem is that this fixes the Recovery environment, there is no fix needed for your encrypted drives. And if you don't use bitlocker encryption, then you don't actually need the fix, but you better have it in case you would use it.

I switched to bitlocker, 'cause else this combination does not work: Encrypted + working snapshots (+ deduplication for non system drives) + software RAID (aka Storage Spaces, not that dynamic disks shit from Windows 2000 which does not even TRIM).

[biddibiddibiddibiddi]

Re: Bitlocker?

Considering drives that really needed TRIM didn't exist when dynamic disks were introduced, and dynamic disks were hardly ever even used, and then Storage Spaces arrived not all that long after SSDs started to become popular, I think it's excusable or at least understandable for MS not to have made much if any effort to make it work. (That would have given people one less reason to move to Storage Spaces even after dynamic disks were deprecated.) Windows 7 didn't even properly and fully support TRIM with basic disks unless they were the right kind of connection.

[ecofeco]

Re: Bitlocker?

I misunderstood nothing. I had to deal with this problem back in January, for many users.

Eventually it faded away. If people are still having problems, it's because they are many, many updates behind. Which sadly, is far too common.

Bitlocker is garbage. Always was, and always will be. Good luck to you. You're going to need it.

[The Man Who Fell To Earth]

Users who do not have a recovery environment configured can ignore the error.

The very fact that this error gets triggered when it should not even apply to the machine says droves. Also reinforces the theory that all the people who really knew how Bitlocker works were laid off l ong ago.

[Roland6]

Re: Users who do not have a recovery environment configured can ignore the error.

I’m not convinced the problem really is Bitlocker. My Thinkpad doesn’t have Bitlocker, the upgrade failed, I ignored it and now it is reporting the January update was successfully installed…

[ecofeco]

Re: Users who do not have a recovery environment configured can ignore the error.

This was my solution as well. I had to tell a lot of people to just ignore it. There was no solution. Eventually, it went away.

Typical MS bullcrap.

[Jou (Mxyzptlk)]

Time to re-create recovery partition (again)

This works from within the system, with bitlocker enabled, usually without a reboot. Unless the partition scheme so f-up that you need a 3rd party tool to help...

Rebuild the Recovery partition is a "simple" process. Skip the # lines in diskpart please :D. They don't hurt, but they will cause diskpart to show the help screen more often than needed.

Step 0: Start diskpart.exe with admin rights.

Step 1: Nuke recovery partiton. (repeat if you have more than one recovery partition)

lis dis

# select system disk

lis par

# Select the "recovery" or "Wiederherstellun"

sel par X

del par override

Step 2: Shrink to have space if needed, either with diskmgmt.msc or diskpart. If your Windows has the "bugfix" from 2017 and created the recovery partition BEFORE the system partition you have to shrink by 850 MB.

list volume

# Select C: volume

select volume X

# Shrink by 250 MB

shrink desired=250

Step 3: Recreate Recovery partition. If you Windows has the "bugfix" from 2017 and created the recovery partition BEFORE the system partition you MAY have to create two partition in order to have the recovery partition at the end of the drive. Check with lis par.

lis dis

# select the system disk

sel dis X

create par pri

# Check where that partition was created. If it was before the system disk and is too small, do a second create par pri

lis par

# If everthing is fine, go on.

format fs=NTFS quick label=Recovery

# Id for Recovery partition

set id=DE94BBA4-06D1-4D40-A16A-BFD50179D6AC

gpt attributes=0x8000000000000001

You can exist diskpar.exe now. Either by entering "exit" or closing the window.

Step 4: Copy WinRE.wim and the uninitialized ReAgent.xml files from the installation Media to C:\Windows\System32\Recovery IF MISSING. Mount or open the Installation ISO, I recommend 7-zip for this. Use the right build version for your OS. Check with winver.exe. Open Sources\install.esd or Sources\install.wim, select the biggest folder of those "1 2 3 4" etc listed there. Copy the Windows\system32\Recovery contents to your normal C:\Windows\System32\Recovery. Rename the possibly existing .xml file, if you want to keep it. From Admin command, run reagentc.exe /enable. This will move WinRe.wim to the Recovery partition and set the GUID and location in ReAgent.xml

NOW retry KB5034439, and it should install fine.

That's it. "So simple" to fix the bad planning ahead which was done in 2007, when Vista came out and supported UEFI. The bad planning was to create "only as big as needed now", aka a too small, recovery partition instead of using 1 GB right from the start for this. That bad default is still there, including the latest Windows 11 Canary Insider.

[Doctor Syntax]

Re: Time to re-create recovery partition (again)

From what I can remember of reading the earlier version of the instructions the last two commands of your step 3 are dependent on some attribute of the recovery partition that you had to make a note of before you nuked it.

And all this CLI stuff to install a patch on an OS that's promoted as being GUI-friendly.

[Jou (Mxyzptlk)]

Re: Time to re-create recovery partition (again)

I wouldn't call it GUI-friendly either. More like pushy, needy. Using Teams and Office often feels like this famous scene.

[Bebu]

Re: Time to re-create recovery partition (again)

Thanks those instructions are really quite clear and make sense.

(Un)fortunately I am unlikely to ever need them. The last time I used diskpart was perhaps twelve years ago. :)

Beginning to think retreating to something like RiscOS or Plan 9 on a RPi5, or BeOS/Haiku on whatever, might make for a more tranquil senility. ;)

[43300]

Two points:

1) It also affects Server 2022. Pissing around with parittions on servers is clearly not something most admins want to be doing

2) It never appeared through WSUS. I'm 99% sure this is 'never' rather than 'pulled quickly' as I normally download them and push them out to some test machines within minutes of them being released - and it wasn't there. It does however try to install on servers which are not managed by WSUS. This is turn suggests that M$ may have known about the issues with it before they even released it as normally updates appear in WSUS at the same time as they become available through unmanged updating.

[mcato]

I followed MS's instructions https://support.microsoft.com/en-us/topic/kb5028997-instructions-to-manually-resize-your-partition-to-install-the-winre-update-400faa27-9343-461c-ada9-24c8229763bf which worked for a system I had created from MS Win10 media. Tedious but worked, and all with MS command line tools.

HOWEVER, another system had extra partitions added by the PC mfr, which prevented the simple decrease the main partition by 250MB and increase the recovery partition by 250MB procedure. In this case I had to use GPARTED to decrease the size of the main partition and move it and all intervening partitions to the right to make room to increase the size of the recovery partition by 250MB. The main partition being large, it took several (unattended) hours.

The point being, MS could only provide a reasonable solution if it knew all of the various PC mfr's partition schema, and was willing to make the end user lose the use of the computer for hours as part of the update process. (How many users would get impatient and restart the system during the partition move?)

And yes, they should have made the recovery partition larger to begin with, but small SSDs (I ran across some 32 and 64GB ones in cheap systems, didn't leave enough room for monthly updates) and push-back from PC mfrs probably quashed that idea.

[Jou (Mxyzptlk)]

> small SSDs (I ran across some 32 and 64GB ones in cheap systems)...

Not only in cheap system, in mini PCs as well. I have two "inherited" Zotac Pico PI335 W3B, 32 GB SSD, 4 GB RAM, N3350, Windows 8 home, not cheap by the time they were bought. They were to be thrown out since the one, who decided to buy them, "forgot" that unmanaged PCs with "home" OS are forbidden. They both ran fine with Server 2019 and run Server 2022 now. Since Server versions are not loaded with crap it works very well. The OS taking less than half of the RAM, after ditching the AV, and about 15 GB disk space unoptimized, and optimized about 13,5 GB. Leaving enough room for updates, data, things that take time but don't need much CPU power like slow downloads or my solar control scripts. Even enough for 850 MB recovery partition, one of the boxes I tested my procedure on to get the KB message out of the way (see other posting). Hell I even did an in-place upgrade from Server 2019 to Server 2022, albeit with the install media unpacked on micro-SD card.

64 GB in that thing would be huge step, but the SSD is soldered obviously. And since they works so flawless it will take a while be fore I change them.

[43300]

I've just done it on a W10 machine. Bloody hell, that was fiddly. The OS parititon wouldn't resize despite having sufficient free space (data towards the end, I assume). Fortunately, there were two recovery partitions - a not uncommon finding as with typical M$ untidiness if one of the feature updates decided the partition was too small, it just created another one and left the old one there too. Did work in my favour here, as by removing both of them I was able to create enough space to create a new partition which was large enough, and then to install the patch.

In order to do this and get it right, you really do need to understand the concept of partitions and get the right one each time when using Diskpart operations. The idea that it's appropriate to get non-technical users to try this is frankly ridiculous. It would be so easy to competely fuck the OS by nuking the wrong partition.

Forums report the issue with the OS partition refusing to resize and suggest GParted - which I would have had to resort to if there hadn't been the dual recovery partitions. GParted is great (used it a number of times) but it really isn't a tool suitable for use by the majority of users - it's primailry for IT techs.

[Ken Shabby]

If they get it wrong the machine will be dparted