Fixing KB5034441 Error 0x80070643: WinRE Partition Resize

LIMEHAWK - Managed IT

Home>Incident Reports>Fixing KB5034441 Error 0x80070643: WinRE Partition Resize

Affected

312 of 347 endpoints (90%)

Incident

January 2024 Patch Tuesday. Morning after, our RMM dashboard lit up like a Christmas tree: 312 of 347 managed endpoints showing KB5034441 installation failure with error 0x80070643. Compliance went from 94% patched to 41% overnight. Couldn't just wave it off — the patch was a critical WinRE security fix tied to BitLocker. And the same update was failing everywhere with the same cryptic error.

Problem identification

Error 0x80070643 is Windows' catch-all "installer failure" code and tells you nothing. We pulled Event Viewer and the CBS log from a sample of affected machines and found the real error buried a few hundred lines down: "WinRE servicing failed, Not enough space."

- affected machines: 312 of 347 endpoints (90%)
- error code: 0x80070643 (generic installer failure)
- real cause: WinRE partition too small — needed 250 MB free, had less than 50 MB
- pattern: all Dell and HP machines shipped 2020 through 2022, same 500 MB recovery partition

Microsoft had shipped KB5034441 to update the Windows Recovery Environment with BitLocker security fixes. But OEMs had been stamping out 500 MB recovery partitions for years, and the WinRE image itself had grown to around 450 MB. There was no room to stage the new image during installation.

MICROSOFT'S "SOLUTION"
Microsoft published KB5028997 with manual remediation steps. 15 steps involving diskpart, reagentc, and manual partition manipulation. Here's what they expected us to do on 312 machines:

- open elevated command prompt
- run reagentc /disable
- open diskpart, select disk, list partitions
- delete recovery partition, shrink OS partition by 250 MB
- create new partition, format, assign correct GPT attributes
- run reagentc /enable
- verify, pray, repeat on 311 more machines

At 15 minutes per machine with perfect execution, that's 78 hours of manual work — assuming no mistakes. One wrong diskpart command and you're rebuilding an OS from scratch. Not happening.

Resolution

Wrote a script that automates the entire partition resize. It queries the disk layout, backs up the existing WinRE content, shrinks the OS partition by 250 MB, extends the recovery partition into the freed space, and re-enables WinRE. No diskpart. No manual steps. Just push and go.

Why this works

The script uses native PowerShell cmdlets and WMI instead of diskpart — safer, more predictable, and actually scriptable. Diskpart's interactive prompts make it a pain to automate and easy to mis-target.

Technical flow:

1. pre-flight checks: verifies WinRE is enabled, identifies disk type (GPT/MBR), locates recovery partition
2. space check: if WinRE already has 250 MB free, exits cleanly — no unnecessary changes
3. backup: copies existing WinRE content to C:\winre_backup before touching anything
4. disable WinRE: releases locks on the recovery partition so it can be modified
5. resize: uses Resize-Partition to shrink C: by 250 MB and extend the recovery partition
6. re-enable: runs reagentc /enable to restore WinRE functionality

Safety feature: the script won't proceed if WinRE is already disabled (indicates existing corruption) or if there's less than 250 MB free on C: to donate. It fails gracefully rather than making things worse.

Outcome

Deployed the script to all 312 affected machines via RMM overnight. 297 completed successfully on the first run. The 15 failures were edge cases: 8 had WinRE already disabled from previous issues, 4 had MBR disks that needed different handling, and 3 had full C: drives. Those we handled manually the next morning. KB5034441 installed successfully on the next Windows Update cycle across the fleet, and compliance came back to 97%.

- machines remediated: 297 of 312 (95% success rate)
- time saved: around 74 hours vs the manual process
- compliance restored: 97% within 48 hours

Key takeaways

Takeaway

Microsoft's "manual remediation" guides aren't realistic at scale — automate or suffer.

Takeaway

OEM partition layouts from 2020 through 2022 are undersized for modern WinRE requirements.

Takeaway

pre-deployment scanning for WinRE partition size can catch this before updates start failing.

Takeaway

we now run this proactively on new client onboarding — fix the partition before the next update drops.

Need help with something like this? Contact us

• Automating CrushFTP Upgrades and In-Place Updates (Automation)

• PC Replacement: Zero Data Loss User Profile Migration (Automation)

• Winget for RMM: Silent Software Deployment at Scale (Automation)