Macrium Reflect moving to lease model.

johnlgalt · Jul 7, 2023

He was directly replying to hdmi's post stating that Secure Boot would have to be disabled to restore. Nothing more.

cereberus · Jul 7, 2023

johnlgalt said:
He was directly replying to hdmi's post stating that Secure Boot would have to be disabled to restore. Nothing more.

Where does that garbage come from?

Bree · Jul 7, 2023

johnlgalt said:
He was directly replying to hdmi's post stating that Secure Boot would have to be disabled to restore. Nothing more.

cereberus said:
Where does that garbage come from?

Direct from Microsoft.

Microsoft said:
Because of the security changes required for CVE-2023-24932 and described in this article, revocations must be applied to supported Windows devices. After these revocations are applied, the devices will intentionally become unable to start by using recovery or installation media, unless this media has been updated with the security updates released on or after May 9, 2023. This includes both bootable media, such as discs, external drives, network boot recovery, and restore images.

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

hdmi · Jul 7, 2023

ian50 said:
because his balls are crystal.

BobOmb · Jul 7, 2023

Bree said:
Direct from Microsoft.

Let me try to wrap my head around this.. regarding this SecureBoot warning.. (May 9th MS update)

This is supposed to affect all machines that were backed up before a recent UEFI firmware update? (If you dont update your firmware on the same machine the point is mute, but moving from a machine without the updated firmware to a machine with the updated firmware is a problem.)
The newer UEFI firmware contains SecureBoot fixes that will cause a "mismatch" when trying to boot those prior backups? (Disabling SecureBoot, restoring the backup, doing Windows updates, then turning SecureBoot back on is the fix)
Any new backups of systems that have been brought up to date should be fine?

Do I have that right?

This seems important :smirk:

hdmi · Jul 7, 2023

f14tomcat said:
That's very nice, but what is your point? This is a Macrium thread. If you are implying that Acronis is a one-to-one viable repleacement for Macrium, say so, and back it up (no pun intended). In a new thread would be best.

Everyone already knows that it can be a viable replacement to many. But a one-to-one viable replacement? As in, a viable replacement for everyone, no matter what? Really? I'm not sure I understand what you must be getting at here. As for your remark that this should be in a new thread, I am going to have to strongly disagree. It's only logical the fact that people are looking for viable replacements after what just happened so, any relevant info about that is PRECISELY on topic.

GCG1000 · Jul 7, 2023

This topic has been beaten to death! Let's face it, Macrium is going to do what its business plan dictates. If their product is priced beyond anything reasonable, then there are some good (cost-effective) alternatives to consider for your backup requirements.

hsehestedt · Jul 7, 2023

BobOmb,

SecureBoot comes into play once you apply the Revocations that are described in Microsoft KB5025885. This is all a part of a mitigation for what is known as the "BlackLotus bootkit". Microsoft is rolling out the mitigations in three phases. The first phase came with the May 2023 Patch Tuesday updates. A part of the mitigation requires user action which includes applying these "revocations". The revocations include a “Code Integrity Boot Policy” and a “Secure Boot UEFI Forbidden List” update.

Phase 2 of the mitigations are expected to be released next Tuesday with the July Patch Tuesday updates.

I have some batch files ready to go to help people automatically manage this, but I wanted to wait until after next Tuesday to see what phase 2 involves since it may require me to add additional steps to those batch files.

Finally, phase three is "Tentatively scheduled for the first quarter of 2024". This is when Microsoft will actually enforce all of this.

You can see details documented here:

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

The bottom line is that, currently, there is nothing you need to do until you follow the steps to apply revocations as noted in the above article from Microsoft.

hdmi · Jul 7, 2023

johnlgalt said:
He was directly replying to hdmi's post stating that Secure Boot would have to be disabled to restore. Nothing more.

I re-tested it this afternoon just to be sure that I remembered it right, as I don't very often use it and it's been a while since last time. On my dad's Core i5-10400 desktop PC with NVMe it simply refused to boot from my Ventoy stick unless I turned off Secure Boot first. This probably explains why:

Ventoy

Ventoy is an open source tool to create bootable USB drive for ISO files. With ventoy, you don't need to format the disk again and again, you just need to copy the iso file to the USB drive and boot it.

www.ventoy.net

Bree · Jul 7, 2023

BobOmb said:
Let me try to wrap my head around this.. regarding this SecureBoot warning..

This is supposed to affect all machines that were backed up before a recent UEFI firmware update? (If you dont update your firmware the point is mute)

Basically, yes.

As of now, the revocation will not be applied unless you do so manually. In January 2024 MS say they will be applied automatically. Once applied you will only be able to boot from media that has been updated with the security updates released on or after May 9, 2023. This includes any recovery drives, and even a restored system image made before the May 9th update. You'd have to turn off secure boot to boot any such OS.

Latest Windows hardening guidance and key dates

Hardening is a key element of our ongoing security strategy to help keep your estate protected while you focus on your job. Increasingly creative cyberthreats target weaknesses anywhere possible, from the chip to the cloud. Have you seen our publications on hardening on the Windows message...

www.elevenforum.com

Bree · Jul 7, 2023

hsehestedt said:
Finally, phase three is "Tentatively scheduled for the first quarter of 2024". This is when Microsoft will actually enforce all of this.

MS may be intending to speed up the timetable. See the latest update to this article.

Microsoft said:
Editor's note: This article will be updated over time to provide the latest information about hardening changes and timelines. Last updated: June 07, 2023.
....

July 2023

Secure Boot bypass protections KB5025885 | Phase 2
Automated deployment of the revocation files and SafeOS dynamic update package for Window Recovery Environment (WinRE). New Event Log events will report on the success of revocation deployment.

Page Not Found | Microsoft Community Hub

hsehestedt · Jul 7, 2023

Bree said:
MS may be intending to speed up the timetable. See the latest update to this article.

Page Not Found | Microsoft Community Hub

That article still shows as 1st quarter 2024 for this specific issue, but thanks for providing that article as I was unaware of all the other hardening efforts underway.

f14tomcat · Jul 7, 2023

hdmi said:
Everyone already knows that it can be a viable replacement to many. But a one-to-one viable replacement? As in, a viable replacement for everyone, no matter what? Really? I'm not sure I understand what you must be getting at here. As for your remark that this should be in a new thread, I am going to have to strongly disagree. It's only logical the fact that people are looking for viable replacements after what just happened so, any relevant info about that is PRECISELY on topic.

Whoa! You sound like you feel attacked. So sorry. I was addressing the OP who, in my "opinion" had made a post out of topic to the general discussion. That is all. I really am sorry you felt the need to come after me.

Bree · Jul 7, 2023

hsehestedt said:
That article still shows as 1st quarter 2024 for this specific issue, but thanks for providing that article as I was unaware of all the other hardening efforts underway.

It was the "Automated deployment of the revocation files and SafeOS dynamic update package for Window Recovery Environment (WinRE)" in July that caught my eye.

hsehestedt · Jul 7, 2023

Bree said:
It was the "Automated deployment of the revocation files and SafeOS dynamic update package for Window Recovery Environment (WinRE)" in July that caught my eye.

Ah, yes. Good point. Up until now, I had no idea what phase two was supposed to include.

hdmi · Jul 7, 2023

f14tomcat said:
Whoa! You sound like you feel attacked. So sorry. I was addressing the OP who, in my "opinion" had made a post out of topic to the general discussion. That is all. I really am sorry you felt the need to come after me.

No, I didn't feel attacked nor was trying to come after you. Just wondering what made you think Scott might be trying to suggest that it is a one-to-one viable replacement. I mean, isn't it already completely obvious the fact that it is not? But even if it were a one-to-one viable replacement, I still don't see why this should be pointed out in a new thread. Much to the contrary, I think it would imply that the relevancy would be even more pronounced.

f14tomcat · Jul 8, 2023

hdmi said:
No, I didn't feel attacked nor was trying to come after you. Just wondering what made you think Scott might be trying to suggest that it is a one-to-one viable replacement. I mean, isn't it already completely obvious the fact that it is not? But even if it were a one-to-one viable replacement, I still don't see why this should be pointed out in a new thread. Much to the contrary, I think it would imply that the relevancy would be even more pronounced.

Have a wonderful day!

Wisewiz · Jul 8, 2023

A new poll on the lease question is live at Macrium Support Forum as of this morning (8 July '23). If you find this EF discussion has been productive and interesting, please go sign in and cast a vote. A succinct poll result could have a touch more persuasive power for the company's decision-makers than the pages and pages of discussion we've generated here and on the Macrium Forum. Just click the link below to get there.

Will you use Version 9 of Macrium Reflect when it comes out if it becomes lease only?

f14tomcat · Jul 8, 2023

Poll vote done

Josey Wales · Jul 8, 2023

Voted absolutely NO. Now I am not attacking anyone, but why is it that we all cannot seem to stay on Topic. This was all about Macrium Reflect Moving To a Lease Model. But then it moves on to secure boot and stuff that is just confusing the heck out of me. I thought there was a separate Topic on that.

Macrium Reflect moving to lease model.

Antidisestablishmentarianist

My Computers

Well-known member

My Computer

Well-known member

My Computers

Jack of all trades – master of none

My Computers

Well-known member

My Computer

Jack of all trades – master of none

My Computers

Well-known member

My Computers

Well-known member

My Computers

Jack of all trades – master of none

My Computers

Well-known member

My Computers

Well-known member

July 2023​

My Computers

Well-known member

My Computers

Well Known Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Jack of all trades – master of none

My Computers

Well Known Member

My Computer

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Well Known Member

My Computer

Endeavor to Persevere

My Computers

Similar threads

July 2023