Windows 10 22h2 security update [KB5034441] fails to install with code: 0x80070643

You can’t enable Windows RE on a bit locked disk.

That does not mean you can't enable it at all.

If you cannot enable Windows RE on drive C, it is only one of several options that breaks away. KB5028997 keeps applying, extending the recovery partition otherwise keeps applying.

If enabling Windows RE is not an option, installing KB5034441 isn't one.

I only have the one hard disk and even though I created a separate partition and gave it the correct id to identify it as the Windows RE partition. Windows still bit locks it as you can’t partially bit lock a disk.

So the issue is that Windows Update is trying to apply an inappropriate update.

There must to be unlocked portitions on the disk as otherwise Windows would not boot. BitLocker applies to partitions, not disks.

The whole concept of EFI System and Recovery partitions is about them being separate from the encrypted partition.

Run these scripts in the Powershell, that's how a servicedesk person has solved that for me

Try {
    $computerDisks = Get-PhysicalDisk
    foreach ($computerDisk in $computerDisks) {
        $diskPartitions = Get-Partition -DiskNumber $computerDisk.DeviceId -ErrorAction Ignore
        if ($diskPartitions.DriveLetter -contains 'C' -and $null -ne $diskPartitions) {
            $systemDrive = $computerDisk
            }
        }
    $RecPartition = Get-Partition -DiskNumber $systemDrive.DeviceId | Where-Object { $_.Type -eq 'Recovery' }
    $Volumes = Get-Volume
    foreach ($volume in $Volumes) {
        if($volume.UniqueId.Replace('\?\Volume{','').Replace('}','') -eq $RecPartition.Guid.Replace('{','').Replace('}','')){
        $recoveryPartition = $volume
        }
    }
    if ($recoveryPartition.SizeRemaining -le $FreePartitionSize) {
        Write-Output "Recovery Partition Free Space $($($recoveryPartition.SizeRemaining) / 1000000) MB is smaller than required $($FreePartitionSize / 1000000) MB"
        Exit 1
    }
    else {
        Write-Output "Recovery Partition Free Space $($($recoveryPartition.SizeRemaining) / 1000000) MB is larger than required $($FreePartitionSize / 1000000) MB"
        Exit 0
    }
}
Catch {
    Write-Output 'Recovery Partition not found.'
    Exit 1
}

 

---

Try {
    #Run reagentc.exe /info and save the output
    $pinfo = New-Object System.Diagnostics.ProcessStartInfo
    $pinfo.FileName = 'reagentc.exe'
    $pinfo.RedirectStandardOutput = $true
    $pinfo.UseShellExecute = $false
    $pinfo.Arguments = '/info'
    $p = New-Object System.Diagnostics.Process
    $p.StartInfo = $pinfo
    $p.Start() | Out-Null
    $p.WaitForExit()
    $stdout = $p.StandardOutput.ReadToEnd()

    #Verify that disk and partition are listed in reagentc.exe /info. If blank, then something is wrong with WinRE
    if (($stdout.IndexOf('harddisk') -ne -1) -and ($stdout.IndexOf('partition') -ne -1)) {

        #Disable Windows recovery environment
        Start-Process 'reagentc.exe' -ArgumentList '/disable' -Wait -NoNewWindow
        #Get recovery disk number and partition number
        $diskNum = $stdout.substring($stdout.IndexOf('harddisk') + 8, 1)
        $recPartNum = $stdout.substring($stdout.IndexOf('partition') + 9, 1)

        #Resize partition before the recovery partition
        $size = Get-Disk $diskNum | Get-Partition -PartitionNumber ($recPartNum - 1) | Select-Object -ExpandProperty Size
        Get-Disk $diskNum | Resize-Partition -PartitionNumber ($recPartNum - 1) -Size ($size - 250MB)

        #Remove the recovery partition
        Get-Disk $diskNum | Remove-Partition -PartitionNumber $recPartNum -Confirm:$false

        #Create new partion with diskpart script
        $diskpartScriptPath = $env:TEMP
        $diskpartScriptName = 'ResizeREScript.txt'
        $diskpartScript = $diskpartScriptPath + '' + $diskpartScriptName
        "sel disk $($diskNum)" | Out-File -FilePath $diskpartScript -Encoding utf8 -Force
        $PartStyle = Get-Disk $diskNum | Select-Object -ExpandProperty PartitionStyle
        if ($partStyle -eq 'GPT') {
            #GPT partition commands
            'create partition primary id=de94bba4-06d1-4d40-a16a-bfd50179d6ac' | Out-File -FilePath $diskpartScript -Encoding utf8 -Append -Force
            'gpt attributes =0x8000000000000001' | Out-File -FilePath $diskpartScript -Encoding utf8 -Append -Force
        }
        else {
            #MBR partition command
            'create partition primary id=27' | Out-File -FilePath $diskpartScript -Encoding utf8 -Append -Force
        }
        "format quick fs=ntfs label="Windows RE tools"" | Out-File -FilePath $diskpartScript -Encoding utf8 -Append -Force
        Start-Process 'diskpart.exe' -ArgumentList "/s $($diskpartScriptName)" -Wait -NoNewWindow -WorkingDirectory $diskpartScriptPath

        #Enable the recovery environment
        Start-Process 'reagentc.exe' -ArgumentList '/enable' -Wait -NoNewWindow
        Write-Output 'Recovery Partition Extended Successfully.'
        Exit 0

    }
    else {
        Write-Output 'Recovery partition not found. Aborting script.'
        Exit 1
    }
}
Catch {
    Write-Output 'Unable to update Recovery Partition on the device.'
    Exit 1
}

Thanks for the scripts. They cause Powershell 7 to crash. So I think you meant run them on the older Windows Powershell. Which I did and that didn’t crash.

Gave your first script a go. As expected it came back with no partition found.

However I was able to create a partition without bitlocker enabled on it.

I’m now going to have a go at creating a custom recovery partition. This will take a while (backups and all that). Will then get back to you.

But even if the above works, a windows update shouldn’t require this much user effort.