What is the Windows Recovery Environment?
WinRE is a small recovery operating system built on Windows PE (Preinstallation Environment). Because it starts from its own image instead of the installed copy of Windows, it can repair a system that will not boot, or one too damaged or infected to fix while it is running. On most PCs the WinRE image (Winre.wim) sits on a hidden recovery partition. Windows installation media and USB recovery drives carry their own copy.
How to get into WinRE
- Shift+Restart: hold Shift while choosing Restart from the Start menu power button or the sign-in screen.
- Settings: on Windows 11, Settings > System > Recovery > Advanced startup > Restart now. On Windows 10 the page is under Update & Security > Recovery.
- Command line:
shutdown /r /orestarts into the advanced options menu. - Automatically: after two failed attempts in a row to start Windows, the PC normally loads WinRE on its own, often after showing "Preparing Automatic Repair".
- External media: boot Windows installation media and choose Repair your computer, or boot a recovery drive.
On a BitLocker-encrypted PC, many WinRE tools ask for the recovery key before they can work on the Windows drive.
The WinRE tools
From the Choose an option screen, select Troubleshoot. Reset this PC is on that page; the other tools are under Advanced options. The exact layout differs a little between versions.
| Tool | What it does |
|---|---|
| Startup Repair | Automatically finds and fixes common problems that stop Windows from loading, such as damaged boot files |
| Startup Settings | Restarts into a menu for Safe Mode (4), Safe Mode with Networking (5), Safe Mode with Command Prompt (6), low-resolution video, boot logging, disabling driver signature enforcement and disabling automatic restart after failure |
| Command Prompt | A command line for bootrec, bcdboot, chkdsk, diskpart, offline sfc and DISM, and copying data off the drive |
| Uninstall Updates | Removes the latest quality update or feature update when an update broke startup |
| System Restore | Applies a restore point |
| System Image Recovery | Restores a full system image backup, replacing what is on the target drive |
| UEFI Firmware Settings | Restarts into the firmware setup screen on UEFI systems |
| Reset this PC | Reinstalls Windows with Keep my files or Remove everything |
Working in the WinRE Command Prompt
The prompt opens on X:, which is the recovery environment itself, and the Windows partition may not be C:. Run diskpart then list volume, or try dir on each letter, before running repairs. Offline commands must name the right letter, for example sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows. Boot repairs use bootrec /fixmbr, bootrec /fixboot and bootrec /rebuildbcd, or bcdboot to recreate boot files on UEFI systems.
Managing WinRE
From an elevated prompt in Windows, reagentc /info shows whether WinRE is enabled and where its image is; reagentc /enable and reagentc /disable switch it on and off. Deleting the recovery partition removes the local copy, after which recovery depends on external media.
WinRE and malware removal
Malware that loads with Windows can hide from a scanner or block it. Working from outside the infected OS, through WinRE's Safe Mode options or a bootable scanning environment such as Microsoft Defender Offline, lets you scan and remove files the malware would normally protect. Once the system is clean, WinRE is also where you would roll back damage with System Restore or Startup Repair.
Windows Recovery Environment on the CompTIA A+ exam
WinRE ties together the boot-failure and crash scenarios of Core 2 (220-1202) objective 3.1 and the scan-from-outside-the-OS step of the malware-removal procedure in objective 2.6. Know the ways in (Shift+Restart, Settings, failed boots, installation media), what each tool does, and the least-destructive order: Startup Repair, then Uninstall Updates or System Restore, then Command Prompt repairs, then Reset this PC. Cues: Windows will not start after an update, think Uninstall Updates; boot files are missing or damaged, think Startup Repair, then bootrec.