On 3/9/2026 9:16 AM, J. P. Gilliver wrote:
On 2026/3/8 19:0:22, Paul wrote:
On Sun, 3/8/2026 2:41 PM, J. P. Gilliver wrote:[]
The post is at the end of the thread.
Thanks. I think I do remember seeing it; not sure why I've lost it.
Force Secure Boot Update
(I thought we'd just agreed that was - for me, anyway - better off!)
[rest snipped (but post kept)]
Leave Secure Boot enabled.
Just run the following one at at time in the following order in a
Powershell admin.
- copy each command and paste into Powershell, press the 'Return' key.
Set-ItemProperty -Path
?HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot? -Name
?AvailableUpdates? -Value 0x40
Start-ScheduledTask -TaskName ?\Microsoft\Windows\PI\Secure-Boot-Update?
Restart the device twice, once after performing the above, and again
when Windows finishes the first restart(do not logon to Windows, restart
for the second time)...once the second restart finishes logon to Windows
in an Admin account.
Your done.
Just run the following one at at time in the following order in a
Powershell admin.
- copy each command and paste into Powershell, press the 'Return' key.
Set-ItemProperty -Path
?HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot? -Name
?AvailableUpdates? -Value 0x40
Start-ScheduledTask -TaskName ?\Microsoft\Windows\PI\Secure-Boot-Update?
Restart the device twice, once after performing the above, and again
when Windows finishes the first restart(do not logon to Windows, restart
for the second time)...once the second restart finishes logon to Windows
in an Admin account.
Your done.
On Mon, 3/9/2026 12:16 PM, J. P. Gilliver wrote:See my reply to Winston ...
(I thought we'd just agreed that was - for me, anyway - better off!)
[rest snipped (but post kept)]
You should use the administrator terminal and try winstons two status commands.
Just to see if PCA 2023 has already wandered in there.
I'm seeing them both return True, even though my motherboard
did not have a BlackLotus patch like the other motherboards.Me too.
And my Secure Boot key situation has been changing dynamically
with time (the kind of behavior I hate). At one time,
I was even able to get red scare text in Linux about
Secure Boot, and that seems to have stopped, but I don't
know what exactly fixed it.
I wouldn't panic about remedying this right away,
but a minimum for you to do right now, is to
run the two status commands.
Paul
On 3/8/2026 12:05 PM, Frank Slootweg wrote:
..w¤?ñ?¤ <winstonmvp@gmail.com> wrote:
[...]
Open Powershell in an admin prompt, then separately run each of these
two commands.
Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)
-match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
- If the first command returns ?true,? then your PC is using the new
certificate
- If this second command returns ?true,? your system is running an
updated BIOS with the new Secure Boot certificates built in.
On my HP Windows 11 laptop with the (March) 'Secure Boot Allowed Key
Exchange Key (KEK) Update', both commands return 'True', while AFAIK,
the only (Windows Update supplied) BIOS update was done on Sept 19, 2023
and according to HP documentation, the Secure Boot Certificate BIOS
update for the age of my laptop (Nov 2022) should have come out around
September 30 or December 31.
'HP PCs - Prepare for new Windows Secure Boot certificates'
<https://support.hp.com/us-en/document/ish_13070353-13070429-16>
So how can a BIOS which was updated on Sept 19, 2023 include
certificate fixes which were not released until late 2025?
It won't.
Sadly the information on what is fixed in which BIOS version for a
given model is missing in the documentation on HP's support site. It
only says something meaningless like 'security fix'.
For my laptop, the HP support site lists sp167316.exe (8.6 MB, of Dec
12, 2025) for BIOS Version F.13 Rev.A. But Windows Update hasn't offered
any new BIOS update and the 'HP Support Assistant' program only offers
version F.11 (i.e. lower number) of Nov 22, 2024 (i.e. way before end of
2025).
Anyway, as I mentioned in another response, I'll probably just
wait-and-see and if Windows fails to boot in/after June, I'll turn off
Secure Boot in the BIOS (assuming the HP BIOS has such a setting). (N.B.
'System Information' of course says "Secure Boot State On".)
[...]
Look in System Information for BIOS Version/Date
What version and date value is reported for your device?
So you at least want to check your Secure Boot status.
If it's enabled, then you could do the PCA 2023 thing.
BIOS Mode UEFI
Secure Boot State On
BIOS Version/Date Phoenix Technologies Ltd. A1ZG0380.X64, 2022-07-06
The boot options screen doesn't seem to have any way to turn Secure
Boot off. Can I do that within Windows?
Delete Signatures
Signatures Information
Enroll Signatures
Anyway, as I mentioned in another response, I'll probably just
wait-and-see and if Windows fails to boot in/after June, I'll turn off
Secure Boot in the BIOS (assuming the HP BIOS has such a setting). (N.B. 'System Information' of course says "Secure Boot State On".)
Not sure how to logon in an Admin account, but if "my done" at that
point, presumably don't need to.
I'm back, after two restarts (though they were full ones, getting into Windows). Not sure what I do next ...
...w¤?ñ?¤ <winstonmvp@gmail.com> wrote:
Set-ItemProperty -Path
?HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot? -Name
?AvailableUpdates? -Value 0x40
For example on my Windows 11 25H2 system they are both already there
and the task has been run and is run every 12 hours. (Minor nit: I think
you mean 0x400 (1024 decimal). That's what mine is set to and what I
have seen mentioned in several web articles.)
On Mon, 9 Mar 2026 16:07:34 +0000, J. P. Gilliver wrote:
On 2026/3/9 4:26:7, Paul wrote:
On Sun, 3/8/2026 2:48 PM, J. P. Gilliver wrote:
On 2026/3/8 18:25:39, Frank Slootweg wrote:
and turn off Secure Boot now (and check that it's off with the
'System
Does turning it off - assuming it really is as simple as just toggling >>>> something in the BIOS (assuming I can get into that) - scramble
anything? (I think I've established I don't have bitlocker on.)
When you turn Secure Boot off, it does not scramble anything in the OS.
Thanks. I'll try to figure out how to turn it off next time I reboot,
since I can't see what use it is to me, and it sounds like having it on
_might_ be problematic at some point.
I'm fond of penguins so I turn it off and leave it off. It might have some utility for Windows but I don't know what. Zero use with Linux except for complicating life.
You probably don't want to turn off Fast Boot on a Windows machine.
On 2026/3/8 19:0:22, Paul wrote:
I'd use HowardKnight, but it's broken and likely for good
(sooner or later it would lose access to part of what it uses).
Sad, but inevitable, I think. (Maybe the MID enhancement to Thunderbird
will come along soon.)
On Mon, 9 Mar 2026 14:44:59 -0700, Stan Brown wrote:
The boot options screen doesn't seem to have any way to turn Secure
Boot off. Can I do that within Windows?
I was mistaken. I restarted the laptop and went into the BIOS boot
options again, this time checking the sub-menus. I found "Secure Boot Configuration" under Security. There are three settings within it:
* Secure Boot Option [Enabled]; can be changed to Disabled
* Install Default Secure Boot Keys [Enter] -- I'm nervous about
testing that without knowing what it will do
* Delete All Signatures [Enter] -- seems like a bad idea
There are also three sub-sub-menus:
Delete Signatures
Signatures Information
Enroll Signatures
Correct me if I'm wrong, but the _least_ likely source of trouble
seems to me to be changing Secure Boot Option to Disabled.
On 2026/3/9 17:26:21, ...w¤?ñ?¤ wrote:
On 3/8/2026 12:05 PM, Frank Slootweg wrote:
..w¤?ñ?¤ <winstonmvp@gmail.com> wrote:
[...]
Open Powershell in an admin prompt, then separately run each of these
two commands.
Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) >>>> -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
- If the first command returns ?true,? then your PC is using the new >>>> certificate
- If this second command returns ?true,? your system is running an
updated BIOS with the new Secure Boot certificates built in.
Here's what I got (entire session, between ===== lines):
=====
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
PS C:\Windows\system32> Secure Boot Certs ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
Secure : The term 'Secure' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that
the path is correct and try again.
At line:1 char:1
+ Secure Boot Certs ([System.Text.Encoding]::ASCII.GetString((Get-Secur ...
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (Secure:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\Windows\system32> ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
False
PS C:\Windows\system32>
=====
I'm fond of penguins so I turn it off and leave it off. It might have some utility for Windows but I don't know what. Zero use with Linux except for complicating life.
You probably don't want to turn off Fast Boot on a Windows machine.
I'm fond of penguins so I turn it off and leave it off. It might have some utility for Windows but I don't know what. Zero use with Linux except for complicating life.
You probably don't want to turn off Fast Boot on a Windows machine.
On 3/9/2026 12:39 PM, J. P. Gilliver wrote:
Not sure how to logon in an Admin account, but if "my done" at that
point, presumably don't need to.
You should know which logon accounts on your device(s) are logon
accounts as an Administrator(i.e. an Admin account)
I'm back, after two restarts (though they were full ones, getting into
Windows). Not sure what I do next ...
Now, in a Powershell admin window copy and paste the following and press
the 'Enter' key. The response will indicate True or False.
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
Report the response in a reply.
On Mon, 9 Mar 2026 16:16:44 +0000, "J. P. Gilliver" <G6JPG@255soft.uk>
wrote:
On 2026/3/8 19:0:22, Paul wrote:
I'd use HowardKnight, but it's broken and likely for good
(sooner or later it would lose access to part of what it uses).
Sad, but inevitable, I think. (Maybe the MID enhancement to Thunderbird
will come along soon.)
Not that it's actually needed, though, since MID functionality already
exists via extensions.
On Mon, 3/9/2026 4:11 PM, J. P. Gilliver wrote:
On 2026/3/9 17:26:21, ...w¤?ñ?¤ wrote:
On 3/8/2026 12:05 PM, Frank Slootweg wrote:
..w¤?ñ?¤ <winstonmvp@gmail.com> wrote:
[...]
Open Powershell in an admin prompt, then separately run each of these >>>>> two commands.
Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) >>>>> -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
- If the first command returns ?true,? then your PC is using the new >>>>> certificate
- If this second command returns ?true,? your system is running an >>>>> updated BIOS with the new Secure Boot certificates built in.
Here's what I got (entire session, between ===== lines):
=====
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
PS C:\Windows\system32> Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)
-match 'Windows UEFI CA 2023')
Secure : The term 'Secure' is not recognized as the name of a cmdlet,
function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that
the path is correct and try again.
At line:1 char:1
+ Secure Boot Certs ([System.Text.Encoding]::ASCII.GetString((Get-Secur ... >> + ~~~~~~
+ CategoryInfo : ObjectNotFound: (Secure:String) [],
CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\Windows\system32>
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
False
PS C:\Windows\system32>
=====
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
On 2026/3/10 0:11:23, rbowman wrote:
[Secure Boot]
I'm fond of penguins so I turn it off and leave it off. It might have some >> utility for Windows but I don't know what. Zero use with Linux except for >> complicating life.
I haven't touched it yet.
You probably don't want to turn off Fast Boot on a Windows machine.
That's the first time _Fast_ Boot has been mentioned in this thread (I think); not sure if I have that or not. I think I have verbose or
something like that, as it tells me what's happening, and I like that -
gives me some idea what's going on (or at least that something is); the
boot time (I have an SSD) isn't irritatingly slow.
On 2026/3/10 1:14:6, ...w¤?ñ?¤ wrote:
On 3/9/2026 12:39 PM, J. P. Gilliver wrote:
Not sure how to logon in an Admin account, but if "my done" at that
point, presumably don't need to.
You should know which logon accounts on your device(s) are logon
accounts as an Administrator(i.e. an Admin account)
I think I have two accounts - my normal one (from which I can "run
[things] as Administrator", but I don't think it is an Admin account),
and an Administrator one, which I created (or enabled - I think it was
there, but hidden) in response to something (IIRR) here. I can't
remember how to get into it - but I could probably find out. (I _think_
I can remember its password.)
On Tue, 3/10/2026 9:39 AM, J. P. Gilliver wrote:[]
That's the first time _Fast_ Boot has been mentioned in this thread (I
think); not sure if I have that or not. I think I have verbose or
something like that, as it tells me what's happening, and I like that -
gives me some idea what's going on (or at least that something is); the
boot time (I have an SSD) isn't irritatingly slow.
There are "two fast things" on your computer.
The "Fast" one in the BIOS, that setting can change the behavior
of the BIOS.
Any time electrical components are changed inside the computer,
it reverts to "slow boot" while it does a slightly better
memtest on the way up. I've had modern computers take
90 seconds to come up, when they are doing their "thorough"
method. The motherboards with the four white "staging LEDs",
none of the LEDs are lit while the guru in there contemplates
its navel. The next time, the BIOS might be 5-8 seconds, because
it knows the hardware content of the box has not changed. We
see this slow startup behavior, on new screwdriver assembly
of computer components. The first boot is a slow one. You
sit with crossed fingers waiting waiting for the staging
LEDs to light up :-) It's like waiting for Christmas.
*******
In Windows, in the Power options, there is a control to enable
things you would not normally enable. If you hibernate just
the kernel of the OS, between sessions (and writing hiberfil.sys
for storage space), that takes a minimum of time at shutdown
(350MB write), and on the way up, the kernel blob is "bulk loaded",
and that saves time on reading in the individual driver files
for all the hardware. That reduces the OS boot component to
5-10 seconds (depending on the prowess of your processor).
The kids with the 6GHz processors, will race their machines
to see "who is the fastest". And the "Fast Startup" OS option helps.
# If you have trouble opening this .webp graphic, Irfanview can open it.
# Using "control.exe" and then Power Options, eventually gives this dialog
https://cdn.mos.cms.futurecdn.net/r5TsgNrpaNUSgzgckzGnEG-888-80.jpg.webp
There is a similarity between OSes, so other versions have something like this.
( https://www.laptopmag.com/how-to/turn-off-fast-startup-on-windows-11 )
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
All the kit in the room here, has that turned off, as I refuse to be held hostage by any silliness :-) I only care about boot times if it
takes 3-5 minutes. A TORAM boot of a Linux DVD takes that long...
Use a USB stick instead.
Paul--
control.exe then "User Accounts", then "Manage another account" .
That allows reviewing the "full" accounts on the machine.
Mine has three accounts. The administrator group account (the
one I MUST NOT delete :-) ), plus two unelevated accounts
used as credentials for file sharing sessions.
The real administrator account is not enabled on the machine.
By default, this is OFF and I generally leave it OFF as it
has a slight security aspect to it. With real malware,
I don't think it matters what you do but we can always
pretend these little ceremonies make a difference.
Paul
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Ah, got it: I hadn't realised that Winston's "Secure Boot Certs" was
just him telling me what the next two lines did - I thought that was
supposed to be part of what I was to enter.
I've just entered the above two lines into an Admin powershell, and the
first one said True, the second False.
(Incidentally, copying them from _your_ post _didn't_ give any embedded
">> " bits, even though they were split.)
[]
So what does one returning True and one returning False tell me/you/us?
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
On 2026-03-10 14:23, Paul wrote:
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
Also you should disable it if you use imaging software to back up your system disk.
Java Jive <java@evij.com.invalid> wrote:
On 2026-03-10 14:23, Paul wrote:
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
Also you should disable it if you use imaging software to back up your
system disk.
Why?
The imaging software - in my case Macrium Reflect Free - just does a sector copy of the partitions. Any changes to the file-systems/
partitions while the image backup is taking place are recorded in a
Volume Shadow Copy.
So I don't see why Fast Startup, which only does it's preparation/ (partial-)hibernation work during Shutdown, has any effect on an image backup.
Or is your concern that the hibernated system copy might be
stale compared to the current OS? If so, 1) when restoring, the Rescue
media will be booted, invalidating the old hibernated system copy and
2) AFAIK, the hiberfil.sys file is not included in the image, so it
can't be restored.
But please educate me/us.
On 2026-03-10 18:47, Frank Slootweg wrote:
Java Jive <java@evij.com.invalid> wrote:
On 2026-03-10 14:23, Paul wrote:
Also you should disable it if you use imaging software to back up your
Turning off Fast Startup, is for if you are a multibooter. If you only >>>> use the one OS on the laptop, then leaving Fast Startup enabled is fine. >>>
system disk.
ÿÿ Why?
ÿÿ The imaging software - in my case Macrium Reflect Free - just does a
sector copy of the partitions. Any changes to the file-systems/
partitions while the image backup is taking place are recorded in a
Volume Shadow Copy.
ÿÿ So I don't see why Fast Startup, which only does it's preparation/
(partial-)hibernation work during Shutdown, has any effect on an image
backup.
ÿÿ Or is your concern that the hibernated system copy might be
stale compared to the current OS? If so, 1) when restoring, the Rescue
media will be booted, invalidating the old hibernated system copy and
2) AFAIK, the hiberfil.sys file is not included in the image, so it
can't be restored.
ÿÿ But please educate me/us.
First, let me clarify things.ÿ From what has been discussed before here &/or in other Windows NGs, Fast Start only hibernates the state of the OS, IIRC at login, whereas user hibernation saves the state of the Desktop and running programs.ÿ The above is a minimum and there may well be other differences, but I'm not aware of them, and particularly not wrt the following problem, which I know happens when an OS is user hibernated.
When an OS is hibernated by the user, the state of play of ALL the Windows readable disks is remembered, not just that of the system disk. If then the PC is booted into a different OS which results in changes to any of the disks readable by Windows, say you copy in a file, when the original Windows OS is reverted to, it will attempt to revert the state of ALL the disks back to their remembered state, and thus any changes made, such as copying in that file, will probably be lost.ÿ At very least a chkdsk is likely to be triggered.
Similarly, if you restore a Windows OS from a backup taken while the OS was hibernated, then when the restored OS boots it will attempt to revert all the disks back to their state when the backup was taken, potentially losing any legitimate changes made in the meantime, even those to a data disk.
So I'm thinking that possibly/probably the same thing may happen when Fast Start is enabled, and thus I cannot recommend using imaging software to back up a Windows OS with Fast Start enabled.
On 2026-03-10 14:23, Paul wrote:
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
Also you should disable it if you use imaging software to back up your system disk.
On 2026/3/10 3:20:5, Paul wrote:
On Mon, 3/9/2026 4:11 PM, J. P. Gilliver wrote:
On 2026/3/9 17:26:21, ...w¤?ñ?¤ wrote:
On 3/8/2026 12:05 PM, Frank Slootweg wrote:
..w¤?ñ?¤ <winstonmvp@gmail.com> wrote:
[...]
Open Powershell in an admin prompt, then separately run each of these >>>>>> two commands.
Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) >>>>>> -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
- If the first command returns ?true,? then your PC is using the new >>>>>> certificate
- If this second command returns ?true,? your system is running an >>>>>> updated BIOS with the new Secure Boot certificates built in.
Here's what I got (entire session, between ===== lines):
=====
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
PS C:\Windows\system32> Secure Boot Certs
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)
-match 'Windows UEFI CA 2023')
Secure : The term 'Secure' is not recognized as the name of a cmdlet,
function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that
the path is correct and try again.
At line:1 char:1
+ Secure Boot Certs ([System.Text.Encoding]::ASCII.GetString((Get-Secur ... >>> + ~~~~~~
+ CategoryInfo : ObjectNotFound: (Secure:String) [],
CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\Windows\system32>
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
dbdefault).bytes) -match 'Windows UEFI CA 2023')
False
PS C:\Windows\system32>
=====
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Ah, got it: I hadn't realised that Winston's "Secure Boot Certs" was
just him telling me what the next two lines did - I thought that was
supposed to be part of what I was to enter.
I've just entered the above two lines into an Admin powershell, and the
first one said True, the second False.
(Incidentally, copying them from _your_ post _didn't_ give any embedded
">> " bits, even though they were split.)
[]
So what does one returning True and one returning False tell me/you/us?
On 3/10/2026 7:18 AM, J. P. Gilliver wrote:[]
On 2026/3/10 3:20:5, Paul wrote:
[]([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Ah, got it: I hadn't realised that Winston's "Secure Boot Certs" was
just him telling me what the next two lines did - I thought that was
supposed to be part of what I was to enter.
I've just entered the above two lines into an Admin powershell, and the
first one said True, the second False.
So what does one returning True and one returning False tell me/you/us?
It means you're done with updating the device for the current 2023 cert,
and good to go.
The only other option until the Secure Boot 2011 are
revoked/expired/removed is an OEM provided UEFI/BIOS update - which can
be installed if released, if not, your done.
Any future Windows Updates with Secure Boot will be installed via
Windows Update, the scheduled task will continue to run and update the
2023 cert if necessary. After 2011 cert is revoked and 2023 fully implemented the scheduled task can be deleted or ignored.
On Tue, 3/10/2026 3:28 PM, Java Jive wrote:
On 2026-03-10 18:47, Frank Slootweg wrote:
Java Jive <java@evij.com.invalid> wrote:
On 2026-03-10 14:23, Paul wrote:
Also you should disable it if you use imaging software to back up your >>>> system disk.
Turning off Fast Startup, is for if you are a multibooter. If you only >>>>> use the one OS on the laptop, then leaving Fast Startup enabled is fine. >>>>
ÿÿ Why?
ÿÿ The imaging software - in my case Macrium Reflect Free - just does a >>> sector copy of the partitions. Any changes to the file-systems/
partitions while the image backup is taking place are recorded in a
Volume Shadow Copy.
ÿÿ So I don't see why Fast Startup, which only does it's preparation/
(partial-)hibernation work during Shutdown, has any effect on an image
backup.
ÿÿ Or is your concern that the hibernated system copy might be
stale compared to the current OS? If so, 1) when restoring, the Rescue
media will be booted, invalidating the old hibernated system copy and
2) AFAIK, the hiberfil.sys file is not included in the image, so it
can't be restored.
ÿÿ But please educate me/us.
First, let me clarify things.ÿ From what has been discussed before here &/or in other Windows NGs, Fast Start only hibernates the state of the OS, IIRC at login, whereas user hibernation saves the state of the Desktop and running programs.ÿ The above is a minimum and there may well be other differences, but I'm not aware of them, and particularly not wrt the following problem, which I know happens when an OS is user hibernated.
When an OS is hibernated by the user, the state of play of ALL the Windows readable disks is remembered, not just that of the system disk. If then the PC is booted into a different OS which results in changes to any of the disks readable by Windows, say you copy in a file, when the original Windows OS is reverted to, it will attempt to revert the state of ALL the disks back to their remembered state, and thus any changes made, such as copying in that file, will probably be lost.ÿ At very least a chkdsk is likely to be triggered.
Similarly, if you restore a Windows OS from a backup taken while the OS was hibernated, then when the restored OS boots it will attempt to revert all the disks back to their state when the backup was taken, potentially losing any legitimate changes made in the meantime, even those to a data disk.
So I'm thinking that possibly/probably the same thing may happen when Fast Start is enabled, and thus I cannot recommend using imaging software to back up a Windows OS with Fast Start enabled.
Does a Macrium Rescue CD "allow" a backup to run while a hiberfil.sys
has a validated header on it (the OS partition being in a hibernated state) ?
If I run this through CoPilot, I think you can imagine what the answer
is, but I'm not convinced the LLM-AI knows this to be true. It could be
a projection of logical-consequences instead of an observation based
on seeing someone report this.
************** CoPilot Answer *********************
Here?s the clear, technically accurate answer <=== Pinocchio's nose seems longer...
you?re looking for - and the short version is: **No, a Macrium Rescue CD Answer has no cites.
will not allow you to run a proper image backup of a Windows partition that is in a hibernated state (i.e., with a valid hiberfil.sys header).**
---
# **Short Answer**
**Macrium Reflect Rescue Media will *refuse* to image an OS partition that contains a valid hibernation file header**, because that indicates the filesystem
is in an *inconsistent* state. This is by design ? imaging a hibernated Windows volume would produce a corrupted or unbootable image.
---
# **Why This Happens**
When Windows hibernates:
- It writes the entire memory state into **hiberfil.sys**.
- It marks the filesystem as **?dirty / hibernated?** in the NTFS metadata.
- The volume is *not* in a crash-consistent state.
Macrium Reflect (including the Rescue CD environment) checks for this condition.
If it detects a valid hibernation header:
- It **blocks the backup**
- It warns that the volume is in a hibernated state
- It requires you to **disable hibernation or boot Windows normally** before imaging
This is the same behavior you see when trying to mount or image a
hibernated NTFS volume under Linux ? the filesystem is considered unsafe to access.
---
# **Why Macrium Blocks It**
Allowing a backup of a hibernated OS partition would risk:
- Filesystem corruption
- Incomplete or inconsistent system state
- Unbootable restored images
Macrium?s design philosophy is to guarantee *restorable* images, so it refuses to proceed.
---
# **What *Does* Work**
If you want to image the OS partition from Rescue Media:
### Boot into Rescue Media
### Open a command prompt
### Run:
powercfg /h off
```
This deletes **hiberfil.sys** and clears the hibernation flag. <=== sheerest hallucination!
it is booted off X:, not C:
After that, Macrium will allow the backup. If this works, this is my
shocked face.
---
# **Edge Case: Forced Imaging?**
Even if you try to force it (e.g., using forensic sector-by-sector mode), Macrium still checks the NTFS state and will warn or refuse.
Macrium does **not** provide an override to ignore a hibernated filesystem.
---
# **Bottom Line**
**A Macrium Rescue CD will *not* allow a backup of a Windows OS partition
if hiberfil.sys has a valid header.**
You must disable hibernation or boot Windows normally first. <=== this is a more sound advice (including no Fast Startup cycle)
[Please note: This answer had NO reference section with cites at the bottom.]
[This will require test to validate. I can believe the answer that the consistency problem will be picked up by the Rescue CD (because Macrium
devs are very thorough individuals -- hardly ever making stupid mistakes),
if you attempt to pull the old switcheroo. And adjusting your hibernation state before
going offline to make a backup, that's a good answer. But thinking
you can erase C:\hiberfil.sys while booted from X: is just silly. If the LLM-AI told me to "del C:\hiberfil.sys" from the X: prompt, that would make more logical (and dangerous) sense for an AI to cook up. And no, don't
do that either.]
When you back up, it's up to you as a responsible adult, to not be
throwing challenges into the picture that are illogical and just
asking for trouble. Great for an experiment. Bad for a part of your
regular backup cycle. Since my hiberfil.sys is disabled everywhere in
this room, I'm not even ready to test this. Purely by accident,
I'm ready for backup anytime. I didn't plan this.
Macrium can pretend to record the pagefile.sys while the
OS is running on C: , but the contents are all zero. There
is a good chance it is just faking it.
Macrium is not the only imaging software, though it is the one that currently I'm using.ÿ As you may remember, I used to use Ghost until I discovered that it is buggy with GPT disks, and that warns you that the filesystem is in a 'dirty' state, advises you not to proceed, but will
allow you to do so if you choose.
On 2026/3/11 1:41:24, ...w¤?ñ?¤ wrote:
On 3/10/2026 7:18 AM, J. P. Gilliver wrote:[]
On 2026/3/10 3:20:5, Paul wrote:
[]([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Ah, got it: I hadn't realised that Winston's "Secure Boot Certs" was
just him telling me what the next two lines did - I thought that was
supposed to be part of what I was to enter.
I've just entered the above two lines into an Admin powershell, and the
first one said True, the second False.
So what does one returning True and one returning False tell me/you/us?
It means you're done with updating the device for the current 2023 cert,
and good to go.
Thanks! That sounds reassuring.
The only other option until the Secure Boot 2011 are
revoked/expired/removed is an OEM provided UEFI/BIOS update - which can
be installed if released, if not, your done.
Given
BIOS Version/Date LENOVO 1LCN50WW, 2017/4/17
, I don't think that's likely. (Almost certainly pre Windows 10?)
Any future Windows Updates with Secure Boot will be installed viaI guess I'll find out in June! (Or am O safe from that one?)
Windows Update, the scheduled task will continue to run and update the
2023 cert if necessary. After 2011 cert is revoked and 2023 fully
implemented the scheduled task can be deleted or ignored.
On 3/11/2026 6:29 AM, Java Jive wrote:
Macrium is not the only imaging software, though it is the one that
currently I'm using.ÿ As you may remember, I used to use Ghost until I
discovered that it is buggy with GPT disks, and that warns you that
the filesystem is in a 'dirty' state, advises you not to proceed, but
will allow you to do so if you choose.
Hardly a fair comparison(Ghost vs. Macrium). Most today would be using
the last released free version of Macrium or its current subscription released version.
Ghost last released version compatible for a Windows operating system
was over 16 years ago(Nov. 2009) - Windows 7 and earlier. Never designed
for use on Win8x and later, nor with UEFI and GPT.
For non-enterprise consumer Windows 8x and later Symantec's product was System Recovery(for Win10 version SSR version 11.1.3, aka 2013 SP4), Enterprise was Ghost Solution Suite version 3.3 later.
ÿ- Symantec consumer division Veritas was sold to Carlisle Group in
2016 with SSR rebranded as Veritas System Recovery(initial release
version 16 for Win10 compatibility).
On 3/11/2026 5:47 AM, J. P. Gilliver wrote:
On 2026/3/11 1:41:24, ...w¤?ñ?¤ wrote:
On 3/10/2026 7:18 AM, J. P. Gilliver wrote:[]
On 2026/3/10 3:20:5, Paul wrote:
[]([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Ah, got it: I hadn't realised that Winston's "Secure Boot Certs" was
just him telling me what the next two lines did - I thought that was
supposed to be part of what I was to enter.
I've just entered the above two lines into an Admin powershell, and the >>>> first one said True, the second False.
So what does one returning True and one returning False tell me/you/us? >>>It means you're done with updating the device for the current 2023 cert, >>> ÿÿ and good to go.
Thanks! That sounds reassuring.
The only other option until the Secure Boot 2011 are
revoked/expired/removed is an OEM provided UEFI/BIOS update - which can
be installed if released, if not, your done.
Given
ÿÿÿÿBIOS Version/Dateÿÿÿ LENOVO 1LCN50WW, 2017/4/17
, I don't think that's likely. (Almost certainly pre Windows 10?)
ÿÿ Any future Windows Updates with Secure Boot will be installed viaI guess I'll find out in June! (Or am O safe from that one?)
Windows Update, the scheduled task will continue to run and update the
2023 cert if necessary.ÿ After 2011 cert is revoked and 2023 fully
implemented the scheduled task can be deleted or ignored.
As noted, you're good to go(based on your earlier reply that the Powershell command indicated 2023 cert is present in the db store.
Discussion here and elsewhere regarding Secure Boot has been going on for quite some time.
Some of the articles are missing the point and spreading fear beyond what will/does happen.
On 3/11/2026 5:47 AM, J. P. Gilliver wrote:
On 2026/3/11 1:41:24, ...w¤?ñ?¤ wrote:
On 3/10/2026 7:18 AM, J. P. Gilliver wrote:[]
On 2026/3/10 3:20:5, Paul wrote:
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')
Given
BIOS Version/Date LENOVO 1LCN50WW, 2017/4/17
, I don't think that's likely. (Almost certainly pre Windows 10?)
Any future Windows Updates with Secure Boot will be installed viaI guess I'll find out in June! (Or am O safe from that one?)
Windows Update, the scheduled task will continue to run and update the
2023 cert if necessary. After 2011 cert is revoked and 2023 fully
implemented the scheduled task can be deleted or ignored.
As noted, you're good to go(based on your earlier reply that the
Powershell command indicated 2023 cert is present in the db store.
Discussion here and elsewhere regarding Secure Boot has been going on
for quite some time.
Some of the articles are missing the point and spreading fear beyond
what will/does happen.
For Win10 and Secure Boot with the 2023 cert deployed(like yours True
for Windows, False for UEFI), the device and its Win10 OS(24H2) should
be enrolled in ESU to ensure any future Secure Boot updates are
available, downloaded and installed.
On 2026-03-11 17:53, ...w¤?ñ?¤ wrote:
On 3/11/2026 6:29 AM, Java Jive wrote:
Macrium is not the only imaging software, though it is the one that
currently I'm using.ÿ As you may remember, I used to use Ghost until
I discovered that it is buggy with GPT disks, and that warns you that
the filesystem is in a 'dirty' state, advises you not to proceed, but
will allow you to do so if you choose.
Hardly a fair comparison(Ghost vs. Macrium). Most today would be using
the last released free version of Macrium or its current subscription
released version.
Ghost last released version compatible for a Windows operating system
was over 16 years ago(Nov. 2009) - Windows 7 and earlier. Never
designed for use on Win8x and later, nor with UEFI and GPT.
For non-enterprise consumer Windows 8x and later Symantec's product
was System Recovery(for Win10 version SSR version 11.1.3, aka 2013
SP4), Enterprise was Ghost Solution Suite version 3.3 later.
ÿÿ- Symantec consumer division Veritas was sold to Carlisle Group in
2016 with SSR rebranded as Veritas System Recovery(initial release
version 16 for Win10 compatibility).
I just used Ghost for as long as it worked for me, because I had rescue media which automated a lot of the process of backing up and restoring,
and stopped using it when I found it was buggy and gave problems on GPT disks.
Anyway, I don't think you've altered my point, which was that there are different imaging programs which might behave differently under unusual situations, such as the 'dirty' flag being set.
On Tue, 3/10/2026 2:06 PM, Java Jive wrote:
On 2026-03-10 14:23, Paul wrote:
Turning off Fast Startup, is for if you are a multibooter. If you only
use the one OS on the laptop, then leaving Fast Startup enabled is fine.
Also you should disable it if you use imaging software to back up
your system disk.
You can back up the system hot. Not a problem.
(That's why it uses VSS, the Volume Shadow Service, it
freezes a "snapshot" of the OS files, and anything saved
after the ten second quiesce phase, will be backed up
on your *next* backup.)
Backing up from a Rescue CD, the X: OS partition there does not
have VSS, but the C: filesystem is at rest and so it is
easier to back up (compared to backing up hot).
Macrium can pretend to record the pagefile.sys while the
OS is running on C: , but the contents are all zero. There
is a good chance it is just faking it.
It would be nice if some utilities would agree as to what
files are on various representations of a partition like C:
(and the C: backup), but this hardly happens. There are
too many little differences to get an exact match out of anything.
Whereas a data partition like D: , it is more likely to have utilities
that see the same things on there.
On 2026-03-10 23:25, Paul wrote:
Macrium can pretend to record the pagefile.sys while the
OS is running on C: , but the contents are all zero. There
is a good chance it is just faking it.
Which is the sort of reason why I think the whole idea of imaging a
running system is dodgy, and always shut a system down before imaging it.
IIRC, another is that there are keys in the registry which flag whether
a system was shut down properly. If you restore the image of a running system, on first boot it will find that these flags are not in their
proper state, and a menu will be displayed asking for which version of Windows to load, even if there's only one, or whether to load safe mode, etc.
This might not matter much to a home user, but, speaking as a
former professional who used to create the OS images for thousands of corporate PCs, I'm pretty sure that I wouldn't have been allowed to
produce an image that did that, even supposing I had been sufficiently unembarrassed to try!
Java Jive <java@evij.com.invalid> wrote:
IIRC, another is that there are keys in the registry which flag whether
a system was shut down properly. If you restore the image of a running
system, on first boot it will find that these flags are not in their
proper state, and a menu will be displayed asking for which version of
Windows to load, even if there's only one, or whether to load safe mode,
etc.
I think it's extremely unlikely that this is actually a problem,
because if it was, Macrium Reflect would not offer online image backup
(of system partitions) or would at least warn for the consequences and
what precautions/ measures to take when restoring.
--This might not matter much to a home user, but, speaking as a
former professional who used to create the OS images for thousands of
corporate PCs, I'm pretty sure that I wouldn't have been allowed to
produce an image that did that, even supposing I had been sufficiently
unembarrassed to try!
On 12/03/2026 15:41, Frank Slootweg wrote:
Java Jive <java@evij.com.invalid> wrote:
IIRC, another is that there are keys in the registry which flag whether
a system was shut down properly.ÿ If you restore the image of a running
system, on first boot it will find that these flags are not in their
proper state, and a menu will be displayed asking for which version of
Windows to load, even if there's only one, or whether to load safe mode, >>> etc.
ÿÿ I think it's extremely unlikely that this is actually a problem,
because if it was, Macrium Reflect would not offer online image backup
(of system partitions) or would at least warn for the consequences and
what precautions/ measures to take when restoring.
No, agreed, not an actual problem as such, it's just the result seems somewhat unprofessional.ÿ Fine for home use, but perhaps not good for your professional reputation at work :-), which is why I added ...
ÿÿÿÿThis might not matter much to a home user, but, speaking as a
former professional who used to create the OS images for thousands of
corporate PCs, I'm pretty sure that I wouldn't have been allowed to
produce an image that did that, even supposing I had been sufficiently
unembarrassed to try!
On Wed, 3/11/2026 2:08 PM, ...w¤?ñ?¤ wrote:
Some of the articles are missing the point and spreading fear beyond what will/does happen.
The fear is justified, given how stupid some of the motherboard
engineering can be. One company lost the curation chain for their
BIOS releases. In some cases, the only reason this stuff works,
is because the BIOS in an Award, AMI, Phoenix, InSyde and those
companies push out the code for that.
It is the lack of industry expertise in UEFI and Secure Boot that
strikes fear for the unlucky computer owners.
It would help greatly, if we had a tool to properly list the certs
and revokes.
Paul
That's why I said Macrium Reflect probably doesn't even backup (the sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the
sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copyÿÿÿ
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
Paul wrote on 3/11/2026 1:11 PM:
On Wed, 3/11/2026 2:08 PM, ...w¤?ñ?¤ wrote:
Some of the articles are missing the point and spreading fear beyond what will/does happen.
The fear is justified, given how stupid some of the motherboard
engineering can be. One company lost the curation chain for their
BIOS releases. In some cases, the only reason this stuff works,
is because the BIOS in an Award, AMI, Phoenix, InSyde and those
companies push out the code for that.
They lost the curation chain b/c of Secure Boot requirements?
On Fri, 3/13/2026 3:18 AM, ...w¤?ñ?¤ wrote:
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the
sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copyÿÿÿ
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
I just tested this. I had a lot of trouble with the test subject, just getting hiberfil.sys turned on. There really is a minimum size it is happy with!
Who knew. I had to move partitions around on the test disk, it took a while to get set up for this.
The Online backup was 46,716,473 KB and the Hiberfil.sys (after having just used it to hibernate the session then wake up again) was all zeros. While it reads out as zeros, the zeros don't seem to be recorded as such. The same is true of the pagefile.sys, it's zeros and they might or might not be stored.
The Offline backup was 81,806,033 KB and the Hiberfil.sys is recorded.
The first four characters are "WAKE". The pagefile.sys is similar recorded. #HSTR:Trojan:MSIL/AgentTesla <=== a piece of some virus definitions, incoming.
Restoring an all-zeros pagefile.sys does not hurt anything. That is
because there is a GPEdit security policy that does exactly that.
It zeros the pagefile.sys at shutdown, so you "can't find those virus definitions" sitting there.
https://www.ninjaone.com/blog/virtual-memory-pagefile-encryption/
"To securely erase sensitive virtual memory data,
enable ClearPageFileAtShutdown via Group Policy...
This protects data remnants and enhances system security compliance."
The hiberfile has one header pattern for a valid head. And something different when it is invalidating the hiberfile content to prevent
accidental reuse (which might not align with file system state). so
while I can see the word "WAKE", I don't know which byte is the invalidate byte.
On Fri, 3/13/2026 4:46 AM, Paul wrote:
On Fri, 3/13/2026 3:18 AM, ...w¤?ñ?¤ wrote:
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the >>>> sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base >>>> etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copy
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
I just tested this. I had a lot of trouble with the test subject, just
getting hiberfil.sys turned on. There really is a minimum size it is happy with!
Who knew. I had to move partitions around on the test disk, it took a while >> to get set up for this.
Paul
On Fri, 3/13/2026 3:09 AM, ...w¤?ñ?¤ wrote:
Paul wrote on 3/11/2026 1:11 PM:
On Wed, 3/11/2026 2:08 PM, ...w¤?ñ?¤ wrote:
Some of the articles are missing the point and spreading fear beyond what will/does happen.
The fear is justified, given how stupid some of the motherboard
engineering can be. One company lost the curation chain for their
BIOS releases. In some cases, the only reason this stuff works,
is because the BIOS in an Award, AMI, Phoenix, InSyde and those
companies push out the code for that.
They lost the curation chain b/c of Secure Boot requirements?
The custody chain for BIOS updates is broken, and that injures
their ability to help customers have the best most secure
motherboards possible.
I don't use hibernation, routinely disabled(or verified as disabled) shortly after a Windows install of any type(clean, on-top, repair, feature update[now only H2]...except for testing(like you are doing).
I recall from an earlier on-MSFT-campus discussion that hiberfil.sys that was intended(oobe) to have a minimum size, but as expected that's just a starting point and growth can occur even with the same identical footprint of programs, apps, services, etc. running and without any changes to Windows.
It's like a monster *It's alive* (Victor Frankenstein, after turning on/off the electricity or lightning strike - movie version; Shelley's version - no electricity or lightning) and for my use not needed.
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Paul <nospam@needed.invalid> wrote:
[...]
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Your findings seem to be an argument for NOT making offline (Macrium Reflect) image backups, because, as mentioned/documented before, an
online image backup does NOT backup the hiberfil.sys file.
On Sun, 3/15/2026 9:31 AM, Frank Slootweg wrote:
Paul <nospam@needed.invalid> wrote:
[...]
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Your findings seem to be an argument for NOT making offline (Macrium Reflect) image backups, because, as mentioned/documented before, an
online image backup does NOT backup the hiberfil.sys file.
Good point.
A better way to run a computer, is like a lot of us are
already doing (on *desktops* at least).
powercfg /h off
Now your backups are in no danger whatsoever :-)
You cannot do that on a laptop, due to battery management issues.
(Laptop resorts to hibernation, when sleep operation depletes
the battery sufficiently to cause alarm.)
My test of Macrium, was done on 7.2 or so. While on a lot of
softwares, it could be argued a newer version would "fix"
the lack of detection of a potential issue, that's not a
pattern I note in Macrium. If they're letting something slip
like that, that is design intent and not a bug.
That's why I would prefer to see a competing product flag this.
Just so we know someone cares about the topic.
*******
A percentage of users, will be attracted to online backup, as
the provided scheduler will manage their incremental or
incremental-forever pattern. I'm not sure the offline tool
is clever enough to find the backup pattern definition file,
but it might...
| Sysop: | Tetrazocine |
|---|---|
| Location: | Melbourne, VIC, Australia |
| Users: | 13 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 58:30:42 |
| Calls: | 211 |
| Files: | 21,502 |
| Messages: | 81,624 |
