Microsoft has shipped KB5075039, a Windows Recovery Environment (WinRE) update for Windows 10 that fixes a problem Microsoft introduced itself: after the October 2025 WinRE update KB5068164, the recovery environment could fail to start. WinRE is what you fall back on when a machine won't boot, so a broken copy often goes unnoticed until the day you need it. That makes this patch worth checking on any Windows 10 machine you still run, including build agents, lab boxes and legacy workstations.
What happened
On 14 October 2025, the day standard Windows 10 support ended, Microsoft released KB5068164 to update WinRE on Windows 10 versions 21H2 and 22H2. Microsoft didn't acknowledge until February 2026 that "this update contains an issue that prevents the Windows Recovery Environment from starting successfully." On 3 March 2026 it released KB5075039, whose notes say it fixes the problem where WinRE "would not start after installing the October 14, 2025 update KB5068164." The package also applies Safe OS Dynamic Update KB5073933 to WinRE and replaces KB5068164.
This was separate from a Windows 11 problem in the same month, when the KB5066835 Patch Tuesday update broke USB keyboard and mouse input inside WinRE. Microsoft fixed that one quickly.
Who is affected
- Windows 10 Enterprise LTSC 2021 and Windows 10 devices enrolled in Extended Security Updates (ESU) on versions 21H2 and 22H2 that installed KB5068164.
- Machines with a small recovery partition. KB5075039 needs at least 250 MB free in the recovery partition. If there isn't enough space it isn't offered at all, so these machines stay broken without any error.
- Admins who patch through WSUS or Configuration Manager. Microsoft lists Windows Update as the only channel. It isn't in the Update Catalog, WSUS or Configuration Manager.
What it means for developers and engineering teams
There's no code impact here. The lesson is operational: recovery tooling needs testing just like backups do. A broken WinRE gives no symptoms during normal use, and Microsoft took about four months to disclose this one. If you manage Windows 10 machines that matter, such as CI runners, test rigs or developer workstations, add "WinRE enabled and at the expected version" to your health checks instead of assuming it is.
The delivery model adds a second trap. Because KB5075039 is offered only through Windows Update, fleets patched only through WSUS or Configuration Manager won't receive it automatically, even if their cumulative-update compliance dashboards look healthy. Recovery-image servicing is a separate track from monthly cumulative updates, and it needs its own compliance check.
Also note that this update can't be uninstalled after it's applied, and it doesn't need a restart. The recovery partition size requirement is the most likely reason it fails to deploy, so check partition sizes before you rely on it.
What to do now
- Check WinRE status from an elevated prompt:
Confirm "Windows RE status" isreagentc /infoEnabledand note the location. - Check the WinRE version. Microsoft's KB page includes a PowerShell script (
GetWinReVersion.ps1) that mountswinre.wimand reads its version. After the update it should be 10.0.19041.6807 or later. - Make sure the recovery partition has at least 250 MB free. If it doesn't, follow Microsoft's documented resize procedure (or its sample script). Back up the disk first.
- Install through Windows Update (Settings > Windows Update > Check for updates) on LTSC or ESU-enrolled devices. If you use WSUS or Configuration Manager, plan for a Windows Update-based path for this package.
- Test recovery on a sample machine by booting into WinRE (for example with
shutdown /r /o /t 0) to confirm it loads and input works. - Plan for Secure Boot certificate expiry. Microsoft's KB page warns that the Secure Boot certificates used by most Windows devices began expiring in June 2026. Check that your fleet has the replacement certificates.