Update 2/25/2022 6:57 PDT:
Microsoft has now confirmed data persistence issues after a wipe with Windows 10 and Windows 11 in an official post. Additional details have been added to the bottom of this story.
Updated Story
Microsoft MVP Rudy Ooms has discovered that the built-in Windows data wiping functions aren't doing their job. In other words, say you want to sell on or recycle a PC system, and you prudently use the "Reset PC > Remove Everything" option. That should be a good way to wipe your drive, but there will still be personal data left behind on the old system. This error applies to both local and remote wiping of PCs running Windows 10 version 21H2 and Windows 11 version 21H2.
Sorry for ruining your Sunday, but performing a remote or local Wipe on Windows 10 21H2 also leaves the userdata readable in the Windows.old folder#intune #mem #msintune #mempowered https://t.co/439FCyh59MFebruary 20, 2022
Ooms first discovered that there were problems with the disk wipe functionality provided by Microsoft when doing a remote wipe via Microsoft Intune system management. However, he has tested several Windows versions and both local and remote wiping over the weekend to compile the following summary table.
|
Windows 10/11 Action |
Results |
|---|---|
|
Remote Wipe 21H2 |
User Data NOT removed from Windows.old |
|
Remote Protected Wipe 21H2 |
User Data NOT removed from Windows.old |
|
Local Wipe 21H2 |
User Data NOT removed from Windows.old |
|
Local Wipe Cloud Download 21H2 |
User Data NOT removed from Windows.old |
|
Local Protected Wipe 21H2 |
User Data NOT removed from Windows.old |
|
Remote Fresh Start 21H2 |
User Data NOT removed from Windows.old |
|
All Wipe /Fresh Start actions with 21H1 |
User data REMOVED from Windows.old |
At the bottom of the table you can see that both Wipe and Fresh Start options appear to work as expected in Windows 10 and 11 version 21H1, but are ineffectual in versions 21H2. Ooms installed and tested these four OSes, with local and remote wipe operations, then checked the results.
The most common issue was the leaving behind of user data in a folder called Windows.old on the "wiped" or "fresh start" disk. This is despite Microsoft warning users ahead of the action that "This removes all personal and company data and settings from this device."
Bitlocker Protection Is Also Removed
In his blog post, Oooms notes that some users might feel assured that their personal data was always stored on a Bitlocker drive. However, when a device is wiped, Bitlocker is removed, and he discovered that the Windows.old folder contained previously encrypted data, now non-encrypted. It was also noted that OneDrive files, which had been marked as "Always Keep on this device" in Windows previously, remained in Windows.old too.
Ooms has kindly put together a PowerShell Script to fix this security blunder by Microsoft. One needs to run the script ahead of wiping / resetting your old device. Hopefully Microsoft will step up and fix this faulty behaviour in the coming weeks, so you don't need to remember to run third party scripts.
If you must reset or refresh a PC soon, you could just restart the reset / refreshed device and go into Windows to check for and delete the Windows.old files manually. Then a wipe-free space utility might be useful to make sure any sensitive data can't be recovered using any undelete style utilities. Always double-check the contents of the drive after wiping, as you might not only find your old files in Windows.old but also on other storage hardware installed in your PC / laptop.
Microsoft Confirms File Deletion Bug
"When attempting to reset a Windows device with apps which have folders with reparse data, such as OneDrive or OneDrive for Business, files which have been downloaded or synced locally from OneDrive might not be deleted when selecting the “Remove everything” option," Microsoft explained. "This issue might be encountered when attempting a manual reset initiated within Windows or a remote reset. Remote resets might be initiated from Mobile Device Management (MDM) or other management applications, such as Microsoft Intune or third-party tools."
Microsoft goes on to say that "cloud only" OneDrive files are not affected by this particular bug. Microsoft says that it is currently working on a fix that will be delivered in a future update for Windows 10 and Windows 11, but for now, here are two workaround:
- This issue can be prevented by signing out or unlinking OneDrive before resetting your Windows device. For instructions, see the "Unlink OneDrive" section in, Turn off, disable, or uninstall OneDrive.
- This issue can be mitigated on devices that have already been reset by following the steps in KB5012334—Delete the Windows.old folder using Storage sense in the Settings app.
