CVE-2026-45585

.DESCRIPTION This remediation script removes the "autofstx.exe" entry from the BootExecute REG_MULTI_SZ value inside the Windows Recovery Environment (WinRE) offline SYSTEM registry hive. This is a security fix to prevent autofstx.exe from executing during WinRE boot.

.PARAMETER MountPath Directory to use as the WinRE mount point. Created if it does not exist. Default: C:\Mount

.EXAMPLE # Standard run .\Remove-AutoFsTxFromWinRE.ps1

.EXAMPLE # Custom mount path .\Remove-AutoFsTxFromWinRE.ps1 -MountPath D:\mount

.NOTES Requirements: Windows with WinRE and reagentc support, Administrator privileges. The WinRE disable/enable cycle at the end is required to re-seal the BitLocker measurement chain after modifying the WinRE image.

#> param( [Parameter(Mandatory = $false)] [string]$MountPath = "C:\Mount" )

Target entry to remove from BootExecute

$EntryToRemove = "autofstx.exe"

Internal constant for the offline hive key name

$HiveName = "WinREHive"

State tracking for cleanup

$hiveLoaded = $false $imageMounted = $false $mountCreated = $false $changesMade = $false

Write-Host "Remove autofstx.exe from WinRE BootExecute"

1. Verify Administrator Privileges

PS Version: All | Admin: Yes | System Requirements: None

try { $identity = [Security.Principal.WindowsIdentity]::GetCurrent() $principal = [Security.Principal.WindowsPrincipal]$identity $isAdmin = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

} catch { Write-Warning "Error checking administrator privileges: $_" exit 1 }

2. Check WinRE Status

PS Version: All | Admin: Yes | System Requirements: reagentc.exe

try { $winreOutput = & reagentc /info 2>&1 if ($LASTEXITCODE -ne 0) { Write-Host "[2/8] WinRE status check: FAILED" -ForegroundColor Red Write-Warning "reagentc /info returned exit code $LASTEXITCODE" exit 1 } $winreOutputStr = $winreOutput -join "`n"

Make this check language agnostic

if ($winreOutputStr -match "[:：]\s*Enabled\b") { Write-Host "[2/8] WinRE status: Enabled" -ForegroundColor Green } else { Write-Host "[2/8] WinRE status: NOT ENABLED. Exiting." -ForegroundColor Green exit 0 } } catch { Write-Warning "Error checking WinRE status: $_" exit 1 }

3. Mount WinRE Image

PS Version: All | Admin: Yes | System Requirements: reagentc.exe

try { if (-not (Test-Path $MountPath)) { New-Item -ItemType Directory -Path $MountPath -Force | Out-Null $mountCreated = $true Write-Host "[3/8] Created mount directory: $MountPath" } else { $existing = Get-ChildItem -Path $MountPath -Force -ErrorAction SilentlyContinue if ($existing) { Write-Host "[3/8] Mount WinRE image: FAILED" -ForegroundColor Red Write-Host " Mount directory $MountPath is not empty." Write-Host " Clean it or specify a different -MountPath." exit 1 } }

} catch { Write-Warning "Error mounting WinRE image: $_" exit 1 }

4. Load Offline SYSTEM Registry Hive

PS Version: All | Admin: Yes | System Requirements: reg.exe

try { # Locate the SYSTEM hive in the mounted WinRE image $hivePath = $null $hiveCandidates = @( "$MountPath\Windows\System32\config\SYSTEM", "$MountPath\windows\system32\config\SYSTEM" )

} catch { Write-Warning "Error loading offline hive: $_"

}

5. Read BootExecute and Remove autofstx.exe

PS Version: All | Admin: Yes | System Requirements: None

try { # Determine active ControlSets from Select key $selectPath = "Registry::HKEY_LOCAL_MACHINE$HiveName\Select" $selectProps = Get-ItemProperty -Path $selectPath -ErrorAction SilentlyContinue

} catch { Write-Warning "Error modifying BootExecute: $_"

}

6. Unload Offline Registry Hive

PS Version: All | Admin: Yes | System Requirements: reg.exe

try { [gc]::Collect() Start-Sleep -Seconds 2

} catch { Write-Warning "Error unloading hive: $_"

}

7. Unmount WinRE Image with Commit

PS Version: All | Admin: Yes | System Requirements: reagentc.exe

try { if ($changesMade) { $unmountOutput = & reagentc /unmountre /path $MountPath /commit 2>&1 } else { $unmountOutput = & reagentc /unmountre /path $MountPath /discard 2>&1 }

} catch { Write-Warning "Error unmounting WinRE image: $_" exit 1 }

8. Re-seal WinRE (Disable + Enable Cycle for BitLocker Trust Chain)

PS Version: All | Admin: Yes | System Requirements: reagentc.exe, BitLocker

try { if (-not $changesMade) { Write-Host "[8/8] Re-seal WinRE: Skipped (no changes made)" -ForegroundColor Green } else { $disableOutput = & reagentc /disable 2>&1 if ($LASTEXITCODE -ne 0) { Write-Warning "reagentc /disable returned non-zero: $disableOutput" } else { Write-Host " WinRE disabled." }

} catch { Write-Warning "Error during WinRE re-seal: $_" Write-Host " Run manually: reagentc /enable" exit 1 }

Write-Host "" Write-Host " COMPLETE: '$EntryToRemove' removed from WinRE BootExecute" -ForegroundColor Green

Cleanup: remove mount directory if we created it

if ($mountCreated -and (Test-Path $MountPath)) { Remove-Item -Path $MountPath -Recurse -Force -ErrorAction SilentlyContinue }