How to Find if KB5034441 has been installed on your PC

The WinRE security update KB5034441 fixes a BitLocker vulnerability in WinRE. After resizing the recovery partition, the KB5034441 update installs quickly. You wonder if the KB5034441 update has been installed or not. It may not appear in the Windows Update history on some systems, or the old entries may have been purged.

Determine if KB5034441 has been installed

Multiple ways exist to determine if the WinRE security update KB5034441 has been installed on the system. Please try one of these methods:

If the WinRE image has a version greater than or equal to the version 10.0.19041.3920, the KB5034441 update has been applied already.

Method 1: Check the WinRE Version in the registry

To determine the version of your WinRE image, check the WinREVersion registry value in the following branch:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Open a Command Prompt window and run this command:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "WinREVersion"

Method 2: Get the Winre.wim version info using DISM

Open an admin Command Prompt and run:

reagentc /info

Note the WinRE path from the above output.

Suppose the path is "\\?\GLOBALROOT\device\harddisk0\partition6\Recovery\WindowsRE"

Now, run:

Dism /Get-ImageInfo /ImageFile:\\?\GLOBALROOT\device\harddisk0\partition6\Recovery\WindowsRE\winre.wim /index:1

Check the WinRE image version in the output. Here’s a sample output:

Details for image : \\?\GLOBALROOT\device\harddisk0\partition6\Recovery\WindowsRE\winre.wim

Index : 1
Name : Microsoft Windows Recovery Environment (x64)
Description : Microsoft Windows Recovery Environment (x64)
Size : 2,378,699,272 bytes
WIM Bootable : No
Architecture : x64
Hal : 
Version : 10.0.19041
ServicePack Build : 3920
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 3711
Files : 17076
Created : 12/7/2019 - 6:46:07 PM
Modified : 1/10/2024 - 10:52:54 AM
Languages :
        en-GB (Default)
The operation completed successfully.

The OS version is 19041, and the service pack build is 3920. That means the KB5034441 update has been applied to that image.

Method 3: Use WMI’s QFE class

Open Command Prompt and run:

wmic qfe get | findstr /i 5034441

You’ll find the Caption, CSName, Description, FixComments, HotFixID, InstallDate, InstalledBy, InstalledOn, Name, ServicePackInEffect, and Status data for that update.

https://support.microsoft.com/help/5034441  OPTIPLEX-7010  Security Update               KB5034441               NT AUTHORITY\SYSTEM   1/10/2024                                       

Method 4: Run the Systeminfo command

The systeminfo command also uses WMI to query the hotfixes and other information.

From Command Prompt, run:

systeminfo

You’ll find the Hotfix information, among other details.

Hotfix(s):                 19 Hotfix(s) Installed.
                           [01]: KB5041168
                           [02]: KB5029923
                           [03]: KB5011048
                           [04]: KB5015684
                           [05]: KB5040525
                           [06]: KB5014032
                           [07]: KB5016705
                           [08]: KB5029709
                           [09]: KB5031539
                           [10]: KB5032392
                           [11]: KB5032907
                           [12]: KB5034224
                           [13]: KB5036447
                           [14]: KB5037018
                           [15]: KB5037240
                           [16]: KB5037995
                           [17]: KB5039336
                           [18]: KB5040565
                           [19]: KB5034441

That’s it. I hope the above information helps.