Blog · 2026-10-23 · Gardience Engineering

KB5131594: the October 2026 WinRE update, and why it keeps reinstalling

What KB5131594 is (the October 2026 Windows Recovery Environment update for Windows Server 2022), why it reports success and is offered again, the 250 MB recovery partition fix, and why WSUS can't deploy it.

We ran into KB5131594 while patching a test fleet on AWS this week: 634 servers, 600 Linux and 34 Windows Server

1. On all 34 Windows servers every update installed cleanly except this one. Windows Update said it installed successfully. Then after a reboot it offered it again. On a few test servers we watched it do that three times.

If you landed here because the same thing is happening to you, here's what we found.

What KB5131594 is#

It's Microsoft's Windows Recovery Environment (WinRE) update for Windows Server 2022, released October 13, 2026. It doesn't patch Windows itself. It updates the small recovery image Windows boots into when something goes wrong, by applying Safe OS Dynamic Update KB5126667 to it. It replaces the earlier KB5127069.

What Microsoft says about it:

• After it installs, WinRE should be version 10.0.20348.5753 or later.
• It needs 250 MB of free space in the recovery partition.
• It doesn't need a restart, and it can't be uninstalled.
• It's offered only through Windows Update. It is not in the Microsoft Update Catalog, WSUS or Configuration Manager.

That last one surprised us. If your servers get their patches from WSUS, this update never shows up there. You can't approve it and you can't push it. The only way it lands is a server talking to Windows Update directly.

Why it keeps getting offered#

Windows decides whether to offer it by looking at the WinRE image, not at your update history. If WinRE still isn't at 10.0.20348.5753 after the install "succeeds," Windows Update offers it again. The usual reasons:

• The recovery partition is too small. Older installs and a lot of cloud images were built with a recovery partition that doesn't have 250 MB free. This is the big one. With earlier WinRE updates it showed up as error 0x80070643.
• WinRE is disabled. Some images ship with it turned off.
• There's no recovery partition at all. Common on cloud and VM templates.

On our test servers it was the last one. The AWS images we used keep the recovery image on the system drive instead of in its own recovery partition, and on those Windows kept reporting KB5131594 as installed and offering it again. On your own servers, all three are worth checking.

Checking a server#

Open an elevated command prompt and run:

reagentc /info

Look at two lines. "Windows RE status" tells you whether WinRE is enabled. "Windows RE location" tells you which disk and partition it lives on.

To see the WinRE version, temporarily disable it so Windows copies the image back to the system drive, read the version, then turn it back on:

reagentc /disable
dism /Get-ImageInfo /ImageFile:C:\Windows\System32\Recovery\Winre.wim /Index:1
reagentc /enable

The "Version" line should say 10.0.20348.5753 or higher after the update. If it's lower and Windows Update says KB5131594 installed, the update didn't actually take.

To see how much space the recovery partition has, open Disk Management, or in PowerShell:

Get-Partition | Where-Object Type -eq 'Recovery' | Get-Volume | Select-Object Size, SizeRemaining

Fixing it#

Not enough space: grow the recovery partition so it has at least 250 MB free. Microsoft has step-by-step instructions for shrinking the OS partition and recreating the recovery partition (search "KB5028997 resize recovery partition"). Take a backup or snapshot first. You're editing partitions on a live server. Then run Windows Update again.

WinRE disabled: if you want it, reagentc /enable, then check for updates again. If you've decided you don't want WinRE on that server, the update doesn't do anything for you.

No recovery partition: this was our case. An answer on Microsoft's Q&A forum says that on a machine without a recovery partition the update isn't needed and the failure can be ignored. We'd write that down somewhere though, so the next person who sees it in a patch report doesn't spend an afternoon on it.

Across a fleet#

One server is a 15-minute job. Fifty is where it gets annoying, and with WSUS you can't deploy it at all.

In our test we used Gardience, which patches each Windows server through the Windows Update agent on that machine. Our test servers got their updates from Windows Update, so KB5131594 was offered to them; servers pointed at WSUS won't see it however you patch them. The report is what helped most. After the patch run every other update showed as installed on all 34, and KB5131594 was the one still showing as pending, the same thing Windows itself says, so we knew it was one known update and not 34 separate problems. From there you can run the reagentc /info check above across all of them at once (in Gardience that's the "Run a command" runbook, once command execution is turned on) and see which ones are disabled, out of space or have no recovery partition.

Quick answers#

What is KB5131594?#

The October 13, 2026 Windows Recovery Environment update for Windows Server 2022. It applies Safe OS Dynamic Update KB5126667 to WinRE and brings it to version 10.0.20348.5753.

Why does KB5131594 keep installing?#

Windows offers it until the WinRE image is at the new version. If the install can't actually update WinRE, usually because the recovery partition has less than 250 MB free, it gets offered again.

Can I deploy KB5131594 with WSUS?#

No. Microsoft only offers it through Windows Update. It isn't in WSUS, Configuration Manager or the Update Catalog.

Do I need to restart after KB5131594?#

No. Microsoft says it doesn't require a restart.

Can I ignore KB5131594?#

If the server has no recovery partition, it isn't needed. If WinRE is enabled in its own partition, we'd fix the space problem so the recovery image gets updated.

Source: Microsoft, KB5131594.