Windows administrators have several options when it comes to resetting a system locally or remotely. The option to keep the data or delete it is provided, but a new report from Microsoft MVP Rudy Ooms suggests that cleaning no longer deletes user data in Windows 10 and Windows 11 version 21H2.
Resetting a Windows device and deleting the data on it can be useful in some circumstances. Devices can be passed on to other company employees, given to family or friends, or sold on marketplaces like eBay.
The wipe option is designed to remove personal data from the device. Most users save personal data on their laptops and PCs, and it is clear that this data should not be handed over to the new owner of the device.
Ooms found that the Windows wipe feature left user data on the latest versions of Windows 10 and Windows 11. Remote and local wipe, as well as Fresh Start on devices running version 21H2 of the operating system, left data of the user in the Windows.old folder. The same procedures in Windows 10 version 21H1 erased all user data from Windows.old as expected.
Ooms describes how he received a phone call from a CFO his company worked for to delete data from the CFO’s old device so it could be passed on to another employee. Since the company was “a couple of 100 miles away,” Ooms decided to remotely wipe the device.
He made sure not to select any of the options to retain user data after cleanup and discovered that user data was retained in Windows 11 after the operation completed successfully. Testing confirmed that wipe was affected on version 21H2 (Windows 10 and 11) devices and that the issue affected all forms of wipe and reset functionality on these devices.
While Ooms used Intune to remotely wipe the device, he also ran local tests and found that data was also retained.
Ooms created a PowerShell script that fixes the issue by deleting the Windows.old folder from wiped devices. It can be downloaded from the linked blog post.
closing words
The issue affects only Windows 10 and 11 version 21H2. The number of users affected by this wipe issue is unknown, but it could cause data leaks. Windows users who need to wipe a device without retaining user data should ensure that the windows.old folder is deleted after the operation is complete to eliminate any chance of data leaking into the wrong hands.
Now you: have you used the delete functionality before? (via Gunther Born)
advertising