Recovery cookbook

Recovery cookbook

Main menu 9 Recovery / fix opens a set of modular hubs. When you know what broke, use the matching hub instead of a full Undo. For the recommended pre-Apply path (right build, restore point, Dry Run, section defaults), see Hardening workflow.

Hub map

Menu	Hub	When to use it
1	Undo last hardening	Best-effort restore of tracked services, firewall groups, encrypted DNS snapshot (when present), and RDP host prior (when RdpHostLock was applied)
2	Services	Printing stopped; you need file-share host, discovery helpers, or Xbox services again
3	Network	RDP, Remote Assistance, or WinRM; LAN sharing, discovery, or mDNS; DNS reset to DHCP; restore prior DNS; LAN hygiene reverse; home gateway probe (fingerprint only unless a known CPE GUI is detected)
4	Browser policies	Sites break after Strict or ECH settings; set that browser back to Default
5	Apps and UI	Copilot or M365, Widgets or Suggestions, Game Bar or the ms-gamingoverlay prompt
6	Security mitigations	StrictHandle and games, Defender NP/CFA, Defender updates and disk (stale signatures, TEMP fill files, optional daily health task), Delivery Optimization, PowerShell logging, LSA, CEIP tasks
7	Known CVE checks	Scan this PC; reverse Bastion-recorded CVE registry/protocol changes; same catalog as main menu C

Note: Appx bloat and OneDrive removal are not reinstalled from Recovery. Use System Restore or the vendor/Store installers.

Symptom to action

Symptom	Go to	What to do
Cannot print	9 → 2 → Print Spooler	Re-enable Spooler as Automatic and start it
Cannot host or reach Windows shares	9 → 3 → LAN/discovery and 9 → 2 Services	Open File and Printer Sharing if needed; re-enable LanmanServer if it is disabled
Cannot RDP / Remote Assistance / WinRM	9 → 3 → Remote access	Enable the firewall group you need; for a full RDP host also allow system RDP and TermService. Lock remote access again when you are idle
Name resolution wrong after Bastion DNS	9 → 3 → Reset DNS or Restore prior DNS	Option 3 resets eligible adapters to automatic (DHCP). Option 4 restores the encrypted pre-Apply snapshot when present (best-effort). Menu D intent is unchanged; the next DNS Apply may set public DNS again. A VPN may override DNS while connected
Names fail, ping by IP works, after September 2026 Windows Update	Main C row WIN-SEP2026, then 9 → 3 Network	See September 2026 Windows update. Install KB5129195. Check DNS Client. Use one network path. Do not start with netsh winsock reset.
Browser sites broken after policies	9 → 4 or main 6	Set that browser to Default (best-effort). System Restore remains the surest rollback
ms-gamingoverlay "get an app" dialog	9 → 5 → Game Bar	Silence Game DVR (or re-enable flags and install Xbox Game Bar from the Store)
Game or program fails after Apply (instant exit)	9 → 6 → StrictHandle	See Games and StrictHandle
Controlled Folder Access blocks a trusted app	9 → 6 → Defender	Prefer allow-listing the app (Windows Security → Ransomware protection → Allow an app)
Defender looks on but signatures are old / C: is full	9 → 6 → Defender → 5 or main C	Disk, signature age, TEMP fill files; optional delete + signature update. Catalog row BIGDISKBUSTER.
Want a known CVE scan without full Apply	Main C or 9 → 7	Live scan, then confirm remediations. Recovery 7 reverses Bastion registry/protocol changes only. FIREWALL-LAN group locks reverse under 9 → 3 Network.
Printers or Chromecast died after LanHygiene	9 → 3 → option 5	Removes Bastion outbound 137/138/5353 rules only; policies may need System Restore
Curious about the ISP modem	9 → 3 → option 6	Identifies the default gateway on the computer running Bastion. CPE commands only if the live admin speaks a known JSON gateway protocol. Most homes will not match.
Need Widgets or suggestions back	9 → 5	Restore Widgets/Suggestions defaults
Need Copilot UI tools	9 → 5 → Copilot / M365	Status plus policy and Appx helpers

Honesty rules

• OPEN firewall groups and enabled high-risk services increase attack surface. Prefer LOCKED or disabled when you do not need them.
• Firewall hubs toggle named groups; they do not flip overall profile Inbound=Block by themselves.
• Full host RDP usually needs: OPEN Remote Desktop group plus system allow (fDenyTSConnections) plus TermService. Windows Home may not host RDP the way Pro does.
• Undo restores tracked services, firewall groups, encrypted DNS snapshot (when saved), and RDP host prior (when RdpHostLock ran). It does not reinstall Appx or OneDrive, and does not clear browser enterprise policies (use browser Default for policies).
• DNS snapshot and RDP host prior are stored with Windows DPAPI (CurrentUser of the elevating account) plus a tight file ACL. A full compromise of that account can still decrypt. Missing or foreign-user blobs cannot be restored.
• Two different "encrypted" ideas: (1) Bastion DPAPI protects the snapshot file on disk. (2) Windows Settings Encrypted on DNS servers means DNS-over-HTTPS (DoH) on the network. From v15.8.4, Apply/restore writes the same per-interface DoH path Settings Edit DNS uses so known resolvers (Quad9, Cloudflare, Google, OpenDNS) should show Encrypted without a manual Settings click. Verified path: Apply a DoH provider (menu D then A, or main 8) -> Settings shows Encrypted -> Network option 4 restores the prior snapshot and keeps Encrypted for known resolvers. Older snapshots that only stored IP addresses still restore IPs; DoH is re-applied from known templates when possible.
• Optional RdpHostLock (off by default) denies the OS RDP host switch on Apply; Recovery Remote access can reverse it.
• System Restore (menu 13 / R, or Safe Mode then rstrui.exe) remains the strongest full rollback.

For live paths on your machine, open in-app Help (main menu 11). For more detail in the repository, see KNOWN-ISSUES.md. You can also use the site Help page from another device.