CSUSM Surface recovery stick builder

Builds a Surface recovery stick with: Microsoft's recovery image, the latest cumulative update baked in, current drivers/firmware, CSUSM Wi-Fi trusted at OOBE, en-US locale preset, and optionally zero-click reimaging.

Setup (once, on the imaging Surface)

1. Install-Module MSCatalogLTS

2. Put beside New-RecoveryDrive.ps1:

   • Surface*_BMR_*.zip — recovery image from Surface Recovery Image Download (required; needs the Surface's serial number)
   • Surface*_Win11_*.msi — drivers & firmware for the same model from Surface driver and firmware downloads (optional; without it reimaged Surfaces keep the image's firmware, since Intune blocks driver updates)

   Re-download both only when Microsoft posts a newer version; the cumulative update is fetched automatically.

3. Needs ~60 GB free on C: for the update bake.

Build a stick

Run as admin: .\New-RecoveryDrive.ps1 [-SkipUpdate] (or double-click Build Recovery Stick.cmd)

It lists USB drives to pick from (arrow keys, Enter), asks to confirm the erase (Cancel is preselected), then runs unattended, showing each step with a progress bar and time estimates.

• First run: ~1 h (extract 12 GB, download ~5 GB update, bake, copy). Later sticks: copy only (10–20 min).
• -SkipUpdate — don't fetch/bake the cumulative update (quick stick; the Surface gets it from Windows Update instead).

Every stick is built the same way:

• Zero-click: boots straight into wipe-and-reimage after a 15 s countdown (Ctrl+C cancels, Enter skips the wait). Refuses non-Surface hardware.
• 2011-signed boot loader, so older Surfaces whose firmware lacks the 2023 Secure Boot CA boot it with Secure Boot on. All Surfaces trust the 2011 CA; the only exception would be a machine where Microsoft's (still opt-in) 2011 blocklist step has been applied. The 2023-signed loader is kept as EFI\Boot\bootx64-2023.efi: rename it over bootx64.efi if a stick ever needs to boot such a machine.

Updates

Each run searches the Microsoft Update Catalog for the newest "Cumulative Update for Windows 11" for the image's release (24H2 or 25H2, read from its build number) matching the image's architecture and compares its build number with the cached image's. Newer → download and bake once; same → nothing. So just rerun the script after Patch Tuesday.

Cached images live in cache\ (~12 GB each; the -zeroclick- variant is hard-linked and costs only ~1 GB more). Once a cache folder exists the zip can be deleted; the script uses the folder. Delete a cache folder to force re-extraction from the zip.

Using a stick

1. Surface off. Hold Volume Down, press and release Power, release Volume Down when the Surface logo appears.
2. Normal stick: Troubleshoot → Recover from a drive → Just remove my files → Recover. Zero-click stick: countdown (Enter skips), then hands-off. Green screen = done; pull the stick (it reboots on its own, or after 30 s). The stick is needed until the green screen, not after. If it's still in on a reboot and gets booted again, it refuses to re-wipe an install that hasn't booted yet without an explicit Enter.
3. At OOBE pick CSUSM Wi-Fi and sign in. Language/keyboard pages are skipped.

Logs if something fails

• build.log beside the script — every build: what was chosen, each step's start/finish time, and the error that stopped it
• <stick>\sources\StartPostDeploy.log / .err — Microsoft post-deploy (drivers)
• <stick>\sources\ResetPolicy.log — Wi-Fi kit staging
• C:\Windows\Setup\CsusmWifi\Install-CsusmWifi.log — Wi-Fi kit on first boot (Shift+F10 at OOBE)

Files

• New-RecoveryDrive.ps1 — main script; lib\ — its helpers
• Update-RecoveryDrive.ps1 -DriveLetter X — add only the Wi-Fi kit to an existing stick
• Check-SecureBoot.ps1 — run (as admin) on any Surface: shows which Secure Boot CAs it trusts/blocks, i.e. whether it boots 2011- or 2023-signed media
• stick\ — what gets copied onto the stick (Wi-Fi kit, certs, unattend, zero-click scripts)