Windows 10: Experiences with Macrium Image Guardian (MIG)

Paid versions of Macrium Reflect now have Macrium Image Guardian that only allows images to be modified by Macrium Reflect itself, preventing malware attacks. I have tested it a bit and have some comments other might find useful.

1) It protects all images including ones created before MIG was itroduced.

2) You cannot delete an image except via Reflect when MIG is active. The error message is a bit obscure.

3) You can temporarily turn off MIG, but next time you use Macrium, it is switched back on.

I think but am not certain, it switches back on automatically after a reboot or some period of time. I would need to test further.

4) I find MIG to be a solution to a problem I never had, as I store images offline anyway. I personally find it a bit of a PITA, especially as it keeps switching itself backon.

There is a brute force way of switching it off i.e. actually uninstall the MIG component. To do this, you have to select uninstall for Marcrium Reflect Free, from Programs and Features, select modify, and then you can uninstall MIG completely.

I would have preferred to have an option to switch on or off from UI, with option to automatically restart or not.

The problem with MIG is that although it protects online images, it still cannot stop online drives being locked by ransomware i.e. you should still hold backups offline, but then MIG is less useful.

:)

 

N8 losing C drive space. Guardian app?

I wonder if anyone can help.

I’ve noticed over the past few days that my C: memory seems to be dropping.

I don’t have any new programs or installs, and can only put it down to the Guardian app which I notice is very “image” hungry.

Checking the image folder with “X-plore”, I see many stored images courtesy of the Guardian app.

Has anyone else noticed this and is there any other way of this app not storing images to C: drive?

 

Anniversary Edition Upgrade failing

I am seeing this on a number of computers, anniversary update tries to install but fails with same error every time in setuperr.log:

2017-02-07 04:18:27, Error [0x08056a] MIG Exception during processing unit="HKCR": class Mig:evErrorException: Key name is smaller than ClassesRoot name.: The operation completed successfully. [0x00000000] class UnBCL::ArrayList<class UnBCL::String
*> *__cdecl Mig::CComCache::GetRelativeToClassesRootSplit(class UnBCL::String *)[gle=0x00000002]

2017-02-07 04:18:27, Error [0x080191] MIG CMigUnitManager: agent CUpgradeAgent threw an exception during AddGatherInfo: class Mig:evErrorException: Key name is smaller than ClassesRoot name.: The operation completed successfully. [0x00000000] void
__cdecl Mig::CUpgradeAgent::GatherFlow(class Mig::CPlatform *,class Mig::CMigUnit *,class Mig::CUserContext *)

setupact.log shows the following:

2017-02-07 04:18:27, Info [0x08056f] MIG Start processing unit="HKCR"

2017-02-07 04:18:27, Info MIG Entering Mig::CComHelper::AddNonSystemClassesRoot

2017-02-07 04:18:27, Error [0x08056a] MIG Exception during processing unit="HKCR": class Mig:evErrorException: Key name is smaller than ClassesRoot name.: The operation completed successfully. [0x00000000] class UnBCL::ArrayList<class UnBCL::String
*> *__cdecl Mig::CComCache::GetRelativeToClassesRootSplit(class UnBCL::String *)[gle=0x00000002]

2017-02-07 04:18:27, Error [0x080191] MIG CMigUnitManager: agent CUpgradeAgent threw an exception during AddGatherInfo: class Mig:evErrorException: Key name is smaller than ClassesRoot name.: The operation completed successfully. [0x00000000] void
__cdecl Mig::CUpgradeAgent::GatherFlow(class Mig::CPlatform *,class Mig::CMigUnit *,class Mig::CUserContext *)

I have tried numerous posted workarounds with no success, same error message:

installing from iso

installing from usb

limited startup with only key services running

disabled firewall/antivirus

disconnecting peripherals

sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealth

If possible, I want to have the upgrade run its path so user data and application are migrated. Can anyone explain what is happening here, maybe we can find the solution:

Exception during processing unit="HKCR": class Mig:evErrorException: Key name is smaller than ClassesRoot name.

 

My copy of MR has never turned MIG back on or off. To turn it off:

 

Try restart PC, it will be back on - that happens to me. See extract from Macrium Support Forum below


From Macrium Support Forum

Q:
I've noticed that one can turn off MIG temporary basis via the MIG settings. Is there a way, besides re-installing MR and excluding MIG to permanently turn off MIG ? It seems that after any system restart, MIG gets turned back on.

A:
You have to remove MIG entirely, but you can do that without uninstalling Reflect, though even uninstalling Reflect is pretty painless given that you can preserve just about everything you'd want to keep if you were going to reinstall. But to remove only MIG, go to Programs and Features > select Reflect > Change > Modify > uncheck MIG. I initially thought that the inability to disable MIG "until further notice" was a bad move, but the more I've thought about it, the more I've come around to Macrium's design choice. As I see it, there are only a few use cases:

Users who never modify backups manually: MIG will protect them without ever getting in their way.
Users who manually delete or consolidate backups occasionally: Backups can be deleted from within Reflect while MIG remains active, and Macrium's standalone Consolidate.exe file is allowed by MIG.
Users who use other tools to manipulate backups occasionally: If Robocopy doesn't do what they need, they can disable MIG as needed, but I think any potential inconvenience of MIG automatically starting at reboot is far outweighed by the potential danger of a user disabling MIG to perform some task and then forgetting to re-enable it. If MIG did not start automatically on reboot, the user's backups would be left unprotected for far longer than was necessary or intended. I actually have a Wish List thread requesting an option to disable MIG only for a defined period of time to further mitigate this risk, since some users don't restart their PCs often.
Users who use other tools to manipulate backups constantly: If Robocopy doesn't do what they need, their workflow would be incompatible with MIG, so there would be no reason for them to have MIG installed at all.

So far, I haven't thought of a use case where an option to disable MIG until further notice, even across reboots, would be desirable but removing MIG entirely would not be.

 

I image my drive to a external hard drive. I have many versions of Windows 10 on this drive, In order to move an image on the external drive you have to turn MIG off, when I am done I turn it back on. I hazve never left it off and restarted but I will try it now.

 

You are correct Martin but if you look at the image it can be turned off on selected drives.

 

"...I would have preferred to have an option to switch on or off from UI, with option to automatically restart or not..."
+1! I also much prefer the ability to turn off and later turn back on a utility if/when the need arises.

 

That was my question - But It didn't take long for me to UN-INSTALL it. To me the feature is worthless unless I can control it. I would like all of my offsite backups to be untouchable, but not some much for the volumes that I backup to daily.

The big problem is that a restarted system will automatically turn on MIG ! It should be ON or OFF via user control !

 

I will try that, but have to reinstall MIG first.

I am a great fan of Macrium but sometimes their GUI is a little confusing until you get hang of it.

I recently decided to experiment with incremental files following image posted (you iirc) showing how incremental get merged, or even the full (synthetic) image.

I could not see how to create an incremental backup until I googled it. It is counter intuitive that you have to click restore tab to select image, than click other options to create the incremental backup.

To me, this is slightly lazy programming at expense of clarity.

Still despite its quirks, I would never use any other tool.