Windows 11 Cloud Rebuild Adds SSD Sanitization and Remote IT Recovery

The Bangkok Post covered the news this week, but the changes first appeared in Microsoft's September 18 Insider release. Microsoft's release notes for Windows 11 Insider Experimental Preview Build 26340.9502 say that when you start a rebuild in WinRE, you choose Remove files if you're keeping the PC, or Remove & sanitize files before recycling, returning, or reassigning it. The sanitize option uses the storage hardware's erase capability to securely erase data before Windows is reinstalled and is irreversible.

Before you erase your old laptop, there's an important caveat. It comes from Microsoft itself.

What Cloud rebuild actually is​

Cloud rebuild isn't the familiar "Reset this PC." Windows Latest describes it as a Windows 11 recovery option that can fully reinstall Windows from the Windows Recovery Environment using files downloaded through Windows Update, including drivers. It does not depend on the health of your existing Windows installation, and it does not need a USB installer either.

TechRepublic explains why that matters. Cloud rebuild doesn't rely on a possibly corrupted local installation for its files. It can start from the Windows Recovery Environment and pull a fresh Windows image and the required drivers from Windows Update, allowing the machine to rebuild itself even when the installed OS will not boot.

Microsoft's preview documentation on Microsoft Learn lists these prerequisites:

• The device runs Windows 11 and has a healthy WinRE. You can check this by running reagentc /info from an elevated command prompt.
• The device maker has included a compatible networking driver in WinRE, and the device can reach the internet from WinRE.
• The device meets the Windows 11 minimum hardware requirements.

Section summary: Cloud rebuild is a network-based clean install that runs from WinRE. The new build adds a real data-destruction step and remote control for IT.

"Remove files" vs. "Remove & sanitize files"​

This is the part that matters most to readers. According to Microsoft's documentation:

Microsoft states plainly what the standard option leaves behind. Windows Latest quotes the Cloud rebuild documentation: "This option is faster, but files might be recoverable using specialized recovery tools." In other words, a normal reinstall clears what you can see on the drive, not necessarily what a forensic tool can find.

On PCs with more than one drive, the sanitize path offers two choices:

• Windows disk only: sanitizes the drive Windows is installed on and keeps files on the other drives.
• All disks: sanitizes every drive in the PC, which can take much longer.

On a single-drive PC, Microsoft says this screen doesn't appear. Files stored in cloud services such as OneDrive aren't affected either way.

How to run it in the preview​

For Insiders whose builds have the feature, Microsoft documents the following flow:

1. Enter WinRE. This happens automatically after repeated boot failures. You can also go to Settings > System > Recovery and select Restart now next to Advanced startup.
2. Select Troubleshoot > Cloud rebuild.
3. Connect to a network. Ethernet connects automatically. On Wi-Fi, pick a WPA-Personal network and enter the passkey. The troubleshooting section says only WPA-2 Personal is currently supported in WinRE, so a corporate 802.1X network won't work.
4. Wait while Cloud rebuild contacts Windows Update to determine the target build and download networking drivers.
5. Choose Remove files or Remove & sanitize files.
6. If you chose sanitize and have several drives, pick Windows disk only or All disks, then select Sanitize and install on the confirmation screen.
7. Leave the PC alone while it shows Sanitizing data. Microsoft warns that it may look idle for a long time. Keep it plugged in and don't restart it.
8. Cloud rebuild then goes through its preparation, download, and install phases, possibly restarting several times, and finishes at the out-of-box experience (OOBE).

When it works: the PC boots to OOBE as if it were new. For Microsoft Entra-joined, Intune-managed devices registered with Windows Autopilot, Microsoft says the device reconnects to Intune and gets its apps and policies redeployed. User settings come back through Backup for Organizations, and files are available through OneDrive after sign-in. That applies only to the managed Autopilot scenario, not to every PC.

The fine print: Windows asks, the drive decides​

This is where the reporting matters. Thurrott wrote that the "remove & sanitize" option ensuring that no data will be recoverable. Microsoft's own documentation is more careful, and readers should go by Microsoft's wording.

According to Microsoft Learn, Windows requests the erase operation and reports whatever result the storage device returns. The outcome depends on the drive supporting that operation and implementing it correctly, and Windows cannot independently verify what the drive did. The Bangkok Post summarises it this way: Windows only sends the purge command to the storage hardware and receives status reports.

If you've been in IT a while, this will sound familiar. Firmware-level erase commands are only as reliable as the vendor's implementation, and Windows has no way to check the result. For devices being retired or transferred under a policy or regulatory requirement, Microsoft says to confirm with the device manufacturer that the configuration supports sanitization, and to use a manufacturer-provided tool where it doesn't.

Bottom line: For a family laptop going on eBay, this is a big improvement over a plain reset. For a hospital or bank that has to document how a drive was destroyed, a success message from Windows isn't proof on its own.

When sanitization fails​

Microsoft documents a "Data sanitization couldn't be completed" screen with three choices:

• Try again: retries the operation.
• Skip sanitizing: reinstalls Windows but does not securely erase the old data.
• Copy log: copies the logs to a removable drive, which you need to connect first.

Microsoft is clear on this point: if the device is being recycled, returned, or reassigned, don't skip sanitizing. Use the manufacturer's secure-erase tool instead.

Other Cloud rebuild errors listed in Microsoft's troubleshooting guidance:

• 0x800704C6: no network connection. Use Ethernet or a WPA-2 Personal Wi-Fi network.
• 0xc1900200: the PC doesn't meet Windows 11 hardware requirements. The most common cause is that TPM is disabled in UEFI, sometimes labelled PTT, fTPM, or Security Device. Check that tpm.msc reports the TPM is ready.
• 0xc1900224: a required driver, usually networking or storage, isn't published on Windows Update. Ask the OEM, or fall back to manufacturer recovery media or Windows installation media.

If a rebuild is interrupted and Windows won't boot, Microsoft points to a Recovery Drive, installation media, or OEM recovery media. Having a recovery USB stick ready is still a good idea.

A lesser-known extra: DataSanitization.exe​

The Bangkok Post report doesn't mention that Microsoft's Cloud rebuild documentation also describes a stand-alone DataSanitization.exe tool. It runs from WinRE via Troubleshoot > Advanced options > Command Prompt, for cases where you want to sanitize without rebuilding, or where Cloud rebuild isn't available. Microsoft says it:

• Shows a disclosure and a list of target disks, and needs a Y confirmation for each.
• Won't run on battery power.
• Doesn't reinstall Windows, so the PC won't boot until you reinstall it.
• Writes a log that records the start time, targeted disks, method, and final status. Copy it to external storage before you leave WinRE if you need it for an audit.

For IT: Recovery CSP remote rebuilds​

The second addition gives administrators remote control. Microsoft's release notes say IT administrators can now configure and start a Cloud rebuild remotely through the Recovery CSP, using either the currently installed build or a target build you specify.

Microsoft's documentation places the nodes under ./Device/Vendor/MSFT/Recovery/CloudRebuild:

• EnableLocalRebuild: allows or blocks rebuilds that reinstall the build currently on the device.
• EnableCustomRebuild: allows or blocks rebuilds to a specified target build.
• Execute/RebuildType: LocalRebuild or CustomRebuild. A custom rebuild requires BuildBranch, OSVersion, Edition, InstallationType (only Client is supported), SystemLanguage, and LCUVersion. An unattend XML answer file is optional.
• Status: a Get-only HRESULT for the most recent remotely started rebuild.

There are limits. Status is only reported when a rebuild fails early enough that the installed OS is still reachable, before sanitization or repartitioning. Microsoft also says the CloudRebuild nodes are Insider-only and may change before general availability. Don't build production runbooks on them yet.

Where it's available and what comes next​

Microsoft's release notes say the Experimental channel build is based on Windows 11, version 26H2 via an enablement package (Build 26340.9502). Many Experimental features use Controlled Feature Rollout, so not every Insider will see the feature straight away.

Reports differ on which other builds include it. Microsoft's blog lists the Cloud rebuild changes under the Experimental channel, while Thurrott reported that this new feature is also available on today's Beta build 26220.9492. Since then, Thurrott reported that with Experimental (26H1) build 28120.3151, Insiders on that Channel will get access to two new options in Cloud Rebuild, and that the Experimental Channel is getting the build 26340.9596 with a new entry point for Cloud Rebuild under Settings > System > Recovery.

As for public release, Microsoft has not yet confirmed a release timeline for the general public. Microsoft also notes that Insider features may change or never ship.

The verdict​

This is one of the more useful things Microsoft has done for the Windows recovery stack in a while. Built-in secure erase removes the need to track down vendor utilities just to sell an old PC. Remote rebuilds should save help desks a lot of trips to individual machines. The limits are clear, though: it's still a preview, it depends on the network and on drivers being published, and the result rests on SSD firmware that Windows can't check. Back up first, keep the PC plugged in, and don't treat a success screen as a certificate of destruction.