Install Windows 11 25H2 without TPM and Secure Boot requirements

windows11-25H2-tpm-secureboot.md

Install Windows 11 25H2 without TPM and Secure Boot requirements

Alternative: use FlyoobeApp.zip (FlyOOBE) to create an customized ISO.

1. Create a Windows 11 ISO with Microsoft's Media Creation Tool
2. Install Setup Patchium and run it (or try latest Rufus version directly and patch from there)
3. Home tab: Select ISO, wait during processing
4. Go to Install > Uncheck Remove upgrade and Check Disable Windows 11 compatibility restrictions, click Apply
5. Optional: To install without a Microsoft account, go to Install OOBE tab. Click Integrate lumOOBE. This will break sysinstall.
6. Click on Create ISO button
7. Use Rufus or Ventoy (prefered) to run installation from a USB drive

Upgrade Windows 11

You need 10 GB of free space on disk.

Uninstall any Antivirus (can cause BSOD after migration). Reinstall once its done.

1. Download FlyoobeApp.zip (FlyOOBE).
2. Unzip archive and launch "FlyOOBE.exe".
3. In the Upgrade to Windows 11 section, click on Details > Run.
4. Follow steps to download the ISO, select the download folder. FlyOOBE does all the tricks.
5. Follow Windows upgrade tutorial

Want to create a script to configure Windows ? Use WinScript

Hello.

How to do at Step 4 of upgrading Windows 11?

Once you unzip MediaCreationTool.bat, go to the /bypass11 folder.
Then right click on Skip_TPM_Check_on_Dynamic_Update.cmd and Run as admin.

Then launch the Win11 installer from a mounted ISO

Hello - and thanks for the short and to the point explanation. :-)

Once installed fresh, using the no microsoft account method, it would seem that using sysprep to OOBE the machine, doesn't work,
Is there something somewhere, that once "ready to go", I can delete from the new install, so that sysprep will then run the whole OOBE experience, and I can use that to setup the user properly?

thanks much!
Andrew

PS: the why.... is that the OOBE is nice for a fresh machine for resale... or... to trigger the "we found your old install, would you like to restore settings from MS?" options that come up, particularly when you're replacing a failed hard drive on a customer machine. :-)

Hi @AndrewBienhaus.

• Did you succeed ?
• Did you use Microsoft ISO or it failed with lumOOBE ?

Hello!
I both have and have not suceeded, depending on your perspective. :-)

I used the Microsoft ISO, with your instructions above, to make my USB stick, and have used it many times now, and was very happy that I didn't have to fight with the mandatory microsoft account, etc., and can go straight to 24h2.
So, I believe that is using the lumOOBE.

But, once installed, booted, running, updated, with all the drivers in place, and the system the way I like it... in the past before 24h2/lumOOBE... I would sysprep a system, so the user could then take their machine back, and walk through the steps on their own, with their own MS account.
I was giving them a "fresh" machine.

With your lumOOBE enabled, is there any way to remove that, once the system is running?
So that sysprep will work again?

Merci!
andrew

@AndrewBienhaus Do you succeed with this ? (use a translator ;)): https://www.it-connect.fr/effectuer-sysprep-windows-11-24h2/

Hello - and thank you. :-)
I ran through those pages, and I can say, no, that doesn't work.
I do NOT use the generalize, as I do not want to remove SID, or drivers, or anything else - I just want to reset the user account to default, and ask all the "usual" questions.
At the point I am at, I have updated drivers, setup everything to the hardware, and I am NOT using it for HyperV - in fact, I have already activted the license successfully and everything.
It's a "ready to use" machine.

I just need to execute the standard OOBE "script".... so people can put in their own MS account.

but if I do the sysprep with oobe defaults, it just reboots back into what I assume is the lumOOBE.... same default account... no password... everything I picked from the usbstick win11 24h2 install that the instructions created. :-(

Yes, bitlocker is off.

I wonder if there are settings that lumOOBE introduced, that I can remove?
an answer file that can be delete or reset?

thank you!
Andrew

for what it is worth - if it helped - I have 3 machines right now sitting in my "resale" pile, that are in this state.
if you want me to try messing with something, I am happy to experiment. :-)

Ni idea :(

Ok, so for the search engines, here's what I have figured out as of today. :-)

My best google-fu, couldn't unlock the mystery of removing the lumOOBE, resetting it, disabling it, or anything like that.
No matter what I did, sysprep couldn't seem to reset the user experinece to the default oobe.

So - I made a new ISO, using the SetupPatchium tool above, and dumped to USB with Rufus, without the lumOOBE.
Everything worked perfectly.
System setup, just the way I wanted it, and then sysprepped it for a new customer. Tested. Working.
Interestingly enough, using Rufus 4.6.2208 - it actually asked me if I wanted to disable hardware checking, oobe, and a few other things, before it made the USB stick... so I guess Rufus has the same support now for 24h2?

So - I made another USB, using the earlier downloaded iso from MS of 24h2, the one I had fed to SetupPatchium, and selected those options at usb creation time, and it worked perfectly.

BOTH of them - go through the OOBE, but if you unplug the ethernet cable at the "setup for personal use" step, it then bypasses the MS account need, and you can plug the cable back in, one screen later.

The only thing SetupPatchium does do for you, is allow you to select the old pre-24h2 install menus & screens... but there's nothing wrong with the new ones that I have found yet. :-)

Great. Thx for sharing.

Maybe Rufus is enough for patching the official ISO then.
Enjoy

.... maybe... but I want you to know I appreciate your original post!
My brain is storing 100,000 trivial things in the IT world... and I truly always appreciate someone saving me some work, and spelling it out!
:-)

Glad it helps.

You can share Gists too ;)

@AndrewBienhaus You should try this: https://github.com/CodingWonders/DISMTools

@AndrewBienhaus And UnattendedWinstall ;): https://github.com/memstechtips/UnattendedWinstall

thank you!
DISM has always been a pain.... I will look into that for sure!

Salut, moi j'ai lancé l'installation de Windows 11 24H2 avec Fly by11 une fois l'installation terminée et après le redémarrage qui a duré un bon moment j'ai eu tout simplement droit a la réinitialisation de mon Windows 10 22H2 avec le message Windows server n'as pas pu s'installer nous avons réinitialise Windows 10.
S'il y'a une solution je suis preneur peut être je dois essayé avec Windows 22H2. Merci.

Je veux dire essayé avec Windows 11 22H2 . Merci encore une fois.

Bonjour, j'ai aussi essayé Windows 11 22H2 et tout marchai bien mais une fois redémarrer et à 48% de l'installation des mises à jour tout s'est arrêtés et en fin retour à Windows 10 avec le message ci joint. Merci.

Merci d'avance, est se qu'il y a moyen de migrer de Windows 10 22H2 vers Windows_10 IOT enterprise_ltsc_2021.

Thanks

I tested Rufus. Installation by running setup.exe worked but automatic installation did not work without manually clicking.
setup.exe /ShowOOBE none /EULA accept /Compat IgnoreWarning /auto upgrade /DynamicUpdate Disable

I then tried Patchium but the installation stopped and Secure Boot was required.

Edit:
The problem was with a ISO image created by Media Creation Tool. When I downloaded the ISO file directly from https://www.microsoft.com/en-us/software-download/windows11 and used Patchium. Installation did not require Secure Boot.

Edit:
Cannot update Windows 10 22H2 to Windows 11 24H2. I get complains about TPM 2.0 and Secure Boot. My first test was to update Win 11 23H2 to 24H2 and it was ok.

Edit:
I'm updating Windows 10 machines to Windows 11 23H2 which is supported till November 11, 2025.

Edit:
The issue with Rufus setup.exe is now fixed pbatard/rufus#2752

i am stucked on secure boot
tpm is removed but secure boot is still there

i am stucked on secure boot tpm is removed but secure boot is still there

I have made these changes before updating.

# These registry edition does not alone work for Windows 11 24H2. Not sure if needed anymore.
reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassTPMCheck" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassSecureBootCheck" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassCPUCheck" /t REG_DWORD /d 1 /f


# This is what Rufus does
# https://github.com/pbatard/rufus/issues/2568#issuecomment-2387934171
# https://github.com/pbatard/rufus/blob/master/res/setup/setup.c#L109C102-L109C115
reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CompatMarkers" /f
reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Shared" /f
reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TargetVersionUpgradeExperienceIndicators" /f
reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\HwReqChk" /v "HwReqChkVars" /t REG_MULTI_SZ /s "," /d "SQ_SecureBootCapable=TRUE,SQ_SecureBootEnabled=TRUE,SQ_TpmVersion=2,SQ_RamMB=8192" /f
reg.exe add "HKLM\SYSTEM\Setup\MoSetup" /v "AllowUpgradesWithUnsupportedTPMOrCPU" /t REG_DWORD /d 1 /f

Hi @Tataz2 , Secure Boot is temporarly disabled from the UEFI settings, not from Windows.

I have a mc. How to do this on a mac?

Fdy

Click To Download 👇

Install Windows 11 25H2 without TPM

🔰🔴 Install Windows 11 25H2

.
.
.
.
.