10

With a new bare Machine how do I install Windows 10 from a USB stick and install it with secure boot and EFI turned on?

3
  • 5
    I don't think this is a duplicate, at least not from the linked question, since this question asks for how to do it bootable without disabling secure boot, I had a similar problem, and the accepted answer did the trick for me, while Windows USB Download tool didn't! So I upvoted both the question and the answer.
    – joao Beno
    Jun 16 '16 at 10:18
  • The procedure is the same because there isn't anything special you have to do.
    – Ramhound
    Aug 2 '16 at 20:17
  • I needed to use Microsoft's "mediacreationtool.exe" to download and install directly to the USB. I've found that you can't download to an ISO and then use the "Windows 7 USB DVD Download Tool" to create a secure boot compatible USB.
    – P.Turpie
    Mar 9 '17 at 2:17
7

FYI.. Best tool I have seen for Windows for creating a USB Boot Disk from ISO is - Rufus: https://rufus.akeo.ie/ and works great. There are some helpful USB tools in LINUX Mint - but, that is out-of-scope here. ;)

Rufus

Overview from the Site:

Rufus is a utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.

It can be especially useful for cases where:

  • you need to create USB installation media from bootable ISOs (Windows, Linux, UEFI, etc.)
  • you need to work on a system that doesn't have an OS installed
  • you need to flash a BIOS or other firmware from DOS
  • you want to run a low-level utility

Despite its small size, Rufus provides everything you need!

2
  • 4
    Note that Rufus doesn't appear to support installing to a machine with secure boot enabled (as the OP asked for), but you can install with secure boot disabled, and then re-enable secure boot after installation is complete.
    – bart
    Oct 1 '18 at 8:10
  • I've read that if you install with secure boot disabled that you will have to reinstall. Does it depend on the operating system?
    – Brain2000
    Aug 18 at 20:51
6
  1. First make sure your bios has secure boot turned on.
  2. Next, build your USB stick with Fat32
  3. Then install normally.

The 11 steps for manually preparing / building a USB Disk to be a bootable Win 10 Install. This bootable USB stick will work for both older BIOS installs as well as the newer UEFI installs.

  1. Diskpart (Run from a CMD prompt)
  2. List Disk
  3. Select Disk # (Where # is the number of your USB disk)
  4. Clean (removes any partitions on the USB disk, including any hidden sectors)
  5. Create Partition Primary (Creates a new primary partition with default parameters)
  6. Select Partition 1 (Focus on the newly created partition)
  7. Active (Sets the selected partition to an active valid system partition state)
  8. Format FS=fat32 quick (Formats the partition with the FAT32 file system. FAT32 is needed instead of NTFS so that it can load under the secure boot UEFI BIOS.)
  9. Assign (Assigns the USB drive a drive letter)
  10. Exit
  11. Copy all the files from the Windows 10 isO to the USB Stick.

For more details see my blog post at: http://mythoughtsonit.com/2014/05/installing-windows-8-1-from-usb-to-a-uefi-secure-boot-machine/

4
  • 1
    The steps above are still needed with the ISO if you are doing a fresh install from a usb stick. Or burn the ISO to DVDs. Sep 9 '15 at 20:35
  • 6
    Unfortunately, install.wim is 4,469,518,898 bytes in September 2018, which is too large for a single file on FAT32. This approach no longer works for recent versions of Windows 10.
    – bart
    Oct 1 '18 at 7:44
  • kind-a tedious, what I did is convert the wim to esd to compress it, build iso from said esd, then use this method or the rufus method.
    – Earlee
    Dec 30 '20 at 7:33
  • 2
    @bart You can split the install.wim into pieces. See my answer below. Feb 19 at 14:43
6

The following method works without external tools and it works with image files that are larger than 4 GB. Basically, you need a USB drive with a FAT32 file system1 and an active partition. You can use the following PowerShell commands to prepare your USB drive:

  1. Use Get-Disk to identify your USB drive (look for the Number column).
  2. Prepare your USB drive with the following pipeline (note that this will erase your entire USB drive):
    Clear-Disk -Number <USE_NUMBER_FROM_STEP_ONE> -RemoveData -RemoveOEM -Confirm:$false -PassThru | New-Partition -UseMaximumSize -AssignDriveLetter -IsActive | Format-Volume -FileSystem FAT32
    

After that, your USB drive is ready to receive the files of the Windows image. Copy all image files to the USB drive, except the install.wim file, if it exceeds 4 GB (FAT32 cannot handle files larger than 4 GB)2:

Copy-Item -Recurse -Path D:\* -Destination E:\ -Exclude install.wim

If your install file is larger than 4 GB (which is most probably the case nowadays), split it into pieces with the following command2:

DISM /Split-Image /ImageFile:D:\sources\install.wim /SWMFile:E:\sources\install.swm /FileSize:4096

This will create multiple install.swm files (install.swm, install2.swm, etc.) depending on the size of the source file.

After that, your USB drive is ready to serve as both, a legacy boot stick or a UEFI boot stick even with Secure Boot enabled.


1 FAT32 is compatible with more systems than NTFS. Therefore, you are more flexible when using this older format.

2 Where D: contains your mounted .ISO file and E: is your USB drive

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.