10

With a new bare Machine how do I install Windows 10 from a USB stick and install it with secure boot and EFI turned on?

Improve this question
3
  • 5
    I don't think this is a duplicate, at least not from the linked question, since this question asks for how to do it bootable without disabling secure boot, I had a similar problem, and the accepted answer did the trick for me, while Windows USB Download tool didn't! So I upvoted both the question and the answer.
    – Maxinne
    Jun 16, 2016 at 10:18
  • 1
    The procedure is the same because there isn't anything special you have to do.
    – Ramhound
    Aug 2, 2016 at 20:17
  • I needed to use Microsoft's "mediacreationtool.exe" to download and install directly to the USB. I've found that you can't download to an ISO and then use the "Windows 7 USB DVD Download Tool" to create a secure boot compatible USB.
    – P.Turpie
    Mar 9, 2017 at 2:17

3 Answers 3

Reset to default
7
  1. First make sure your bios has secure boot turned on.
  2. Next, build your USB stick with Fat32
  3. Then install normally.

The 11 steps for manually preparing / building a USB Disk to be a bootable Win 10 Install. This bootable USB stick will work for both older BIOS installs as well as the newer UEFI installs.

  1. Diskpart (Run from a CMD prompt)
  2. List Disk
  3. Select Disk # (Where # is the number of your USB disk)
  4. Clean (removes any partitions on the USB disk, including any hidden sectors)
  5. Create Partition Primary (Creates a new primary partition with default parameters)
  6. Select Partition 1 (Focus on the newly created partition)
  7. Active (Sets the selected partition to an active valid system partition state)
  8. Format FS=fat32 quick (Formats the partition with the FAT32 file system. FAT32 is needed instead of NTFS so that it can load under the secure boot UEFI BIOS.)
  9. Assign (Assigns the USB drive a drive letter)
  10. Exit
  11. Copy all the files from the Windows 10 isO to the USB Stick.

For more details see my blog post at: http://mythoughtsonit.com/2014/05/installing-windows-8-1-from-usb-to-a-uefi-secure-boot-machine/

Improve this answer
4
  • 1
    The steps above are still needed with the ISO if you are doing a fresh install from a usb stick. Or burn the ISO to DVDs.
    – Brian Lewis
    Sep 9, 2015 at 20:35
  • 6
    Unfortunately, install.wim is 4,469,518,898 bytes in September 2018, which is too large for a single file on FAT32. This approach no longer works for recent versions of Windows 10.
    – bart
    Oct 1, 2018 at 7:44
  • kind-a tedious, what I did is convert the wim to esd to compress it, build iso from said esd, then use this method or the rufus method.
    – Earlee
    Dec 30, 2020 at 7:33
  • 2
    @bart You can split the install.wim into pieces. See my answer below.
    – stackprotector
    Feb 19, 2021 at 14:43
7

FYI.. Best tool I have seen for Windows for creating a USB Boot Disk from ISO is - Rufus: https://rufus.akeo.ie/ and works great. There are some helpful USB tools in LINUX Mint - but, that is out-of-scope here. ;)

Rufus

Overview from the Site:

Rufus is a utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.

It can be especially useful for cases where:

  • you need to create USB installation media from bootable ISOs (Windows, Linux, UEFI, etc.)
  • you need to work on a system that doesn't have an OS installed
  • you need to flash a BIOS or other firmware from DOS
  • you want to run a low-level utility

Despite its small size, Rufus provides everything you need!

Improve this answer
3
  • 4
    Note that Rufus doesn't appear to support installing to a machine with secure boot enabled (as the OP asked for), but you can install with secure boot disabled, and then re-enable secure boot after installation is complete.
    – bart
    Oct 1, 2018 at 8:10
  • I've read that if you install with secure boot disabled that you will have to reinstall. Does it depend on the operating system?
    – Brain2000
    Aug 18, 2021 at 20:51
  • As of Rufus 3.17, Rufus does support installing Windows on a machine with Secure Boot enabled.
    – Akeo
    Dec 15, 2021 at 23:34
7

The following method works without external tools and it works with image files that are larger than 4 GB. Basically, you need a USB drive with a FAT32 file system1 and an active partition. You can use the following PowerShell commands to prepare your USB drive:

  1. Use Get-Disk to identify your USB drive (look for the Number column).
  2. Prepare your USB drive with the following pipeline (note that this will erase your entire USB drive): 
    Clear-Disk -Number <USE_NUMBER_FROM_STEP_ONE> -RemoveData -RemoveOEM -Confirm:$false -PassThru | New-Partition -UseMaximumSize -AssignDriveLetter -IsActive | Format-Volume -FileSystem FAT32

After that, your USB drive is ready to receive the files of the Windows image. Copy all image files to the USB drive, except the install.wim file, if it exceeds 4 GB (FAT32 cannot handle files larger than 4 GB)2:

Copy-Item -Recurse -Path D:\* -Destination E:\ -Exclude install.wim

If your install file is larger than 4 GB (which is most probably the case nowadays), split it into pieces with the following command2:

DISM /Split-Image /ImageFile:D:\sources\install.wim /SWMFile:E:\sources\install.swm /FileSize:4096

This will create multiple install.swm files (install.swm, install2.swm, etc.) depending on the size of the source file.

After that, your USB drive is ready to serve as both, a legacy boot stick or a UEFI boot stick even with Secure Boot enabled.

1 FAT32 is compatible with more systems than NTFS. Therefore, you are more flexible when using this older format.

2 Where D: contains your mounted .ISO file and E: is your USB drive

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.