sapphirescales
Well-Known Member
- Reaction score
- 3,129
It does, however UEFI and Secure Boot are entirely different things. Modern computers don't support booting a Microsoft OS that doesn't support Secure Boot.
HELP, need windows 7 pro 64
- Thread starter Choppie
- Start date
Sky-Knight
Well-Known Member
- Reaction score
- 5,143
- Location
- Arizona
Modern computers do not support booting to any OS that doesn't support native EFI. Windows 7's most advanced boot mode is CSM EFI, which was removed from all platforms last year.
Secure boot doesn't actually have anything to do with this, other than Windows 11 requires it.
I always disable secure boot especially when installing from USB.
Most brand name machine automatically re-enable once Windows is up and running.
Hasn't happened yet with any white boxes, secure boot remains disabled and no problems.
NviGate Systems
Well-Known Member
- Reaction score
- 1,022
- Location
- Vancouver
I don't disable secure boot. It has its place. If you are using boot media that supports it, you've got no worries.
I have a WinPE that is built with 8.1, supports secure boot, so I can service machines no need to fuss with settings.
You never know what settings go wrong with disabling secure boot. On some systems like HP, it can prevent activation as activation on some units relies on secure boot keys being OEM, which are deleted when secure boot is disabled. Granted, these may be rare cases, but in general I try not to mess with EFI settings.
We were talking specific OS that have quasi EFI support. For 8 and above best to leave security settings as they are.
I have a WinPE that is built with 8.1, supports secure boot, so I can service machines no need to fuss with settings.
You never know what settings go wrong with disabling secure boot. On some systems like HP, it can prevent activation as activation on some units relies on secure boot keys being OEM, which are deleted when secure boot is disabled. Granted, these may be rare cases, but in general I try not to mess with EFI settings.
We were talking specific OS that have quasi EFI support. For 8 and above best to leave security settings as they are.
Sky-Knight
Well-Known Member
- Reaction score
- 5,143
- Location
- Arizona
I typically have secure boot disabled for initial installation, just flip it back on during that first reboot.
nlinecomputers
Well-Known Member
- Reaction score
- 8,529
- Location
- Midland TX
If you create the USB drive with the Media Creation Tool the flash drive will be Secure boot ready. I never need to turn it off and I turn it ON on all systems I work on anymore. It protects against Boot sector malware.
britechguy
Well-Known Member
- Reaction score
- 4,022
- Location
- Staunton, VA
Do you happen to know whether this is because of the Media Creation Tool itself, or the ISO that it builds and places on the USB drive? I ask because I very often use the MCT to "create media for another machine" but have it do so as an ISO file so that I can use it for repair installs when needed and burn it to USB using Rufus if I need actual bootable media.
nlinecomputers
Well-Known Member
- Reaction score
- 8,529
- Location
- Midland TX
It’s the tool. Rufus can’t legally use the certificate required so it can’t create media that is signed. Microsoft tools can.
britechguy
Well-Known Member
- Reaction score
- 4,022
- Location
- Staunton, VA
Thanks.
It's getting harder each day to install W7 on newer hardware. I think another alternative you could try is buying a new older am3+ socket mother board. Buy new DDR3 ram. Buy a used Phenom x4 and a new SSD. The system could be quite snappy and still support W7 and Office 2003.
Sky-Knight
Well-Known Member
- Reaction score
- 5,143
- Location
- Arizona
Yeah, the tool. The nice thing is, Win11 will install with secure boot disabled! You just have to turn it back on after the initial installation process hits that first reboot.
So you can still use Rufus... I know I do!
Rufus creates secure-boot install USBs for Windows 10 fine. There was a short period a few years ago when one of the files in the saved ISO was too large for FAT32, so at that time Rufus could only use NTFS which doesn't support secure boot. That only lasted a week or two, then Microsoft changed the ISO saved by the MCTool so files were small enough for FAT32. Since then Rufus has been able to create secure boot installers again, I use it for every installer I make.
The initial Windows 11 ISO saved by the MCTool was also incompatible with FAT32 meaning Rufus could not create a secure boot installer. The workaround was to have the tool make the install USB directly. I'm not sure if that was or will be changed, or if that's what we need to live with from now on.
There is absolutely no need to turn off secure boot for Windows installs from USB.
The initial Windows 11 ISO saved by the MCTool was also incompatible with FAT32 meaning Rufus could not create a secure boot installer. The workaround was to have the tool make the install USB directly. I'm not sure if that was or will be changed, or if that's what we need to live with from now on.
There is absolutely no need to turn off secure boot for Windows installs from USB.
Porthos
Well-Known Member
- Reaction score
- 12,371
- Location
- San Antonio Tx
The difference between an ISO created by the MCT is it is in ESD (compressed) format.
A directly downloaded ISO is in WIM format and is too large for fat32's 4 gig limit.
A directly downloaded ISO is in WIM format and is too large for fat32's 4 gig limit.
Yes, I do use RUFUS too and based on what was said at:
FAQ
The Reliable USB Formatting Utility. Contribute to pbatard/rufus development by creating an account on GitHub.
github.com
It now appears RUFUS has fixed the problem and disabling secure boot is no longer a requirement, though it didn't appear to make any difference prior to Win11 in terms of security.
Sky-Knight
Well-Known Member
- Reaction score
- 5,143
- Location
- Arizona
NviGate Systems
Well-Known Member
- Reaction score
- 1,022
- Location
- Vancouver
Also, if you have the ISO and can't download Rufus (the ISO that fits in FAT32) simply copying the files to a FAT32 disk will enable it to be bootable. UEFI does not have any boot sectors but rather relies on the Bootia32.efi or bootamd64.efi files. Those I believe are the key to having secure boot as those are the matching firmware files that efi looks for.
You can also remaster the WIM if you remove the other additions like Pro etc and sometimes that can reduce the filesize but only by the files that are not unique to each build. WIM files can have indexes that share multiple files which is why you can have multiple installations of Windows that don't take up 3 times the space.
You can also remaster the WIM if you remove the other additions like Pro etc and sometimes that can reduce the filesize but only by the files that are not unique to each build. WIM files can have indexes that share multiple files which is why you can have multiple installations of Windows that don't take up 3 times the space.
Similar threads
