How to Create a Windows 11 Bootable USB & Bypass TPM 2.0, Secure Boot, and Online Account Checks
Microsoft imposes strict hardware gates for Windows 11, including Trusted Platform Module (TPM 2.0), UEFI Secure Boot, a 64-bit dual-core processor on the supported list, and mandatory Microsoft Account creation during the initial Out-of-Box Experience (OOBE). Here is how Rufus allows you to bypass these restrictions effortlessly.
Prerequisites for the Setup
- A USB Flash Drive: Minimum 8 GB capacity (16 GB or 32 GB recommended). All data on this drive will be erased.
- Official Windows 11 ISO: Downloaded directly from Microsoft’s official portal or downloaded via Rufus’s built-in download feature.
- The Latest Rufus Executable: Downloaded from our Downloads Page (`rufus-4.15.exe` or portable).
Step-by-Step Instructions
1 Connect USB Drive & Launch Rufus
Plug your USB flash drive into your PC and execute Rufus with administrator privileges. In the Device dropdown, make sure your intended USB drive is selected. Double-check the drive letter to avoid formatting the wrong storage device.
2 Select the Windows 11 ISO File
Under Boot selection, keep "Disk or ISO image" and click the SELECT button. Browse to your downloaded Windows 11 ISO file (e.g. `Win11_24H2_English_x64.iso`). Rufus will scan the ISO metadata automatically.
3 Select Partition Scheme & Target System
For 99% of computers manufactured after 2012:
- Partition Scheme:
GPT - Target System:
UEFI (non CSM) - File System:
NTFS(Rufus uses its custom UEFI:NTFS bootloader so large install.wim files exceed FAT32's 4GB limit).
* Note: If you are installing on an ancient legacy BIOS motherboard without UEFI support, switch the partition scheme to MBR and Target System to BIOS (or UEFI-CSM).
4 Click START to Open Windows User Experience Customization
Clicking the START button will pop open the Windows User Experience dialog box. Check the boxes that correspond to your installation preferences:
5 Confirm Drive Formatting & Wait for Completion
Confirm the warning prompt regarding drive deletion. Rufus will partition the stick, extract the ISO filesystem, copy boot sectors, and inject the bypass answer files into the Windows PE environment. When the green progress bar shows READY, your USB drive is ready to boot!
How Rufus Accomplishes the Hardware Bypass Mechanically
Many users wonder if Rufus modifies system binaries or cracks Windows files. It does not. Rufus uses Microsoft's officially supported answer file deployment framework:
-
Unattend XML & Registry Injection: Rufus injects an automated `autounattend.xml` script into the root of the USB drive. When the Windows installer loads WinPE, it reads this configuration and sets the official Microsoft bypass registry keys:
BypassTPMCheck=1,BypassSecureBootCheck=1, andBypassRAMCheck=1underHKLM\SYSTEM\Setup\LabConfig. -
Windows 11 24H2 Compatibility: Starting with Windows 11 build 24H2, Microsoft tightened CPU instruction requirements (requiring the
POPCNTandSSE4.2instruction sets). While Rufus successfully bypasses TPM and Secure Boot checks, CPUs lacking POPCNT cannot execute the Windows 11 24H2 kernel. Ensure your processor was manufactured after 2008.