SGH_WIKI

This is an old revision of the document!
Install Windows 11 bypass TPM2 and SecureBoot check
If PC does not support TPM2 and secureboot, it requires to change ISO, or create usb bootable disk.
Use Below script to modify ISO. Take note, it require admin right to run it.
@echo off
setlocal

:: ===== Admin check =====
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
if '%errorlevel%' NEQ '0' (
    echo Please run this script as Administrator!
    pause
    exit /b
)

:: ===== Configuration =====
set "OSCDIMG=C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe"
set "ISO_PATH=D:\win11\Win11_24H2_English_x64.iso"
set "WORK_DIR=D:\ISO_Mod"
set "NEW_ISO=D:\win11\Win11_24H2_English_x64_Bypass.iso"

:: ===== Check oscdimg =====
if not exist "%OSCDIMG%" (
    echo Not find oscdimg tool. Please check OSCDIMG path.
    pause
    exit /b 1
)

:: ===== Create working directory =====
if exist "%WORK_DIR%" rd /s /q "%WORK_DIR%"
mkdir "%WORK_DIR%"

:: ===== Mount ISO and get drive letter =====
echo [INFO] Mounting ISO...
for /f "usebackq tokens=*" %%D in (`powershell -NoProfile -Command ^
    "$d = Mount-DiskImage -ImagePath '%ISO_PATH%' -PassThru | Get-Volume; Write-Output $d.DriveLetter"`) do set "ISODRIVE=%%D:"
 
if not exist "%ISODRIVE%\" (
    echo [Error] ISO mount failed
    pause
    exit /b 1
)
echo [INFO] ISO mounted at %ISODRIVE%

:: ===== Copy ISO contents =====
echo [INFO] Copy ISO Files...
xcopy "%ISODRIVE%\*" "%WORK_DIR%\" /E /H /K >nul

:: ===== Dismount ISO =====
powershell Dismount-DiskImage -ImagePath "%ISO_PATH%" >nul

:: ===== Create Autounattend.xml =====
echo [INFO] Generate Autounattend.xml...
(
echo ^<unattend xmlns="urn:schemas-microsoft-com:unattend"^>
echo     ^<settings pass="windowsPE"^>
echo         ^<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"^>
echo             ^<RunSynchronous^>
echo                 ^<RunSynchronousCommand wcm:action="add"^>
echo                     ^<Order^>1^</Order^>
echo                     ^<Path^>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f^</Path^>
echo                 ^</RunSynchronousCommand^>
echo                 ^<RunSynchronousCommand wcm:action="add"^>
echo                     ^<Order^>2^</Order^>
echo                     ^<Path^>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f^</Path^>
echo                 ^</RunSynchronousCommand^>
echo             ^</RunSynchronous^>
echo         ^</component^>
echo     ^</settings^>
echo ^</unattend^>
) > "%WORK_DIR%\Autounattend.xml"

:: ===== Create New ISO =====
echo [INFO] Creating new ISO...
"%OSCDIMG%" -m -o -u2 -udfver102 "%WORK_DIR%" "%NEW_ISO%"
 
echo.
echo [DONE] New ISO created:
echo %NEW_ISO%
pause