SGH_WIKI

This is an old revision of the document!

---

Install Windows 11 bypass TPM2 and SecureBoot check

If PC does not support TPM2 and secureboot, it requires to change ISO, or create usb bootable disk.

Basically we need to add below Autounattend.xml file into windows 11 installation ISO file's root folder

Autounattend.xml

<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
            <RunSynchronous>
                <RunSynchronousCommand wcm:action="add">
                    <Order>1</Order>
                    <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
                </RunSynchronousCommand>
                <RunSynchronousCommand wcm:action="add">
                    <Order>2</Order>
                    <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
                </RunSynchronousCommand>
            </RunSynchronous>
        </component>
    </settings>
</unattend>

Here provides a batch script to auto modify ISO file without use 3rd party tools. But it requires to install windows ADK. Note: it requires admin right to run this batch command.

make_win11_bypass.bat

@echo off
setlocal

:: ===== Admin check =====
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
if '%errorlevel%' NEQ '0' (
    echo Please run this script as Administrator!
    pause
    exit /b
)

:: ===== Configuration =====
set "OSCDIMG=C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\oscdimg.exe"
set "ISO_PATH=D:\win11\Win11_24H2_English_x64.iso"
set "WORK_DIR=D:\ISO_Mod"
set "NEW_ISO=D:\win11\Win11_24H2_English_x64_Bypass.iso"

:: ===== Check oscdimg =====
if not exist "%OSCDIMG%" (
    echo Not find oscdimg tool. Please check OSCDIMG path.
    pause
    exit /b 1
)

:: ===== Create working directory =====
if exist "%WORK_DIR%" rd /s /q "%WORK_DIR%"
mkdir "%WORK_DIR%"

:: ===== Mount ISO and get drive letter =====
echo [INFO] Mounting ISO...
for /f "usebackq tokens=*" %%D in (`powershell -NoProfile -Command ^
    "$d = Mount-DiskImage -ImagePath '%ISO_PATH%' -PassThru | Get-Volume; Write-Output $d.DriveLetter"`) do set "ISODRIVE=%%D:"
 
if not exist "%ISODRIVE%\" (
    echo [Error] ISO mount failed
    pause
    exit /b 1
)
echo [INFO] ISO mounted at %ISODRIVE%

:: ===== Copy ISO contents =====
echo [INFO] Copy ISO Files...
xcopy "%ISODRIVE%\*" "%WORK_DIR%\" /E /H /K >nul

:: ===== Dismount ISO =====
powershell Dismount-DiskImage -ImagePath "%ISO_PATH%" >nul

:: ===== Create Autounattend.xml =====
echo [INFO] Generate Autounattend.xml...
(
echo ^<unattend xmlns="urn:schemas-microsoft-com:unattend"^>
echo     ^<settings pass="windowsPE"^>
echo         ^<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"^>
echo             ^<RunSynchronous^>
echo                 ^<RunSynchronousCommand wcm:action="add"^>
echo                     ^<Order^>1^</Order^>
echo                     ^<Path^>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f^</Path^>
echo                 ^</RunSynchronousCommand^>
echo                 ^<RunSynchronousCommand wcm:action="add"^>
echo                     ^<Order^>2^</Order^>
echo                     ^<Path^>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f^</Path^>
echo                 ^</RunSynchronousCommand^>
echo             ^</RunSynchronous^>
echo         ^</component^>
echo     ^</settings^>
echo ^</unattend^>
) > "%WORK_DIR%\Autounattend.xml"

:: ===== Create New ISO =====
echo [INFO] Creating new ISO...
"%OSCDIMG%" -m -o -u2 -udfver102 "%WORK_DIR%" "%NEW_ISO%"
 
echo.
echo [DONE] New ISO created:
echo %NEW_ISO%
pause