What software do you guys use to create bootable Windows 10 USB drive?

[Myna]

I used to use Rufus to create bootable Windows 10 USB flash drives and had no problem with it. But last night, I downloaded the Windows 10 1909 ISO from Microsoft's official website and created the bootable USB drive. And it failed to pass the Secure Boot. I created the USB using the default GPT Partition Scheme. Of course I can disable Secure Boot and install it, but I don't want to have to do it. I don't remember having this issue before. I've only installed Windows 10 on my laptop once, when I was upgrading my SSD. So, I might've missed something. Do enlighten me about it, if that's the case. I haven't been keeping a tab on Windows update/upgrade as of late.

 

If I create the bootable USB using the Microsoft's own Media Creation Tool, which I did eventually, the USB drive works just fine. I can install Windows 10 without disabling Secure Boot. 

 

What am I doing wrong? Is there any working alternative to Rufus? I've tried PowerISO and it doesn't seem to work either. 

 

Ubuntu 19.10 boots just fine when I create the bootable USB drive with Rufus.

[vertical]

Try formatting the usb fat32.

Secureboot doesn't stop windows on a usb.

It's just something to make installing other os's difficult.

 

[kunjar]

Hi, had a similar issue recently when installing a fresh copy of 1909 to my nvme ssd. Basically, you can format your usb stick in windows to FAT32, mount the .iso by double clicking it, highlighting all the contents and simply copying them over to your FAT32 formatted usb. This will boot fine without the need to disable secure boot or change any other BIOS settings, assuming that the BIOS is already set to boot from usb or you have the option of pressing a key during startup to manually select your boot device.

 

IMPORTANT: If you download the .iso (x64) from MSoft it contains ALL editions one of which you can select during the install process. If you browse to the /Sources folder you will find an install.wim file which is probably larger than 4GB hence will NOT write to your newly formatted FAT32 drive. This is one of the important checks Rufus automatically does when choosing the file system. 

 

There are a few ways around this. You can mount the .iso, and using dism extract the install.wim of the specific version you wish to install beforehand, so Home, Pro, .etc

 

1.] Mount the .iso and use the following command (in elevated cmd prompt) replacing the drive letter X: with that of the letter assigned to the .iso virtual drive.

 

dism /Get-WimInfo /WimFile:X:\sources\install.wim

 

A list will appear with Index, Name, Description and Size of each of the editions contained within the .iso. Note down the Index number of the edition you wish to install.

 

2.] Type the following command, replacing H: with the drive letter of your mounted .iso, IndexNumber with the number recorded in previous step, and 😄 with the drive you wish to extract the specific install.wim to.

dism /export-image /SourceImageFile:H:\sources\install.wim /SourceIndex:IndexNumber /DestinationImageFile:😄\install.wim /Compress:max /CheckIntegrity

/DestinationImageFile:😄\install.wim will extract the specific install.wim to root C drive. (ignore the silly emoji it keeps autocorrecting from C-colon)

 

3.] Copy that file over to your USBDrive:\Sources folder in place of where the original 4GB+ install.wim would be. (In this case there will be no install.wim since you cannot copy a file larger than 4GB to a FAT32 partition.) Extraction only takes 1-2min on mechanical HDD.

 

See here: https://www.wintips.org/how-to-extract-an-install-wim-file-that-contains-several-install-wim-files/

[TheEmpathicEar]

I am guessing that folks with an optical drive do not have to deal with any of this? But, of course, having an optical drive in many scenarios now is not even an option.

[Myna]

16 minutes ago, vertical said:

Try formatting the usb fat32.

 

Yea, FAT32 is the way to go. But apparently, it's not as simple as it seems. The original install.wim file is larger than 4GB. So, it can't be copied directly to a FAT32 drive.

 

Quote

22 minutes ago, kunjar said:

Hi, had a similar issue recently when installing a fresh copy of 1909 to my nvme ssd. Basically, you can format your usb stick in windows to FAT32, mount the .iso by double clicking it, highlighting all the contents and simply copying them over to your FAT32 formatted usb. This will boot fine without the need to disable secure boot or change any other BIOS settings, assuming that the BIOS is already set to boot from usb or you have the option of pressing a key during startup to manually select your boot device.

 

IMPORTANT: If you download the .iso (x64) from MSoft it contains ALL editions one of which you can select during the install process. If you browse to the /Sources folder you will find an install.wim file which is probably larger than 4GB hence will NOT write to your newly formatted FAT32 drive. This is one of the important checks Rufus automatically does when choosing the file system. 

 

There are a few ways around this. You can mount the .iso, and using dism extract the install.wim of the specific version you wish to install beforehand, so Home, Pro, .etc

 

1.] Mount the .iso and use the following command (in elevated cmd prompt) replacing the drive letter X: with that of the letter assigned to the .iso virtual drive.

 

dism /Get-WimInfo /WimFile:X:\sources\install.wim

 

A list will appear with Index, Name, Description and Size of each of the editions contained within the .iso. Note down the Index number of the edition you wish to install.

 

2.] Type the following command, replacing H: with the drive letter of your mounted .iso, IndexNumber with the number recorded in previous step, and 😄 with the drive you wish to extract the specific install.wim to.

dism /export-image /SourceImageFile:H:\sources\install.wim /SourceIndex:IndexNumber /DestinationImageFile:😄\install.wim /Compress:max /CheckIntegrity

 

3.] Copy that file over to your USBDrive:\Sources folder in place of where the original 4GB+ install.wim would be. (In this case there will be no install.wim since you cannot copy a file larger than 4GB to a FAT32 partition.) Extraction only takes 1-2min on mechanical HDD.

 

See here: https://www.wintips.org/how-to-extract-an-install-wim-file-that-contains-several-install-wim-files/

@kunjar so, how does that make the USB bootable? Will it get auto detected?

 

5 minutes ago, TheEmpathicEar said:

I am guessing that folks with an optical drive do not have to deal with any of this? But, of course, having an optical drive in many scenarios now is not even an option.

Yep. Unfortunately, I don't have an optical drive on my laptop  

[Myna]

18 minutes ago, vertical said:

Try Yumi.

 

https://www.pendrivelinux.com/yumi-multiboot-usb-creator/

 

connect usb and start yumi .

 

 

Nope. Doesn't work. I tried it with YUMI-UEFI-0.0.2.0.exe and it threw the following error. Was expecting it though, as Yumi was just copy pasting the install.wim file onto the drive.

Quote

 

[TheEmpathicEar]

Does anyone out there know of way around formatting FAT32 in this scenario? This seems rather arduous.

[Jogs]

You can look here

https://alternativeto.net/software/rufus/

 

I have used SARDU & WinToUSB  in the past, but now I use Rufus only. 1909 didn't give me any problem during boot, but on one it was unable to create a new partition without any apparent reason.

[neofita]

I use Easy2Boot, but I haven't tried with 1909

[Kalju]

You don't need any special software or widgets, also there is no matter if You use FAT32 or NTFS formatting, but the FAT32 file system is better selection to be able to boot either BIOS-based or UEFI-based PCs. But You must remember, there is one small limitation, namely with FAT32 the max file size is 4GB (NB! install.esd or install.wim may be sometimes large).
Yes it's true on some computers You must disable secure boot, but not always. 
Always make sure all other drives and peripherals are unplugged. Update the BIOS or UEFI firmware to latest, if don't already updated, or reset to Defaults, making sure SATA controller is set to AHCI, UEFI is enabled, CSM disabled. If You want, set in boot menu to boot from USB but it isn't mandatory, You can always go first to boot menu (usually F12, on some pc-s F2, Delete, etc - You must know Your pc) and select manually and it's done.
With Rufus are problems for some years already, personally I don't use it, for me it's absolutely useless.

I do it always manually and have never had any kind of problems.

[kunjar]

3 hours ago, Myna said:

 

Yea, FAT32 is the way to go. But apparently, it's not as simple as it seems. The original install.wim file is larger than 4GB. So, it can't be copied directly to a FAT32 drive.

 

@kunjar so, how does that make the USB bootable? Will it get auto detected?

 

Yep. Unfortunately, I don't have an optical drive on my laptop  

 

Yes the USB will be auto detected. The boot image is signed and thus complies with Secure Boot. The extraction of the required install.wim takes < 2mins.

 

OR, you can navigate to uupdump.ml, select the edition of Windows you want including the most recent cumulative updates, create the edition specific .iso (so either Home or Pro) hence resulting in a smaller install.wim file and you should be able to copy it straight over to the FAT32 USB. Creation of the .iso will take sometime on a mechanical hdd though but you will have a fully up to date Win ISO.

 

I have the ISO "18363.476.191106-2043.19H2_RELEASE_SVC_PROD1_CLIENTPRO_OEMRET_X64FRE_EN-GB.ISO" which was created using uupdump.ml a week ago. It is for Win10 Pro x64. I can upload this if you wish. All you will have to do is mount the iso (double-click) and copy all the files over to your FAT32 formatted USB. 

[eurobyn]

i use power iso : under tools choose make bootable usb stick and point to youre iso file.

works great here and secure boot and uefi is working fine.

you can  thry other usb stick ?

 

 

 

 

[Myna]

Quote

13 hours ago, Jogs said:

You can look here

https://alternativeto.net/software/rufus/

 

I have used SARDU & WinToUSB  in the past, but now I use Rufus only. 1909 didn't give me any problem during boot, but on one it was unable to create a new partition without any apparent reason.

 

I gave up. lol

 

Quote

13 hours ago, neofita said:

I use Easy2Boot, but I haven't tried with 1909

 

I too never had any issue until now. But with 1909, the install.wim has gone past the 4GB mark. And so, the issue came up.

 

Quote

11 hours ago, Kalju said:

You don't need any special software or widgets, also there is no matter if You use FAT32 or NTFS formatting, but the FAT32 file system is better selection to be able to boot either BIOS-based or UEFI-based PCs.
Yes it's true on some computers You must disable secure boot, but not always. 
Always make sure all other drives and peripherals are unplugged. Update the BIOS or UEFI firmware to latest, if don't already updated, or reset to Defaults, making sure SATA controller is set to AHCI, UEFI is enabled, CSM disabled. If You want, set in boot menu to boot from USB but it isn't mandatory, You can always go first to boot menu (usually F12, on some pc-s F2, Delete, etc - You must know Your pc) and select manually and it's done.
With Rufus are problems for some years already, personally I don't use it, for me it's absolutely useless.

I do it always manually and have never had any kind of problems.

 

I didn't know that I don't need to use any software to create a  Windows 10 bootable USB device. lol....

Anyways, for whatever reason, my system doesn't detect NTFS USB drive unless and until I create the bootable USB device using Rufus. But then it fails at Secure Boot. FAT32 formatted drives boots up just fine.

 

Quote

11 hours ago, kunjar said:

 

Yes the USB will be auto detected. The boot image is signed and thus complies with Secure Boot. The extraction of the required install.wim takes < 2mins.

 

OR, you can navigate to uupdump.ml, select the edition of Windows you want including the most recent cumulative updates, create the edition specific .iso (so either Home or Pro) hence resulting in a smaller install.wim file and you should be able to copy it straight over to the FAT32 USB. Creation of the .iso will take sometime on a mechanical hdd though but you will have a fully up to date Win ISO.

 

I have the ISO "18363.476.191106-2043.19H2_RELEASE_SVC_PROD1_CLIENTPRO_OEMRET_X64FRE_EN-GB.ISO" which was created using uupdump.ml a week ago. It is for Win10 Pro x64. I can upload this if you wish. All you will have to do is mount the iso (double-click) and copy all the files over to your FAT32 formatted USB. 

 

Yep. Just checked. The process that you've mentioned in the previous post works. The USB drives boots normally. 

 

11 hours ago, vertical said:

It is not weird  that it dtdn't work.

Download an iso ,   that works.

with the windows media creation tool you'll have an iso with a little bit less than 4gb.

If you download it youself it will be more than 5gb.

 

 

with rufus you need to do mbr (bios or uefi-csm) because most likely your drive is mbr .

and ntfs

 

 

I've not used win 10 a long time and i don't use rufus so much .

i've done the 5gb iso newest update with rufus.

 

I downloaded it myself now and the 4 gb  and 5gb iso are done with yumi.

not      yumi-uefi ,     the other one.

 

rufus was faster than yumi.

 

I don't have the time to install now .

i will do that later and add it to the disk management course that i'm doing here.

When I use the MBR option on Rufus, the USB doesn't even get detected while booting. My system works only works with GPT.

 

9 hours ago, eurobyn said:

i use power iso : under tools choose make bootable usb stick and point to youre iso file.

works great here and secure boot and uefi is working fine.

you can  thry other usb stick ?

PowerISO doesn't work. I've tried that. It's not a hardware issue. Earlier versions of Windows 10 had install.wim files smaller than 4GB. And so, fitting it onto a FAT32 drive wasn't an issue. But now, that size of that file has gone past the 4GB mark. So, if one's PC doesn't support booting from NTFS USB drives, the only way to install Windows 10 is by extracting the install.wim file using the process mentioned by @kunjar.

 

To sum it up, I've tried everything that was mentioned above and found out that, the only thing that works for me is the process mentioned by @kunjar. All the software that used to work with 1903 doesn't work with 1909. Rufus might work, but only after disabling Secure Boot.

 

As of right now, if your system doesn't boot via NTFS USB flash drives, you can either use the Microsoft's Media Creation Tool to create the bootable USB drive, or follow the instructions provided by kunjar and do it manually.

[MrZeb]

1 hour ago, Myna said:

To sum it up, I've tried everything that was mentioned above and found out that, the only thing that works for me is the process mentioned by @kunjar. All the software that used to work with 1903 doesn't work with 1909. Rufus might work, but only after disabling Secure Boot.

 

As of right now, if your system doesn't boot via NTFS USB flash drives, you can either use the Microsoft's Media Creation Tool to create the bootable USB drive, or follow the instructions provided by kunjar and do it manually.

 

What format was used by the Media Creation Tool? FAT32 or NTFS?

[Jogs]

Sometimes computers start to use their own brain, and at that time Human Brains can do nothing.

[MrZeb]

1 hour ago, vertical said:

The windows media creation tool only downloads.

 

Besides the download option the tool also have another option to download and create a bootable flashdrive.

[uffbros]

16 hours ago, eurobyn said:

i use power iso : under tools choose make bootable usb stick and point to youre iso file.

works great here and secure boot and uefi is working fine.

you can  thry other usb stick ?

 

 

 

 

Doesn't work for me...I then used Rufus..That worked.

I could swear I posted in this thread the other day with links to what you need to address this problem and it is now gone???? I search this site and can't find my post but here are the 2 links again. They fix your problem.

https://forums.mydigitallife.net/threads/solutions-installing-windows-on-uefi-systems-with-install-wims-larger-than-4gb.79199/

https://forums.mydigitallife.net/threads/windows-boot-disk-uefi-or-legacy-bios-install-wim-over-4gb.79268/page-3

[Kalju]

I read these "wise comments" and somehow feel very sad.
People try to praise one or another gadget, but at the same time don't understand what they are doing, what they need to do, don't understand that there are different systems and capabilities, ie computers are in different ages, there are different configurations, etc. And what works in one case may not work in another.
People, first of all if you want to do something, the first must to know the basics, that is, to know what we have and, secondly, to know where we want to get. Only then can one begin to look at what methods can be used, which ones are reasonable to use, and so on.
It cannot be that we start tooth fixing with an enema pump and through the anus.
It's really sad if nothing is understood and even don't comes to mind that if you don't know, you should look at how things work and why they work just that.
Finally. You really don't need any additional tools or third-party gadgets to create bootable Windows 10 USB drive, but only formatted USB drive and what ever .iso unpacker. 
That's all what You need.

[vertical]

Quote

You really don't need any additional tools or third-party gadgets to create bootable Windows 10 USB drive, but only formatted USB drive and what ever .iso unpacker. 

 

moved

[dhjohns]

If I want to use usb to install Windows I just format it fat32, and extract the ISO to it.  Good-to-go!  But, I have created a 10 GB partition on my SDD, extract ISO to that (fs=NTFS,) and use EasyBCD to point to it in my boot menu.  I install Windows this way.  Way quicker. 

[JohnTk]

You can't use 3rd party bootloaders with secure boot. That's the whole point of secure boot.

 

Simply format your USB with NTFS filesystem and use DISKPART or some 3rd party program to mark USB partition as active. Then extract your iso to it. As long as you have EFI folder from iso on the drive with original MS bootloader (not GRUB or what ever 3rd party bootloader those utilities put) you should have no problems booting from it.

 

EDIT: When I think about it more marking partition as active is probably not even required for UEFI boot. This was required when you wanted to boot from USB under MBR (legacy) mode before using bootsect.exe to write bootloader

[pr1xsel]

Convert the .WIM file to .ESD, then should fit into FAT32.

[TheEmpathicEar]

4 minutes ago, pr1xsel said:

Convert the .WIM file to .ESD, then should fit into FAT32.

This attempts to explain this. I did not understand this prior to this thread.

[kunjar]

36 minutes ago, pr1xsel said:

Convert the .WIM file to .ESD, then should fit into FAT32.

 

I was just about to suggest this also. You can convert the wim to esd using power iso rather easily OR you can download the latest .esd offered by MSoft i believe it is 1909 18363.418 and use an esd decryptor and choose "create iso with compressed install.esd". This only takes about 10-15mins on mechanical HDD and the resulting install.esd should be smaller than the original 4GB+ install.wim in the iso from MSoft so can be copied to your FAT32 usb.

 

 

 

[Krinal]

Official statement from rufus Developer.

 

Why do I need to disable Secure Boot to use UEFI:NTFS? 

Also known as: "Surely, because it says 'Secure', it shouldn't be disabled, ever!!!" 

First, you might want to realise that a name is just that, a name, and that it's not because someone slaps a big "Secure" sticker onto a product or software, that it suddenly makes it any more secure. For instance, you may call the ROT13 encryption algorithm "secure encryption" all you want, it still doesn't make it an actual secure means of encrypting data... 

So, I must first stress out that, instead of being paranoid about it, you should come to terms with the fact that YOU are actually being manipulated with the terminology that Microsoft (and others) decided to use when they introduced "Secure Boot" because it was deliberately chosen to convey something that it cannot really deliver (See for instance the fiasco of Microsoft's Golden Key).

Instead, Secure Boot should more accurately have been called Bootloader Signature Enforcement because that is really what (and only what) it does, which is different from trying to protect your computer's security.

But of course, the minute you call Secure Boot by its real name, you risk letting people realise that there may exist alternate motives for what you are trying to promote, for dubious reasons (see below) and they may also come to understand how not having "Secure Boot" enabled, as you would like them to do always, does not necessarily equate "Leaving your computer in an insecure state".

  Which brings us to point number 2: When Rufus is asking you to disable Secure Boot, as a temporary measure, so that you can boot the UEFI:NTFS bootloader, it's not because this bootloader should be considered unsafe, or because we were too lazy/too cheap to get it signed for Secure Boot, or even (as some people seem keen to suggest) out of spite because we dislike Secure Boot (which is incorrect: We do like the principle behind Secure Boot.

We just don't like the clear abuse of power that is being demonstrated when a single entity; Microsoft, is left in control of it and abuses it to promote a nefarious agenda). No, the ONLY reason we do not provide a signed UEFI:NTFS bootloader, which would avoid requesting that you disable Secure Boot, is because Microsoft (again the only entity that controls the Secure Boot signing process) has unilaterally decided, for no reason that stands the test of scrutiny, that anything licensed under GPLv3 cannot be signed for secure boot, ever.  And that is really all there is to it.  Microsoft has decided it doesn't like the GPLv3 and, in a clear abuse of power created a signing process that forbids the submission of anything that is GPLv3. Of course, Microsoft tried to "justify" their stance with a half baked tirade about how the GPLv3 would ultimately require them to relinquish their private keys, but that reasoning can easily be demonstrated to be utter bullshit when you also know that Microsoft has no qualms signing Linux shims, which, clearly, it should not sign, since these should logically be subjected to the same "alleged" relinquishing of private keys that the GPLv3 is supposed to entitle its users to, and therefore, if Microsoft's reasons are to be believed, having said shims load GPLv3 bootloaders such as GRUB (which they do) can only result in someone eventually demanding that the shims' private signing keys are relinquished, therefore completely defeating Secure Boot...  Well, UEFI:NTFS is GPLv3 since the source for the NTFS driver we use is GPLv3, which means that, because we cannot get it signed for Secure Boot, we have to ask YOU to temporarily disable secure boot when using UEFI:NTFS.  Now, given the feedback I am getting, I do realize that a lot of people may irrationally scream at the idea of even temporarily disabling Secure Boot. So let me pursue further on what Secure Boot is really about, and why your impression that even temporarily disabling Secure Boot is not an option, is about as wrong as thinking that UEFI cannot boot anything but FAT32 (which, as can be seen from the previous FAQ entry, is also completely wrong).  All Secure Boot does is establish trust, by verifying that the boot files have not been altered from the version that was created by the makers of the OS, and it does so through the process of using digital signatures to validate hash of the files.  Well, guess what; even if you have Secure Boot disabled, the exact same process can still apply because:      Rufus is digitally signed, and therefore validated with about the same level of trust as a Secure Boot executable would be (and if you want to dispute that statement, may I invite you to read the Security page?)     If you produced the OS installation image yourself, through official sources, or, if it's a retail ISO, validated its checksum against the one provided on the OS manufacturer's page, then you have also confirmed that the UEFI boot files you are going to launch are not malicious (which actually makes Secure Boot superfluous for the installation process).  Therefore, even with Secure Boot disabled, you can actually have some good level of trust that the boot files you are going to run are not going to do anything malicious, which is all Secure Boot is about. Again the only purpose of Secure Boot is to provide some level of "safety" if you have reasons not to trust the media you are about to boot. But if you are able to establish a sufficient level of trust from elsewhere, then Secure Boot becomes entirely superfluous.  So, now that you understand what Secure Boot is really about, and how Rufus tries to secure its bootloader creation process (because if Secure Boot can misappropriate "secure" in its name, then I don't see why I shouldn't), then you should really understand how there is no increased risk associated with temporarily disabling Secure Boot, as long as you are using legitimate installation media.  And again, since it's only a temporary measure, once you have finished installing your OS, you can re-enable Secure Boot.

 

Source (Github)

 

https://github.com/pbatard/rufus/wiki/FAQ#How_do_I_disable_Secure_Boot