Additional steps needed to allow install of MX on a new Win 11 computer

[j2mcgreg]

@FullScale4Me wrote:

A quick expansion & correction on one of your points: 3. Disable Fast Startup in Windows AND Fast Boot in the PC motherboard BIOS/Firmware.

That's not true of the newest laptops like mine because Microsoft now has the ability to access the bios and make changes. I think that this is the reason that Bitlocker is now an integral part of Windows 11. However it can be true on Win 10 machines that were upgraded to Win 11.

I think that the line should be changed to: 3. Disable Fast Startup in Windows. Note on computers that were upgraded to Windows 11, you may have to disable Fast Boot in the bios as well.

[AK-47]

For a fresh install overwriting Win11 straight out of the box with no need to recover anything, (who have latest Win11 machines) can you just get into the TPM settings to nuke all the keys first and then disable Secure Boot. You could also disable secure boot without nuking the TPM keys in some instances. Some machines allow you to just hold a key while booting and this gets you into the BIOS.

There are also tricks to avoid the MS account: https://www.tomshardware.com/how-to/ins ... ft-account
For Windows 11 22H2 (as noted in the article) you would need to create the media using Rufus.

[FullScale4Me]

Rufus is great for setting up Win 11 on older PCs. It does an offline insertion of registry keys for the bypass of W11 required 8th Generation CPU, presence of TPM, Secure Boot being on, and minimum 4 Gb RAM checks.

Typing this on a PC that dual boots Windows 11 with a 6th Generation CPU.

Code: Select all

System:    Kernel: 6.1.0-2mx-amd64 [6.1.7-1~mx21+1] x86_64 bits: 64 compiler: gcc v: 10.2.1 
           parameters: BOOT_IMAGE=/boot/vmlinuz-6.1.0-2mx-amd64 
           root=UUID=<filter> ro 
           Desktop: KDE Plasma 5.20.5 wm: kwin_x11 vt: 7 dm: SDDM 
           Distro: MX-21.3_KDE_x64 Wildflower October 20  2021 
           base: Debian GNU/Linux 11 (bullseye) 
Machine:   Type: Desktop System: Dell product: OptiPlex 5040 v: N/A serial: <filter> Chassis: 
           type: 3 serial: <filter> 
           Mobo: Dell model: 0T7D40 v: A00 serial: <filter> UEFI: Dell v: 1.21.0 date: 12/08/2021 
Battery:   Device-1: hidpp_battery_0 model: Logitech Wireless Mouse B330/M330/M331 
           serial: <filter> charge: 55% (should be ignored) rechargeable: yes status: Discharging 
CPU:       Info: Quad Core model: Intel Core i5-6500 bits: 64 type: MCP arch: Skylake-S family: 6 
           model-id: 5E (94) stepping: 3 microcode: F0 cache: L2: 6 MiB 
           flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 25599 
           Speed: 900 MHz min/max: 800/3600 MHz Core speeds (MHz): 1: 900 2: 900 3: 900 4: 900 
           Vulnerabilities: Type: itlb_multihit status: KVM: VMX disabled 
           Type: l1tf mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled 
           Type: mds mitigation: Clear CPU buffers; SMT disabled 
           Type: meltdown mitigation: PTI 
           Type: mmio_stale_data mitigation: Clear CPU buffers; SMT disabled 
           Type: retbleed mitigation: IBRS 
           Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via prctl 
           Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization 
           Type: spectre_v2 
           mitigation: IBRS, IBPB: conditional, RSB filling, PBRSB-eIBRS: Not affected 
           Type: srbds mitigation: Microcode 
           Type: tsx_async_abort mitigation: TSX disabled 
Graphics:  Device-1: Intel HD Graphics 530 vendor: Dell driver: i915 v: kernel bus-ID: 00:02.0 
           chip-ID: 8086:1912 class-ID: 0300 
           Device-2: Logitech Webcam C270 type: USB driver: snd-usb-audio,uvcvideo bus-ID: 1-8:3 
           chip-ID: 046d:0825 class-ID: 0102 serial: <filter> 
           Display: x11 server: X.Org 1.20.14 compositor: kwin_x11 driver: loaded: modesetting 
           unloaded: fbdev,vesa display-ID: :0 screens: 1 
           Screen-1: 0 s-res: 1920x1080 s-dpi: 96 s-size: 508x285mm (20.0x11.2") 
           s-diag: 582mm (22.9") 
           Monitor-1: HDMI-1 res: 1920x1080 hz: 60 dpi: 93 size: 527x296mm (20.7x11.7") 
           diag: 604mm (23.8") 
           OpenGL: renderer: Mesa Intel HD Graphics 530 (SKL GT2) v: 4.6 Mesa 22.0.5 
           direct render: Yes 
Audio:     Device-1: Intel 100 Series/C230 Series Family HD Audio vendor: Dell 
           driver: snd_hda_intel v: kernel bus-ID: 00:1f.3 chip-ID: 8086:a170 class-ID: 0403 
           Device-2: Logitech Webcam C270 type: USB driver: snd-usb-audio,uvcvideo bus-ID: 1-8:3 
           chip-ID: 046d:0825 class-ID: 0102 serial: <filter> 
           Sound Server-1: ALSA v: k6.1.0-2mx-amd64 running: yes 
           Sound Server-2: PulseAudio v: 14.2 running: yes 
Network:   Device-1: Intel Ethernet I219-V vendor: Dell driver: e1000e v: kernel port: f040 
           bus-ID: 00:1f.6 chip-ID: 8086:15b8 class-ID: 0200 
           IF: eth0 state: up speed: 100 Mbps duplex: full mac: <filter> 
Drives:    Local Storage: total: 596.17 GiB used: 331.82 GiB (55.7%) 
           SMART Message: Unable to run smartctl. Root privileges required. 
           ID-1: /dev/sda maj-min: 8:0 vendor: Western Digital model: WD6400AAKS-75A7B2 
           size: 596.17 GiB block-size: physical: 512 B logical: 512 B speed: 3.0 Gb/s type: N/A 
           serial: <filter> rev: 3B01 scheme: GPT 
Partition: ID-1: / raw-size: 506.18 GiB size: 497.16 GiB (98.22%) used: 331.72 GiB (66.7%) 
           fs: ext4 dev: /dev/sda2 maj-min: 8:2 
           ID-2: /boot/efi raw-size: 256 MiB size: 252 MiB (98.46%) used: 44.5 MiB (17.7%) 
           fs: vfat dev: /dev/sda1 maj-min: 8:1 
Swap:      Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default) 
           ID-1: swap-1 type: partition size: 11.62 GiB used: 58.3 MiB (0.5%) priority: -2 
           dev: /dev/sda6 maj-min: 8:6 
Sensors:   System Temperatures: cpu: 40.5 C mobo: 29.8 C 
           Fan Speeds (RPM): N/A 
Repos:     Packages: 3172 note: see --pkg apt: 3157 lib: 1760 flatpak: 15 
           No active apt repos in: /etc/apt/sources.list 
           Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list 
           1: deb http://deb.debian.org/debian bullseye-updates main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/debian.list 
           1: deb http://deb.debian.org/debian bullseye main contrib non-free
           2: deb http://security.debian.org/debian-security bullseye-security main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/google-chrome.list 
           1: deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main
           Active apt repos in: /etc/apt/sources.list.d/google-earth-pro.list 
           1: deb [arch=amd64] http://dl.google.com/linux/earth/deb/ stable main
           Active apt repos in: /etc/apt/sources.list.d/mx.list 
           1: deb http://mxrepo.com/mx/repo/ bullseye main non-free
           2: deb http://mxrepo.com/mx/repo/ bullseye ahs
           Active apt repos in: /etc/apt/sources.list.d/vscode.list 
           1: deb [arch=amd64] https://packages.microsoft.com/repos/vscode stable main
           No active apt repos in: /etc/apt/sources.list.d/yannubuntu-ubuntu-boot-repair-jammy.list 
Info:      Processes: 201 Uptime: 18h 58m wakeups: 129 Memory: 7.66 GiB used: 3.13 GiB (40.9%) 
           Init: SysVinit v: 2.96 runlevel: 5 default: 5 tool: systemctl Compilers: gcc: 10.2.1 
           alt: 10 Client: shell wrapper v: 5.1.4-release inxi: 3.3.06 
Boot Mode: UEFI

[davidy]

Rufus's latest update pretends it needs to have network access to function. Rufus is done. I installed PhoenixLite OS win10 on a small amd board. Admin acct only as long as you don't try and create a user, otherwise it will ask you to login. Works perfect. I used etcher portable. Fastest booting pc I've ever had. 10s restarts.

[FullScale4Me]

Rufus's latest update pretends it needs to have network access to function. Rufus is done.

Rufus connects to the internet, but I never allowed it to - why?

A little context for others about the recent Rufus change: he gives a work-a-round to 'shut off' internet accessing [rufus update checking only]. He explains why he made this internet access opt-out vs opt-in.

[AK-47]

I guess "Do not show this message again" wasn't an option for him?

[FullScale4Me]

I guess "Do not show this message again" wasn't an option for him?

He gives a workaround - it's not a toggle, it just involves renaming the program file.

[davidy]

That's interesting. Rufus has normally downloaded extra files, incl. folders, so that it can make images bootable. Those files have sat in the same folder for years now alongside the rufus exe. I have always ran it portably and even would normally rename it to just rufus.exe. The latest I simply replaced the exe I had with the default file that's free to download. I assumed that it would need those extra files and folders in order to work so did not change the name. Whatever. Etcher only wants to update, is portable, and requires no other files to work. Glad to know it's as simple (stupid) as a rename. If the dev needs telemetry, or whatever, he should say so upfront when you down it and then I'd be glad. I will probably never use it again.
PhoenixLite also has a Win11 ed.. I hear the task manager in 11 is awesome but for my money 10 is enough. MS has become what android is today. A google nightmare but under another name.

Even so if you do install 10 or 11 using a std iso image, Chris Titus Tech's "One Tool" is highly recommended to mitigate the bloatware bs. It's free as a terminal cmd program. I've never used it but was getting ready to until I found the phoenix iso's. I literally only run windows for my xerox laser printer software. But, it's nice to have a fully functional version of windows that requires no ms acct.. I still remember when MS tried getting me to "just give us your cell #" just to install it.

Anyone who erases MS for MX is a hero btw. Smart too.

[j2mcgreg]

Yes, Rufus can connect to the internet but only if you let it. I always download ISOs separately from Rufus so that I can run an MD5 checksum on them before I use Rufus to write them to a USB drive. This way, Rufus only searches locally.