How to configure Ventoy to skip the Windows 11 TPM and Secure Boot check

 I have written a How To article here.

We can use an XML file to run the registry bypass hack automatically.

P.S. Six different Ventoy themes can be downloaded from here. The ventoy.json script will choose one at random.

agFM v1.73 released

Thomas came across a problem with agFM recently when booting to Windows ISOs. He was not able to boot to the Windows ISOs on a specific model of notebook:

The same stick and method was used on tons of notebooks of the previous model Lifebook U7410. 

It just fails with the new Model Lifebook U7411.

(Fastboot disabled, Secureboot disabled)
Booting the ISO with .isodef works, but I need to use .isowin for using unattended.xml. When starting the ISO using .isowin (even directly without unattended.xml), it stops loading with the following message:
\"Loading (memdisk)/boot/grubfm/null.cpio
# GRUB Environment Block
installiso=\\\\_ISO\\WINDOWS\\WIN10\\Win_10_2004.2_64BIT_Ger_EDU.ISO
##############
##############
error: xz file corrupted or unsupported block options.
Add: (wimboot)/bootmgfw.efi -> bootmgfw.efi
Add: (envblk)/null.cfg -> null.cfg\"

In the past, I have had a few people report the same .xz error but I have never been able to reproduce it...

agFM v1.72 and 'Ventoy for Easy2Boot' v1.0.46 are now fully released

These latest released versions will be installed if you make a new E2B drive, or you can update an existing E2B USB drive:

Instructions - update to agFM  v1.72

Instructions - update to Ventoy for Easy2Boot v1.0.46

Latest E2B is v2.10b (for Win11) - download .zip file and extract files to a new folder and run Make_E2B.exe and then use the Update_E2B button or just extract the files straight onto your E2B USB drive's Partition 1.

How can you check using a Windows batch file what AntiVirus s/w is active?

Windows Defender is the standard Windows Antivirus software that comes with Windows 10 and it does a pretty good job.

However, many people like to install 3rd-party AV and anti-malware software too.

In fact, some people may be running 3rd-party AV software without even knowing it!

For instance, many types of Acronis backup products may also install Acronis Cloud Protect without you even being aware of it.

One way to detect AV software and Services is to trawl through the Windows task list and try to recognise the names of the software products but I wanted to write a small .cmd Windows batch file to show the user what AV software was installed and if it was enabled or not so that I could add the code  into the E2B Make script to warn the user that they have AV s/w installed and it may be blocking write access to their USB drive's boot sector.

Here is what I ended up with...

Install Windows 11 using E2B and agFM onto any system

 E2B and agFM can automatically run the registry hack to skip the Windows 11 TPM\RAM\SecureBoot checks.

1. First update to agFM v1.72 or later version (just over-write files on Partition 2 with the latest download) and also update to latest E2B v2.10 Beta which has the WIN11 folder support (run Make_E2B.exe as Admin and click on the Update E2B button). Download areas for latest Betas

2. Copy your Win11 ISO to the \_ISO\WINDOWS\WIN11 folder.

Download Win 11 ISO from here. Select 'Latest Dev Channel' - Cumulative Update for Windows 11 (10.0.22000.51) (untick 'Integrate updates' option for faster build and download). The fewer Editions you tick the quicker the build - I ticked Home\Core + Pro. The download and build of the ISO may take a few hours or more!

Note: If you only tick one Edition, the Install.wim that is made is non-standard and does not contain an XML file. I suggest you include at least two Editions.

3. Create a .cmd text file which has exactly the same name as the Win11 ISO file and place the following three lines of code in the .cmd file:

reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassTPMCheck" /t REG_DWORD /d 1
reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassRAMCheck" /t REG_DWORD /d 1
reg add "HKLM\SYSTEM\Setup\LabConfig" /v "BypassSecureBootCheck" /t REG_DWORD /d 1

Tip: If you suspect this cmd file is not being run, add an extra line at the bottom which will wait for you to press ENTER:

pause

4. Copy the \_ISO\WINDOWS\WIN10\Windows 10 Pro (no prompt to repair).xml file to \_ISO\WINDOWS\WIN11 folder (your ISO must include Win11 Pro Edition - if not use a different XML file - e.g. Win10 Home, etc.)

You should now have the following files:

Easy2Boot v2.10a Beta available with Win11 support

The new E2B Beta is here.

It adds a \_ISO\WINDOWS\WIN11 folder.

I have also speeded up the loading of the Main Menu if you have lots of files in the \_ISO\WINDOWS\xxxx folders. The Main menu no longer shows you how many payload files are present as they are no longer counted.

I installed a version of Win11 using VBox and E2B legacy and agFM UEFI64 successfully.

To update, just extract the files onto your USB drive.

Bypass the Win11 Compatibility check

To avoid the Win11 'compatibility check' you can install Win11 using WinNTSetup.

If you install to a Virtual Machine, the 'compatibility check' is skipped.

Or you can run these commands as soon as Setup is loaded to skip the checks:

'Ventoy for Easy2Boot' v1.0.46 is now available for download

 I have now made an update for 'Ventoy for Easy2Boot' so it is now v1.0.46.

This is not the Ventoy image files but the modified version which is directly added to Partition 2 and can be booted to without switching in an image.

I had a problem with it where it would not boot Ubuntu ISOs and many other Linux ISOs unless Partition 2 was exactly 32MB in size - this is now fixed.

You can find the .zip file in the Latest Beta folders.

Instructions

1. Download the ventoy-1.0.46-windows.zip file

2. Drag-and-Drop the file onto the \e2b\Update agFM\Add_Ventoy.cmd  windows batch file using Explorer - answer Y to copy the files across.

You should now have the latest version of Ventoy for Easy2Boot

Please report any issues.

I will update the E2B server release version to this version in  a few days if no issues are reported.

agFM v1.72d Beta now available

 For those of you following my last few blog posts, agFM v1.72d includes the latest version of the Ventoy disk image scheme.

I have tidied it up a bit and renamed some files so that they appear first in the Ventoy menu system.

Also a new .mnu file is added to the \_ISO\MAINMENU folder to allow you to restore the original E2B partitions from a Legacy boot. This is quicker than booting to E2B - then Ventoy - then grubfm_multiarch.iso - then selecting 'Restore agFM Partition 2'. It also does not need to reboot.

So as not to clutter up the MAINMENU, I have not added three menu entries to switch in the Ventoy disk image files from E2B - you can just run agFM from the E2B menu and then switch in one of the Ventoy disk image files from the agFM Legacy menu.

To try it just extract the agFM download files onto Partition 2 (make sure you have the original agFM partition on Partition 2 first - not the Ventoy 32MB partition 2!).

Ventoy+Kaspersky Secure Boot bypass now available

agFM v1.73c Beta now makes 3 Ventoy 32MB images when you run the Make_Latest_Ventoy_Partion_Image.cmd script.

1. Ventoy with Secure Boot/MokManager

2. Ventoy (no Secure Boot)

3. Ventoy with Kaspersky shim - can Secure Boot as long as the Kaspersky shim is not blacklisted in the BIOS UEFI DBx blacklist database (same as used by agFM).

Please update to v1.73c if you want to try out this new Kaspersky Secure Boot Bypass version of Ventoy.

Ventoy images are now made with and without Secure Boot

The standard Ventoy image that was made by the Make_Latest_Ventoy_Partion_Image.cmd script contained the Secure Boot enabled EFI boot files.

However, this version does not boot on many systems (such a Lenovo laptops, etc.) - I get a 'Linpus Lite' boot option but it won't Secure Boot or load MokManager.

So I have now modified the script to produce two Ventoy images, one with the Secure Boot (InSecure Boot) files and the other image which does not support Secure Boot. which is much more compatible (but won't work if Secure Boot is enabled in the BIOS).

I also find that MokManager does not work on many Secure BIOSes (crashes/hangs/doesn't load) which is why E2B does not use it.

So you can now you pick which Ventoy image you want (no need for two Ventoy USB drives).

Note: v1.72c now makes 3 images, the last one includes the Kaspersky Secure Boot bypass mechanism so you can Secure Boot to Ventoy without needing MokManager.

Update Instructions

First follow the previous blog article, then...

1. Download the latest agFM v1.72b Beta version

2. Extract it to Partition 2 of your E2B USB drive

3. Run \e2b\Update agFM\Make_Latest_Ventoy_Partion_Image.cmd to make the new Ventoy image files.

You should now have two img files on Partition 2:

The startup_default.cfg file will also be updated, but you will need to change your startup_menu.txt file if you have made your own  agFM startup menu.

if [ -f (${user})/ventoy.disk.img -a -f (${user})/Switch_Ventoy.cfg ] ; then
menuentry "Ventoy image (Secure Boot) [Ptn2=32MB image]" --class=img {
set vdisk=ventoy.disk.img
grubfm_open "(${user})/Switch_Ventoy.cfg"
}
fi
if [ -f (${user})/ventoyNS.disk.img -a -f (${user})/Switch_Ventoy.cfg ] ; then
menuentry "Ventoy image (no Secure Boot) [Ptn2=32MB image]" --class=img {
set vdisk=ventoyNS.disk.img
grubfm_open "(${user})/Switch_Ventoy.cfg"
}
fi