Question Win 11/ UEFI

[Pez]

Hi all.

I put up a recent post over in the Motherboards sub-forum (https://forums.tomshardware.com/threads/tpm-windows-11.3733608/#post-22520761). With my current Windows 10 Pro OS, I saw a message in Settings/ Update & Security that said my PC does not meet the minimum system requirements for Windows 11; it turned out to be TPM needing to be enabled on my motherboard. I know how to enable it on my motherboard, so, I asked some question in that motherboard thread and got some good, useful info.

This weekend, I'm looking to take the big step and install Windows 11 on my computer. However, I want to check some things here since there is a certain something that is new to me.

I am not going to do an in-place upgrade to Win 11 from my current Win 10 system. Instead, I download the Win 11 ISO and put it onto a bootable USB drive and then am going to perform a clean install from scratch.

With my Gigabyte motherboard, the B450M DS3H V2, I'll need to enter the BIOS and make that change so TPM is enabled. I had contacted Gigabyte's tech support, and they said "For Windows 11, just enable fTPM in the bios along with disabling CSM. If the OS is not configure as UEFI, it won't boot after these setting changes so you will need to boot off the Windows 11 image to perform a full OS install ". I mentioned that I am not performing an in-place upgrade from Win 10 to Win 11, but the part that still caught my eye was "If the OS is not configure as UEFI, it won't boot after these setting changes so you will need to boot off the Windows 11 image to perform a full OS install".

Since I am performing a clean install of Win 11 from scratch, and yes, I am going to boot off a Windows 11 image on a USB drive.......how do I verify UEFI?

UEFI is new to me as I have been using legacy BIOS for years in the many different systems I've had. In the manual for my Gigabyte motherboard, it says: "Boot Option Priorites - Specifies the overall boot order from the available devices. Removable storage devices that support GPT format will be prefixed with "UEFI:" string on the boot device list. To boot from an operating system that supports GPT partitioning, select the device prefixed with "UEFI:" string." So if I'm reading this correctly, I shouldn't really need to do anything if my drive supports GPT format? I've already checked using a command in PowerShell (Get-Disk), and my Solid State Drive is listed as GPT.

So is that it? After I've made the changes in my BIOS (enable fTPM in the bios along with disabling CSM), I should be good-to-go? Then just boot from the USB that I have the Win 11 ISO on and install it to my Solid State Drive?

I noticed there's a sticky thread here in the sub-forum for Windows 11 by Colif: https://forums.tomshardware.com/thr...-what-you-can-do-to-resolve-problems.3711259/ The sticky post was originally put up on 7/2/21, but then updated on 9/2/21. The updated post mentions that if you're performing a Windows 11 install from an ISO (which I am from a USB drive), then the requirements aren't quite as much. So, looks like I should be OK....correct? My drive is listed as GPT and not MBR....

And one more thing: When Windows 10 came out years ago, as you probably know, as long as you had a licensed copy of Windows 7 or 8, then you were eligible for Windows 10 for free (I've had both Windows 7 and 8). With the Windows 10 OS I've had for years, I did a recent motherboard swap a month or so ago, and initially, after reconnecting everything to that new motherboard including the previous SSD with Win 10 already on it, I received that message that Windows may not be genuine and needs to be activated. But in Settings, there's a link to click on if you've made a recent hardware change (like I did with the motherboard!), and after clicking that link, I was activated again and good-to-go.

Sooooooooo.....if I perform this full, clean installation of Windows 11 on a USB drive from scratch.....will it "recognize" my system as having before had Windows 10? Will it get automatically activated? Because on previous Win 10 installation, during installation, when it comes to that part for License key, I click "Skip For Now" and then it gets automatically activated later.

Thanks for any helpful info;
Pez

 

[kerberos_20]

you can verify uefi easily
during bios POST, press F12 key to get to boot selection, bootable devices in UEFI will say UEFI
windows boot manager is also uefi even if it doesnt says that

CSM doesnt have to be disabled, it can be enabled, but storage has to be UEFI (in CSM settings), and drive needs to be formatted as GPT drive

here you can see CSM enabled and storage boot option as UEFI
but if you can disable CSM and PC will work, you can later on enable fast boot once windows gets installed, that will speed up PC startup time

 

[Pez]

Hi kerberos_20; thanks for the reply!

Can't take screen capture shots while in the BIOS, eh? Use your cell phone to take a pic?

You have a Gigabyte board, too?

Anyway, here's a pic of my Gigabyte motherboard B450M DS3H V2 BIOS screen:

So in that pic, where you see the red-colored arrow: Windows Boot Manager (P2: Samsung SSD 850 Pro 512GB)? You're saying that that is the same thing as UEFI even though it doesn't use that word/ acronym? You mean I've been in UEFI mode all this time and didn't even know it?!

And then the yellow-colored arrow: CSM Support - Enabled. You're saying that it doesn't have to necessarily be Enabled? But if it is enabled, then "storage has to be UEFI (in CSM settings), and drive needs to be formatted as GPT drive"? How do I do that?

And then the white-colored arrow: Anything need to be done there with Other PCI Device ROM Priority - UEFI Only?

And then in the Peripherals section of the BIOS:

So in here where the red-colored arrow is: Just Enable AMD CPU fTPM? And then I should be good for the security requirement for Windows 11?

Pez

 

[Colif]

how to set up secure boot/tpm on all AMD Gigabyte Motherboards

Steps to enable (all AMD-based Gigabyte mobos) Secure Boot. Make sure fTPM is enabled. Make sure CSM is disabled. In Secure Boot, select custom under Secure Boot Mode, Select Restore Factory Keys, Say YES to reset without saving.

When BIOS restarts, access BIOS and change Secure Boot Mode back to Standard and then Yes to restart without save.

Almost every motherboard since 2010 has been UEFI.

Spoiler

UEFI - Unified extensible Firmware Interface

If your PC is less than 11 years old, you have a UEFI bios now

In 2006 or so Intel decided the bios as it was at time was too limited and needed to be replaced so that it supported newer technologies as they were invented
By about 2009 a consortium of hardware makers had combined to create UEFI standard

Old bios were limited, they didn't know what a mouse was for, so everything was keyboard driven
they weren't expandable, everything had to fit in a small amount of memory
they only supported MBR drives, no idea what GPT is.
MBR = Master Boot Record
Can only have 4 partitions per drive (there are tricks to get around this) and max drive size is 2.2 tb



UEFI bios overcame all the limitations of legacy bios (as it came to be called)
it supports mouse, it has a GUI so it looks better than previous bios could
Its expandable, it can be added to to grow as new hardware is created.
UEFI supports MBR & GPT Drives


GPT = GUID Partition Table

GUID = Global Unique ID = Every GPT drive on earth has a unique ID
GPT drives can have a max of 255 partitions on them, and the max size of a GPT drive/partition is 18.8 million TB

 

[kerberos_20]

Hi kerberos_20; thanks for the reply!

Can't take screen capture shots while in the BIOS, eh? Use your cell phone to take a pic?

You have a Gigabyte board, too?

Anyway, here's a pic of my Gigabyte motherboard B450M DS3H V2 BIOS screen:

So in that pic, where you see the red-colored arrow: Windows Boot Manager (P2: Samsung SSD 850 Pro 512GB)? You're saying that that is the same thing as UEFI even though it doesn't use that word/ acronym? You mean I've been in UEFI mode all this time and didn't even know it?!

ah my bad, it means you wont know if its uefi or not

And then the yellow-colored arrow: CSM Support - Enabled. You're saying that it doesn't have to necessarily be Enabled? But if it is enabled, then "storage has to be UEFI (in CSM settings), and drive needs to be formatted as GPT drive"? How do I do that?

your storage is set to legacy only, switch it to uefi only
then boot from windows boot media and go into repair mode command line and type in mbr2gpt

And then the white-colored arrow: Anything need to be done there with Other PCI Device ROM Priority - UEFI Only?

And then in the Peripherals section of the BIOS:

So in here where the red-colored arrow is: Just Enable AMD CPU fTPM? And then I should be good for the security requirement for Windows 11?

Pez

ftpm should be enabled for win11, thats all its needed from bios security settings, hvci is not enforced yet, so ya just ftpm

 

[Pez]

Hi Colif & kerberos_20; thanks for your replies.

First off, this is weird: When I came here to my post to check on any updates and I saw your replies, as I scrolled through the message thread, the last reply that I myself put up & posted? The pictures are gone that I embedded, I can't see them anymore. I can see the text that I used to describe what's in the pics....but the pics are gone. Hmmmm....I wonder if the site that I use that hosts the pics is down....

Anyway....

Colif: I saw your sticky thread in this forum: Win 11 Requirements and what you can do to resolve problems. Nice info!!

And....in your reply up above, I almost thought you were kidding me and pulling my leg. You're saying to make some changes in the BIOS....but then exit from the BIOS but choose not to save changes? Or did I read you wrong?

Usually in the BIOS if you've made some changes, there is the option of Exit Without Saving, or, Save Changes and Exit. If I don't save the changes, reboot the computer and then enter the BIOS again, those changes should not even be there to change back since they weren't saved in the first place.

As I mentioned originally up above, I had contacted Gigabyte tech support regarding their motherboard and installing Windows 11, and all they replied with was "For Windows 11, just enable fTPM in the bios along with disabling CSM. If the OS is not configure as UEFI, it won't boot after these setting changes so you will need to boot off the Windows 11 image to perform a full OS install ". They did not mention any of the BIOS changes that you did (In Secure Boot, select custom under Secure Boot Mode, Select Restore Factory Keys, Say YES to reset without saving. When BIOS restarts, access BIOS and change Secure Boot Mode back to Standard and then Yes to restart without save ).

I haven't actually attempted what you described yet so there may be something I haven't seen yet or missed; maybe I need to put eyes on it to see what you're referring to.

kerberos_20: Yes, I can do that: In the BIOS, I can switch from Legacy Only to UEFI Only.

But "boot from windows boot media and go into repair mode command line and type in mbr2gpt "? My SSD at this moment already is GPT; is this "repair" really necessary?

And....in my original post up above, there was one other thing I asked but never got addressed; I'll Copy & Paste it here:

And one more thing: When Windows 10 came out years ago, as you probably know, as long as you had a licensed copy of Windows 7 or 8, then you were eligible for Windows 10 for free (I've had both Windows 7 and 8). With the Windows 10 OS I've had for years, I did a recent motherboard swap a month or so ago, and initially, after reconnecting everything to that new motherboard including the previous SSD with Win 10 already on it, I received that message that Windows may not be genuine and needs to be activated. But in Settings, there's a link to click on if you've made a recent hardware change (like I did with the motherboard!), and after clicking that link, I was activated again and good-to-go.

Sooooooooo.....if I perform this full, clean installation of Windows 11 on a USB drive from scratch.....will it "recognize" my system as having before had Windows 10? Will it get automatically activated? Because on previous Win 10 installation, during installation, when it comes to that part for License key, I click "Skip For Now" and then it gets automatically activated later.

Thanks!
Pez

 

[kerberos_20]

kerberos_20: Yes, I can do that: In the BIOS, I can switch from Legacy Only to UEFI Only.

But "boot from windows boot media and go into repair mode command line and type in mbr2gpt "? My SSD at this moment already is GPT; is this "repair" really necessary?

you mean you have installed windows in legacy mode on GPT drive?
can you show me picture from your disk management?
in windows, righ click start button and select disk management

 

[kerberos_20]

Sooooooooo.....if I perform this full, clean installation of Windows 11 on a USB drive from scratch.....will it "recognize" my system as having before had Windows 10? Will it get automatically activated? Because on previous Win 10 installation, during installation, when it comes to that part for License key, I click "Skip For Now" and then it gets automatically activated later.

when installing your windows 11 for firsttime (not yet activated), use key which you have for win10
once it gets synced with ms servers (with online ms account), then your free to install win11 any time later on without any key

if you update from win10 to win11, your key gets auto promoted to win11..any later fresh installs can be key skipped
i think there is some time to revert back to win10...im not sure how long that window is..but once you pass it, win10 wont recognize your key anymore (same goes for win7/8)

 

[Pez]

kerberos_20: Sheepishly, yes, I have to admit: Even I was not aware that my "C" drive's disk was GPT 😊

OK, Disk Management....and then you forgot to add, Right-click on the disk and select Properties/ Volume tab; here ya go:

Now, the other thing: Windows 10 license product key. Technically, I didn't purchase Windows 10 so I don't have a direct product key that came with it; back when I had Windows 7 (or 8), I took advantage of the free upgrade.

I still have my Windows 7 and Windows 8 keys, and I took a look at them. However, as you might be aware, there is a CMD command of "slmgr -dlv" that will reveal a partial product key, the last 5 characters. I performed this in the CMD prompt, and the last 5 characters revealed do not match the last 5 of either my Win 7 or 8 keys; weird.

Have you heard of a free program called "Belarc Advisor"? It's a program that can supposedly reveal and show you your full 25-character Windows product key. Should I give that a shot?

Pez

 

[kerberos_20]

kerberos_20: Sheepishly, yes, I have to admit: Even I was not aware that my "C" drive's disk was GPT 😊

OK, Disk Management....and then you forgot to add, Right-click on the disk and select Properties/ Volume tab; here ya go:

Now, the other thing: Windows 10 license product key. Technically, I didn't purchase Windows 10 so I don't have a direct product key that came with it; back when I had Windows 7 (or 8), I took advantage of the free upgrade.

I still have my Windows 7 and Windows 8 keys, and I took a look at them. However, as you might be aware, there is a CMD command of "slmgr -dlv" that will reveal a partial product key, the last 5 characters. I performed this in the CMD prompt, and the last 5 characters revealed do not match the last 5 of either my Win 7 or 8 keys; weird.

Have you heard of a free program called "Belarc Advisor"? It's a program that can supposedly reveal and show you your full 25-character Windows product key. Should I give that a shot?

Pez

if you did upgrade, then you dont have real win10 key, no worries, just use your win 7 key

 

[Colif]

And....in your reply up above, I almost thought you were kidding me and pulling my leg. You're saying to make some changes in the BIOS....but then exit from the BIOS but choose not to save changes? Or did I read you wrong?

Usually in the BIOS if you've made some changes, there is the option of Exit Without Saving, or, Save Changes and Exit. If I don't save the changes, reboot the computer and then enter the BIOS again, those changes should not even be there to change back since they weren't saved in the first place.

the advice I gave you is from @COLGeek who originally wrote the instructions and did the actions on his own PC.
I have a gigabyte X570 with win 11 installed and without secure boot enabled, so I haven't done those steps myself.
I assume he said not to save for a reason.