Enforcing Windows 11 TPM Check

[sjackaman]

Hi there,

I use NTLite for custom Windows 11 ISO's for my tech company. I've had a few reports now that Windows 11 has been installed on unsupported machines, leading me to believe something in my NTLite configuration is set incorrectly.

I see there are two options as shown in the screenshot - please can someone clarify what these both need to be set to in order to ensure Windows 11 isn't installed on unsupported devices (i.e. requires TPM 2.0 & Secure Boot)?

In the screenshot, this is what it is set to currently. It's possible technicians are using the checkbox in Rufus to bypass TPM checks, but I just wanted to ask just in case it is the ISO itself that is bypassing the checks.

Many thanks.

 

[garlin]

There's two sets of HW compatibility checks for a W11 install or upgrade.

• For a clean install from the ISO, the first setting disables the checks.
• For an in-place upgrade on a live system, the second setting ("- Host") disables the checks.

NTLite performs the bypasses by updating the reg values directly in the image, or on a live host (2nd setting). Rufus creates a hidden unattended file which applies the same reg values using RunSynchronous commands.

The Host bypass is ignored on a clean install, and the clean install bypass doesn't work on a live system. Two different safeguards.