Create a Bootable Windows 11 USB and Install Windows 11

The Windows 11 ISO Microsoft serves today is 9 GB, so the 8 GB stick most older guides still recommend no longer fits it. Its install.wim alone is 8.2 GB, which is also why a plain FAT32 copy fails halfway and why every working tool either formats the stick as NTFS or splits that file. With the right tool and a 16 GB stick, your bootable Windows 11 USB takes 2 to 10 minutes to write.

Original content from computingforgeeks.com - post 600

You’ll find Rufus and the Media Creation Tool for Windows, WoeUSB-ng and wimlib for Linux, and the Mac route, then you install Windows 11 from USB past the account screen and the TPM check. We wrote the 26H2 ISO (build 26300.9457) with Rufus 4.15, WoeUSB-ng 0.2.12 and wimlib 1.14.5 on Ubuntu 26.04, tried Ventoy 1.1.18, and tested the installs on UEFI VMs with and without TPM 2.0 in October 2026.

Pick a method for the computer you have

The computer you make the stick on decides the tool, not the PC you install on. Every method gives you the same installer, so pick by what’s on your desk:

• Windows PC: Rufus
• Windows PC, no third-party software: Media Creation Tool
• Linux: WoeUSB-ng, or a FAT32 stick split with wimlib
• Mac: diskutil for FAT32, then wimlib from Homebrew

Rufus is our pick on Windows because it reads the ISO, sets GPT, UEFI and NTFS for you, and can remove the TPM check and create a local account. The Media Creation Tool fits on 8 GB because it downloads a compressed image, but it has no bypass options. On Linux, WoeUSB-ng is one command, while the FAT32 route avoids running a 2023-era tool as root.

Ventoy is missing from that list on purpose. It installed and booted fine on our test VM, but on that VM it would not start the 26H2 ISO in either of its boot modes. The Linux section has the details, and the table below is what each method did on the machines we tested:

Method	Stick layout it wrote	Write time	Booted with Secure Boot on	Removes TPM check
Rufus (Windows)	GPT, NTFS + 1 MB UEFI:NTFS	About 10 min	Not tested (booted with Secure Boot off)	Yes, checkbox
WoeUSB-ng (Linux)	MBR, NTFS + 1 MB UEFI:NTFS	2 min 26 s	Yes	No
FAT32 + wimlib split (Linux)	GPT, one FAT32 partition	1 min 45 s for the split	Not tested (booted with Secure Boot off)	No
Ventoy (Linux)	MBR, exFAT + VTOYEFI	33 s to copy the ISO	Menu yes, Windows no (on our VM)	No

Your write time depends on the stick far more than on the tool. The Linux numbers come from virtual disks on fast ZFS storage, while Rufus wrote through an emulated USB port, which is why it looks slowest here. A cheap USB 2.0 stick will be slower than all of them, and a good USB 3 drive lands in between.

Prerequisites

Microsoft’s Windows 11 system requirements ask for a 64-bit CPU of 1 GHz or faster with 2 or more cores that is on the approved CPU list. The PC also needs Secure Boot capable UEFI firmware, TPM 2.0, 4 GB of RAM and 64 GB of storage. The stick itself is the part people get wrong, because the ISO grew past the size older guides were written for:

• A 16 GB or larger USB stick. The 26H2 ISO is 9,047,330,816 bytes and the finished stick used 8.5 GB
• About 9 GB of free disk space for the ISO download
• Admin rights on the computer that writes the stick (Rufus and sudo on Linux)
• The target PC’s boot menu key, listed further down

You lose everything on the stick. A cheap 16 GB stick works. Its write speed decides how long creating the stick takes, and its read speed decides how long setup spends pulling the 8.2 GB image back off it, so a USB 3 stick helps on both. If you’re buying one anyway, see our picks for reliable USB flash drives.

Download the Windows 11 ISO and verify it

Get the ISO from Microsoft’s Windows 11 download page. Scroll to Download Windows 11 Disk Image (ISO) for x64 devices, pick Windows 11 (multi-edition ISO for x64 devices) and click Download Now, choose the language and click Confirm, then click 64-bit Download. The link works for 24 hours. The same page lists the current release in its header (Windows 11 2026 Update, version 26H2 when we downloaded) and carries a Verify your download table with the SHA-256 of every language.

Check the hash before you write anything, because a truncated download still mounts and only fails once you are halfway through setup. On Linux, compute it with sha256sum:

sha256sum ~/Downloads/Windows11_Client_x64_en-us_26300_9457.iso

Your value must match the row for your language in the table on that page. Ours matched the English 64-bit entry, BD4307DF...55EA650, character for character, and took 57 seconds to compute on the 9 GB file:

bd4307df32bc8af33b39ccecb1174aeb345386630f89a2b86c7a4e36b55ea650  Windows11_Client_x64_en-us_26300_9457.iso

The terminal capture below shows the size and hash next to the value Microsoft publishes. A mismatch means a broken or tampered download, so delete the file and fetch it again rather than writing it:

On Windows, run Get-FileHash .\Windows11_Client_x64_en-us_26300_9457.iso in PowerShell, the method the download page describes. On a Mac the command is shasum -a 256 followed by the file name. We only ran the Linux check, but all three give you the same SHA-256 for the same file.

Create a bootable Windows 11 USB with Rufus

Rufus is the fastest route on Windows and the only one that bakes the TPM bypass and a local account into the stick. Download the latest release from rufus.ie (the portable build needs no install), plug in the stick and run it as an administrator. We pointed Rufus at the 26H2 ISO, and it filled in every setting by itself:

• Image option: Standard Windows installation
• Partition scheme GPT, target system UEFI (non CSM)
• File system NTFS, cluster size 4096 bytes
• Volume label CCCOMA_X64FRE_EN-US_DV9, copied from the ISO

You can leave all of them alone. NTFS is there because install.wim is over the FAT32 4 GB limit, and the only reason to change the target system is a PC that boots legacy BIOS only, which Windows 11 does not support anyway. The main window looked like this once the ISO was selected:

Rufus does not list external hard drives or SSDs by default, so a USB SSD will not appear in Device until you press Alt+F or tick List USB Hard Drives under advanced drive properties. A normal flash drive shows up straight away.

Click START and Rufus opens the Windows User Experience dialog. These options are why most people pick Rufus over the Media Creation Tool, because they’re written into the stick, not applied after Windows is installed:

The first two boxes were ticked by default. We also ticked Create a local account with username and typed a name. Rufus offers nine options here, including turning off BitLocker’s automatic device encryption and using bootloaders signed with the Windows UEFI CA 2023, which only boot on PCs whose firmware already trusts that certificate. Leave that last one off unless you know your firmware has the 2023 keys.

The options land in two places on the finished stick. Rufus writes the three LabConfig bypass values straight into the registry inside boot.wim, which is the setup environment that runs the hardware check, so boot.wim on the stick is larger than the one in the ISO. It also writes sources\$OEM$\$$\Panther\unattend.xml, which Windows setup copies to the new install. That file sets the BypassNRO registry value and creates the local account with an empty password that must be changed at first sign-in. It also lists the same LabConfig commands, but under a pass named disabled, so they never run from there.

Confirm the data-loss warning and wait. The 9 GB write took about 10 minutes through our VM’s emulated USB port, and you get a green READY bar when it’s done:

The stick ends up with an NTFS partition labelled with the ISO name and a 1 MB FAT partition called RUFUS_BOOT. That small partition holds UEFI:NTFS, the signed loader that lets UEFI firmware, which cannot read NTFS itself, start Windows setup from the NTFS partition. With Secure Boot on, some PCs, Secured-core laptops among them, only boot it after you enable the Microsoft 3rd party UEFI CA option in the firmware (the wording varies by vendor), as the Rufus FAQ notes.

Use the Media Creation Tool instead

The Media Creation Tool is Microsoft’s own option and the right pick if you do not want third-party software on a work machine. It downloads Windows straight to the stick in a compressed format, which is why Microsoft still says 8 GB is enough for it. We did not run it, because it needs a Windows client, so these steps come from Microsoft’s download page:

1. Under Create Windows 11 Installation Media on the download page, click Download Now and run the tool as an administrator
2. Accept the license terms, then on What do you want to do? select Create installation media for another PC
3. Select the language, edition and architecture (64-bit), then choose USB flash drive
4. Select the stick and let it download and write

It gives you no TPM or Microsoft account options, so on unsupported hardware you’d use the registry bypass described further down.

Create a bootable Windows 11 USB on Linux

On Ubuntu 26.04 we got a stick that boots with Secure Boot on from WoeUSB-ng, and a working FAT32 stick from nothing more than parted and wimlib. Both start the same way: find the stick’s device name, because both write to the whole disk and a wrong name wipes the wrong drive. Plug the stick in and list the disks:

lsblk

A real USB stick shows 1 in the RM (removable) column and a size that matches the stick, usually as /dev/sdb or /dev/sdc. Our lab stick was a 16 GB virtual disk, so it showed up as vdb with RM at 0, next to the ISO we had mounted on loop0:

NAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
loop0     7:0    0  8.4G  1 loop /mnt/win11
sr0      11:0    1    4M  0 rom
vda     253:0    0   60G  0 disk
├─vda1  253:1    0 58.9G  0 part /
├─vda13 253:13   0 1023M  0 part /boot
├─vda14 253:14   0    4M  0 part
└─vda15 253:15   0  106M  0 part /boot/efi
vdb     253:16   0   16G  0 disk 

Set two shell variables so the commands below run as written. Change both to your own ISO path and stick, and check the stick name twice, because it is the only value in this section that can destroy data:

export ISO_PATH=~/Downloads/Windows11_Client_x64_en-us_26300_9457.iso
export USB_DEV=/dev/sdb
lsblk -o NAME,SIZE,RM,TRAN,MODEL "${USB_DEV}" && ls -lh "${ISO_PATH}"

Both commands must print something, and the TRAN column for your stick must read usb. If it shows sata or nvme, the variable points at an internal disk, so stop and fix it before any wipe. An error means a typo in a path.

Write the stick with WoeUSB-ng

WoeUSB-ng is the quickest Linux method, but know what you’re installing: its last release came out in February 2023, and the repository has only seen small packaging fixes since. It still works on Ubuntu 26.04, it just needs a different install command from the one in its README. Install the dependencies first:

sudo apt update
sudo apt install -y git p7zip-full python3-pip python3-wxgtk4.0 grub2-common grub-pc-bin parted dosfstools ntfs-3g pipx

The README then says sudo pip3 install WoeUSB-ng, which Ubuntu 26.04 refuses with error: externally-managed-environment because the system Python is managed by apt. Install it with pipx instead. --global puts the woeusb command where sudo can find it, and --system-site-packages reuses the wxPython package apt just installed instead of compiling it:

sudo pipx install --global --system-site-packages WoeUSB-ng

That took 15 seconds on our builder. Confirm the version you got:

woeusb --version

It reports the 2023 release:

0.2.12

Unmount anything the desktop auto-mounted from the stick, then write the ISO. Ask for NTFS explicitly, since FAT32 cannot hold the 8.2 GB install.wim:

sudo umount ${USB_DEV}?* 2>/dev/null
sudo woeusb --device "${ISO_PATH}" "${USB_DEV}" --target-filesystem NTFS

The write took 2 minutes 26 seconds and ends with these lines:

Installing GRUB bootloader for legacy PC booting support...
Installing custom GRUB config for legacy PC booting...
You may now safely detach the target device
Done :)
The target device should be bootable now

If you leave the default FAT target, WoeUSB-ng notices the oversized file and switches to NTFS on its own, as our first run shows. It also creates a 1 MB second partition holding the same UEFI:NTFS loader Rufus uses, downloaded from Rufus’s GitHub repository during the write, so the builder needs internet access:

Two side effects caught us out. WoeUSB-ng unmounts any loop mount of the source ISO before it starts, so if you mounted the ISO yourself, mount it again afterwards. And the stick uses an MBR partition table, which UEFI firmware boots without complaint; our VM, whose firmware trusts the Microsoft 3rd party UEFI CA, started Windows setup from it with Secure Boot and TPM 2.0 enabled.

Write a FAT32 stick and split install.wim

This route needs no third-party USB tool, only packages from the Ubuntu archive, and it is the same method the macOS section uses. FAT32 is the one file system every UEFI firmware can read, so the stick boots without the UEFI:NTFS helper. The catch is that FAT32 stops at 4 GB per file. Install the tools:

sudo apt install -y wimtools rsync dosfstools parted

Unmount anything the desktop auto-mounted from the stick, or wipefs stops with a busy device, then partition it as GPT with one FAT32 partition. On an NVMe-style device name the partition is ${USB_DEV}p1 instead of ${USB_DEV}1:

sudo umount ${USB_DEV}?* 2>/dev/null
sudo wipefs -a "${USB_DEV}"
sudo parted --script "${USB_DEV}" mklabel gpt mkpart WINUSB fat32 1MiB 100% set 1 msftdata on
sudo mkfs.vfat -F 32 -n WINUSB "${USB_DEV}1"

Mount the ISO and the stick, then copy everything except install.wim:

sudo mkdir -p /mnt/win11 /mnt/usb
sudo mount -o loop,ro "${ISO_PATH}" /mnt/win11
sudo mount "${USB_DEV}1" /mnt/usb
sudo rsync -r --exclude=sources/install.wim /mnt/win11/ /mnt/usb/

If you copy install.wim anyway, cp writes exactly 4,294,967,295 bytes and stops with cp: error writing '/mnt/usb/sources/install.wim': File too large. Split it into pieces under 4 GB instead. The 3800 is the maximum part size in MiB:

sudo wimlib-imagex split /mnt/win11/sources/install.wim /mnt/usb/sources/install.swm 3800

wimlib wrote three parts in 1 minute 45 seconds. Windows setup picks up the numbered .swm parts on its own, and in our test it listed every edition from them:

Flush the writes and unmount both before you pull your stick:

sync
sudo umount /mnt/usb /mnt/win11

We booted this stick on a VM with Secure Boot turned off, and it reached the Windows 11 edition picker from the split image. The files on it are Microsoft’s own signed boot files, so Secure Boot should accept it too, but we did not run that combination.

Why we did not lead with Ventoy

Ventoy is the tool we’d normally recommend for Linux users, because you copy ISOs onto the stick and pick one from a menu, as our Ventoy guide for Linux ISOs shows. It installed in seconds, and the 9 GB ISO copied in 33 seconds. With Secure Boot on, the first boot stopped at Verification failed: (0x1A) Security Violation until we enrolled Ventoy’s key through MokManager, after which the Ventoy menu came up normally.

On our VM, booting the 26H2 ISO from that menu failed every time. Boot in normal mode printed error: cannot load image and error: you need to load the kernel first, and Boot in wimboot mode ended at a Windows Boot Manager screen with status 0xc000000f. Normal mode failed the same way with Secure Boot disabled and with the stick attached as a SATA disk instead of USB, so on this VM it was not the key enrollment or the virtual USB controller:

That is one QEMU virtual machine with OVMF firmware, not every PC. Ventoy’s maintainer says a default Ventoy install boots 26H2 setup fine, and a 26H2 report in its tracker came from a stick whose VTOYEFI partition type had been changed by hand. If Ventoy already works on your PC, it is worth a try; if it fails the way it did for us, write the ISO with WoeUSB-ng or the FAT32 method instead.

Create a bootable Windows 11 USB on a Mac

macOS has no built-in tool for writing a Windows installer stick, so the Mac route is the FAT32 method above with macOS commands. We did not test it on a Mac, but the steps match what we ran on Linux, and the ISO’s volume name and file sizes are the ones we measured. Find the stick’s disk number first:

diskutil list

Erase it as FAT32 with a GPT map. Replace disk4 with your stick’s identifier, because eraseDisk does not ask twice:

diskutil eraseDisk MS-DOS WINUSB GPT /dev/disk4

Double-click the ISO in Finder to mount it. It mounts as CCCOMA_X64FRE_EN-US_DV9, the volume label inside the 26H2 ISO. Copy everything except install.wim:

rsync -avh --progress --exclude=sources/install.wim /Volumes/CCCOMA_X64FRE_EN-US_DV9/ /Volumes/WINUSB/

Install wimlib from Homebrew, then split the image onto the stick:

brew install wimlib
wimlib-imagex split /Volumes/CCCOMA_X64FRE_EN-US_DV9/sources/install.wim /Volumes/WINUSB/sources/install.swm 3800

Eject the stick from Finder when the split finishes. The older bootable USB guide for Linux and macOS covers dd for Linux ISOs; for Windows, stick with the file-copy method above.

Boot the PC from the USB stick

Plug the stick into the target PC, power it on and tap the one-time boot menu key as soon as the maker’s logo appears. These are the usual keys, though some models differ:

Manufacturer	Boot menu key
Dell	F12
HP	F9 or Esc
Lenovo	F12 or Fn+F12
ASUS	F8 or Esc
Acer	F12 (enable it in BIOS first)
MSI	F11
Gigabyte	F12

Pick the entry that starts with UEFI and names your stick. Our firmware listed it as a USB hard drive next to the empty internal disk:

If the stick does not appear at all, enter firmware setup (usually F2 or Del) and make sure boot mode is UEFI, not Legacy or CSM. Disconnect any other drive that already has Windows on it, too. On our second install, the old drive’s Windows Boot Manager entry came first in the boot order. The first reboot of setup started the old Windows instead of finishing the new one, and setup only resumed once we detached that drive.

Install Windows 11 from USB

Setup starts with the language and keyboard screens. Pick yours and click Next twice to reach the screen where you choose what to do:

Since 24H2, setup no longer shows the old Upgrade or Custom choice when it boots from a stick. You get Install Windows 11 or Repair my PC, and Next stays greyed out until you tick the box agreeing that everything on the target disk is deleted. The Previous Version of Setup link at the bottom brings back the old wizard if a guide you’re following expects it:

On the product key screen, enter your key or click I don’t have a product key. A PC that ran an activated Windows 10 or 11 before reactivates from its digital license once it’s online, as long as you install the same edition. The edition list follows; the multi-edition ISO carries Home, Education, Pro and their N variants, and we picked Pro:

After the license terms comes Select location to install Windows 11. Your stick shows up in this list too, so read the sizes before you click anything. Our 64 GB target disk was Disk 0 and the WoeUSB-ng stick was Disk 1, with its 1 MB UEFI:NTFS partition labelled RUFUS_BOOT:

Select the unallocated space and click Next. Setup creates the EFI, MSR and Windows partitions itself. On a disk that already has partitions, delete only the ones that belong to the old Windows. If you plan to dual boot Fedora and Windows 11, or Rocky Linux or AlmaLinux next to Windows, leave the Linux partitions alone and install Windows first. If a disk you know is there is missing from the list, Windows has no inbox driver for its controller. In a KVM or Proxmox VM that’s the virtio controller, and loading the virtio drivers through Load Driver fixes it.

Click Install on the summary screen. The file copy phase took close to half an hour on our VMs before the first reboot. Our stick sat on an emulated USB port that is slower than a real one, so expect a physical PC with a USB 3 stick to finish sooner. Leave the stick in until you see the region screen.

Get past the Microsoft account screen

The first-run setup, called OOBE, expects an internet connection and a Microsoft account. On our 26H2 Pro install with a network cable connected, setup first offered to download updates, with an Update later option on screen. A command prompt opened afterwards reported build 26300.9711, the October 2026 update listed on Microsoft’s Windows 11 release information page. Then the personal-use path offered only Sign in:

With the network removed, the old I don’t have internet link was not there either. The network page offered only Install driver, and Next stayed disabled:

This is deliberate. In the October 2025 Insider build announcement, Microsoft said it is “removing known mechanisms for creating a local account in the Windows Setup experience (OOBE)”. Here is where each route to a local account stood on the build we installed:

• Rufus local account option: worked, no Microsoft account page at all
• BypassNRO registry value: still honoured, it brings back the offline link
• oobe\bypassnro script: still ships in the image, not run by us
• start ms-cxh:localonly: not verified on this build

The Rufus stick is where we saw the difference. Its unattend.xml sets the same BypassNRO value the old script sets, and on that install, with no working network adapter, the network page offered I don’t have internet again. Setup then skipped the account pages, because the unattend file had already created the local account:

We also read BypassNRO.cmd straight out of install.wim with wimlib-imagex extract: it still adds that registry value and reboots. Shift+F10 opened a command prompt during OOBE on our second VM, but our VM console could not send keystrokes into it, so we never ran the script itself on 26H2.

If you need a local account without signing in at all, use the Rufus option, because it is the route we saw work end to end. Keep the PC offline when OOBE reaches the network page, as the Rufus FAQ says the Microsoft account bypass only applies when setup cannot reach the internet; our working install had no network adapter at that point. Copying the same sources\$OEM$\$$\Panther\unattend.xml onto a Linux-made stick should give you BypassNRO and the local account, but not the TPM, Secure Boot or RAM bypass, which Rufus puts in boot.wim. We only tested it on the Rufus stick.

Install Windows 11 on a PC without TPM 2.0

Setup checks for TPM 2.0, Secure Boot capability and 4 GB of RAM right after you pick an edition. Booted from a plain stick on a VM with no TPM, our 26H2 setup stopped with this screen and only offered Back or Close:

Microsoft is blunt about what you give up. Its support article on unsupported hardware says such a PC “will no longer be supported and won’t be entitled to receive updates”. The install still worked for us, but plan for the possibility that a future update refuses it, and keep a backup.

With a Rufus stick, the check never appears. Ours, written with the TPM and Microsoft account boxes ticked, went straight from the edition picker to the license terms on the no-TPM VM, and finished at a desktop signed in as the local account. On that desktop tpmtool getdeviceinformation failed with 0x800710df - The device is not ready for use, which is what a PC with no TPM returns, and winver showed the build:

That is Version 26H2, OS Build 26300.9457, running with no TPM at all. With any other stick, the check stops you, so open a command prompt on the error screen with Shift+F10 and add the three LabConfig values:

reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f

Each command answers The operation completed successfully. Close the prompt and click Back. Setup re-ran the check, passed it, and moved on to the license terms and the disk list. The prompt’s header shows something easy to miss: the setup environment on the 26H2 ISO reports version 10.0.26100.9457, so it is the 24H2-era Windows PE that runs these checks:

The values live only in the setup environment’s registry, so you add them again each time you boot your stick. They do not change anything on the installed system.

Finish the first boot

A fresh install from USB is not done at the first desktop. Windows ships inbox drivers for most hardware but not for everything, and the ISO is a few weeks behind the latest cumulative update, so run through these before you put the PC to work:

• Device Manager: any device with a yellow warning needs a driver from the PC or board maker
• Settings > Windows Update > Check for updates, then restart
• Settings > System > Activation: confirm the edition and license state
• Recovery Drive app: build a recovery stick on a second USB drive

Install chipset, graphics and network drivers from the manufacturer’s support page rather than a driver-updater tool. If the activation page says Windows is not activated on a PC that ran an activated copy before, connect to the internet and give it a few minutes. A digital license tied to the hardware activates the same edition on its own. Keep the installer stick as well; it is the quickest way back into setup or Repair my PC if the new install stops booting.

Fix Windows 11 USB boot and setup errors

These are the errors we hit while building and booting the sticks, with the fix that worked for each, so you can match yours by the exact message.

cp: error writing ‘install.wim’: File too large

FAT32 holds files up to 4 GB minus one byte, and the 26H2 install.wim is 8,155,984,950 bytes. Delete the partial file and split the image with wimlib-imagex split ... install.swm 3800, or format the stick as NTFS with Rufus or WoeUSB-ng, which add the UEFI:NTFS loader so UEFI firmware can still boot it.

error: externally-managed-environment

This is sudo pip3 install WoeUSB-ng on Ubuntu 26.04, which protects its system Python under PEP 668. Do not force it with --break-system-packages; install with sudo pipx install --global --system-site-packages WoeUSB-ng as shown above.

Verification failed: (0x1A) Security Violation

We saw this when booting a Ventoy stick with Secure Boot on, before the Ventoy menu ever appeared. The firmware rejects Ventoy’s bootloader until its key is enrolled:

Press Enter, then any key at the MokManager prompt, choose Enroll key from disk, open the VTOYEFI volume, select ENROLL_THIS_KEY_IN_MOKMANAGER.cer, confirm with Continue and Yes, then reboot. It’s a one-time step per PC. Our WoeUSB-ng stick booted with Secure Boot on without this step, since its UEFI:NTFS loader is signed, and the Rufus FAQ says the same of current Rufus releases. If a Rufus or WoeUSB-ng stick is rejected with Secure Boot on, enable the Microsoft 3rd party UEFI CA option in the firmware (the wording varies by vendor) instead of turning Secure Boot off.

error: cannot load image, or 0xc000000f from Ventoy

Both came from Ventoy with the Windows 11 26H2 ISO on our OVMF test VM, in normal and wimboot mode respectively, and normal mode failed the same way with Secure Boot off. The maintainer reports that a default Ventoy install boots 26H2 setup, so this may be specific to our firmware. We did not find a Ventoy setting that fixed it, so write that ISO to its own stick with WoeUSB-ng, the FAT32 method or Rufus instead.

This PC doesn’t currently meet Windows 11 system requirements

The PC lacks TPM 2.0, Secure Boot capability or enough RAM. Check the firmware settings for a disabled TPM option first, often labelled Intel PTT or AMD fTPM. If the hardware really lacks it, use a Rufus stick with the first box ticked or the LabConfig values above, and accept the update caveat. For a PC that later fails to boot into Windows at all, our notes on fixing a missing Windows recovery environment cover rebuilding WinRE.

For a Windows 11 VM rather than a physical PC, our Windows 11 on KVM with virt-manager guide covers the emulated TPM and Secure Boot firmware that make the requirement screen go away without any bypass.