Rufus Windows 11 Guide: Best Settings, TPM Bypass and Error Fixes

What you need before you start

A USB stick of 8 GB or more. Everything on it will be erased, so copy anything you want to keep first.

A PC running Windows 8 or later to run Rufus. Version 3.22 was the last one that ran on Windows 7. Builds exist for x64, 32-bit x86 and ARM64. The portable version is the same program and doesn't install anything.

A Windows 11 ISO. Get it from Microsoft's download page, or use Rufus itself (next section). Use a 24H2 or 25H2 ISO. Older ISOs use boot files that up-to-date PCs now reject (more on that below).

Download Rufus only from rufus.ie or its GitHub releases. The file is signed: right-click it, open Properties, then Digital Signatures, and check it says Akeo Consulting.

Downloading the ISO from inside Rufus

Next to the SELECT button there's a small arrow. Click it, switch the button to DOWNLOAD, and Rufus walks you through version, release, edition, language and architecture, then fetches the ISO straight from Microsoft.

If the arrow isn't there, enable Check for updates in Rufus's settings and restart it. The download option is hidden when update checks are off, because it runs a signed script fetched from the internet. It also won't appear if Rufus couldn't reach the internet when it started.

If you downloaded the ISO yourself, check it before writing it. In PowerShell:

Get-FileHash "$env:USERPROFILE\Downloads\Win11_25H2_English_x64.iso" -Algorithm SHA256

Compare the result with the SHA-256 that Microsoft lists on the download page. A mismatch means a corrupted or tampered file. Don't use it.

The right Rufus settings for Windows 11

Rufus is still the quickest way to turn a Windows 11 ISO into a bootable USB stick, and it does one thing Microsoft's own Media Creation Tool won't: it can switch off the TPM 2.0, Secure Boot, RAM and online-account checks before setup ever runs.

The catch is that the settings matter. Pick the wrong partition scheme and the stick won't boot. Tick the wrong box and you lock yourself out of a working install. This Rufus Windows 11 guide covers the settings to use for Windows 11, what every option in Rufus's Windows User Experience dialog actually does (quoted exactly as Rufus shows them), and the fix for each error Rufus reports. It's based on Rufus 4.15 (released 30 June 2026), the 4.16 beta and Rufus's own FAQ.

Short version: Partition scheme GPT, Target system UEFI (non CSM), File system NTFS, then press START and tick the boxes you need in the Windows User Experience dialog. If the PC is older and boots in legacy BIOS mode, use MBR instead. If Rufus can't see your drive, press Alt+F.

• Device: Your USB stick. Check the size and name twice. This drive gets wiped.
• Boot selection: Disk or ISO image, then SELECT your ISO. Rufus reads the ISO and fills in sensible defaults.
• Image option: Standard Windows installation. Windows To Go runs Windows from the stick itself. That's a different job.
• Partition scheme: GPT. Windows 11 PCs boot in UEFI mode, and UEFI expects GPT.
• Target system: UEFI (non CSM). Set automatically once GPT is chosen.
• File system: NTFS. Recent Windows 11 ISOs hold a file over 4 GB, which FAT32 can't store. Rufus adds a small UEFI:NTFS boot partition so UEFI can still start it.
• Cluster size: Default. Changing it gains nothing here.

GPT or MBR for Windows 11?

Use GPT for practically every PC that can run Windows 11. Choose MBR with BIOS (or UEFI-CSM) only if the target PC is old and boots in legacy BIOS mode.

Rufus deliberately makes a Windows stick boot in one mode only: MBR plus BIOS boots in BIOS mode only, even on UEFI machines, and GPT boots in UEFI mode only. That's intentional. It stops you from installing Windows in the wrong mode by accident.

Rufus's FAQ is blunt about it: if a stick doesn't boot, the usual reason is that Target system didn't match the PC. (There is an Alt+E shortcut for dual BIOS+UEFI boot, but you shouldn't need it for a normal install.)

The Windows User Experience dialog: every option explained

The TPM and account options are no longer on the main screen. They appear in a separate dialog after you press START. If you're looking for them and can't find them, that's why. They're only offered for Windows images, and only when Rufus runs on Windows 8 or later.

• Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0: Skips Windows Setup's hardware checks. It doesn't stop Windows from using a TPM or extra RAM if the PC has them. Yes for unsupported PCs. Harmless on supported ones.
• Remove requirement for an online Microsoft account: Brings back the local-account option during setup. Only works if the network is disconnected at the account screen. Yes, if you want a local account.
• Create a local account with username:: Creates the account for you with an empty password, which you must change at first sign-in. Optional.
• Set regional options to the same values as this user's: Copies keyboard, time zone and currency from the PC running Rufus. Only if the target PC is in the same country.
• Disable data collection (Skip privacy questions): Answers "no" to the privacy and data-sharing screens automatically. Optional.
• Disable BitLocker automatic device encryption: The system disk isn't encrypted unless you ask for it later. See the warning below.
• Use 'Windows CA 2023' signed bootloaders: Writes boot files signed with Microsoft's newer 2023 certificate. Needs a 25H2 ISO and Rufus 4.10 or later. Only for PCs with updated Secure Boot certificates.

Rufus 4.14 and later also offer a "Quality of Life" option. According to Rufus's FAQ for 4.15, it removes OneDrive, Outlook and Teams, disables Copilot, Fast Startup and Start-menu ads, and tidies the Start menu and taskbar search box. It uses documented Windows settings, so it can be undone.

Recent versions also include a silent install option that erases the first disk it finds without asking. Leave that off unless you're imaging machines and have read every warning Rufus shows.

About BitLocker: skipping automatic encryption makes recovery easier if something goes wrong, and you won't be caught out by a recovery-key prompt later. But it also leaves a stolen laptop's data readable. For a laptop that leaves the house, keep encryption on and save the recovery key somewhere you can find it.

What Rufus can't bypass

The bypass option removes setup's checks. It can't make unsupported hardware supported. Since 24H2, Windows 11 needs a CPU with the PopCnt and SSE4.2 instructions. If an upgrade reports "This PC's processor doesn't support a critical feature (PopCnt)" or (SSE4.2), that's the end of the road on that machine. Rufus's author says plainly that this can't be bypassed. Most PCs from the last decade have both instructions. Very old CPUs don't.

Also keep in mind that a PC running Windows 11 below the official requirements isn't guaranteed future feature updates. Microsoft has said so from the start.

Secure Boot, "Security Violation" and the 2023 certificate

This is the part that changed most in 2025-26, and it trips people up. Three things to know:

You don't normally need to disable Secure Boot. Since Rufus 3.17 the UEFI:NTFS boot loader is Secure Boot signed. On some PCs you may need to enable Allow Microsoft 3rd Party UEFI CA (wording varies) in the firmware settings, because that loader isn't signed with Microsoft's own Windows key.

Old ISOs now fail on up-to-date PCs. Microsoft's Windows boot loaders from before 24H2 had vulnerabilities that let attackers get past Secure Boot, and fully updated PCs revoke them. Rufus warns with "Revoked UEFI bootloader detected", and booting such a stick gives a "Security Violation" screen. The fix is a current 24H2 or 25H2 ISO, not disabling Secure Boot.

The 2011 certificate is being retired. Microsoft's original Windows boot signing certificate (PCA 2011) expired in October 2026. A PC whose firmware has been updated to trust only the newer Windows UEFI CA 2023 will refuse ordinary installation media. For those PCs, tick Use 'Windows CA 2023' signed bootloaders with a 25H2 ISO. 24H2 ISOs won't work for this. Don't tick it for a PC that hasn't been updated, or the stick won't boot there.

If you use several ISOs on one stick instead, Ventoy has its own set of Secure Boot problems and fixes. See Ventoy not booting Windows 11 for that side.

Rufus errors and how to fix them

Rufus doesn't detect the USB drive

Rufus hides USB hard drives and SSD enclosures by default, so you can't wipe a backup drive by mistake. To show them, open Show advanced drive properties and tick List USB Hard Drives, or just press Alt+F.

If the drive still doesn't appear, open the log (the small button left of START, or Ctrl+L). A line saying "Device Number for device ... is too big" means more than 64 physical or virtual drives are mounted. The Xbox PC app is a known cause, because it leaves hidden virtual drives behind. A reboot usually clears it.

Error [0x00000005] Access is denied

Something outside Rufus is holding the drive open. Rufus 2.15 and later try to name the culprit in the log, for example:

Could not lock access to \\?\Volume{...}: [0x00000005] Access is denied.
WARNING: The following process(es) or service(s) are accessing \Device\HarddiskVolume9:
o 'C:\Windows\System32\cmd.exe' (pid: 13124, access: x)

Close whatever it names: a File Explorer window on the stick, a command prompt, a backup or antivirus tool. If Controlled Folder Access is on in Windows Security, turn it off while Rufus runs. As a last resort, Alt+, tells Rufus not to request exclusive access. Finding the program that holds the drive is the better fix.

The "device is in use by another process" message has the same cause and the same fix.

Error [0x00000015] The device is not ready

First check whether Windows itself can format the drive with diskpart. If that fails too, the problem isn't Rufus.

If it fails early and you've disabled automounting, run this in an administrator command prompt, then retry:

mountvol /e

If it fails halfway through copying files, suspect the connection. USB 3.0 sticks on extension cables or loose front-panel ports drop out briefly. Plug straight into a port on the back of the PC.

Drive is read-only, write-protected or "contains no media"

Usually the flash memory has worn out, and the controller has switched to read-only to protect it. Replace the stick.

The exception is a work PC with a strict BitLocker policy that makes any unencrypted drive read-only. On a home PC, check the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies: if it exists and has a WriteProtect value, that value should be 0. Edit it at your own risk. If the key isn't there, the cause is the drive.

Error while partitioning drive / Undetermined error while formatting

"Error while partitioning drive" is a general message. The real cause is in the log, and it's usually one of the errors above. "Undetermined error while formatting" usually means Windows itself can't format that device with that file system. Confirm by right-clicking the drive in File Explorer and choosing Format. If Windows fails too, try another stick.

"ERROR: BIOS/LEGACY BOOT OF UEFI-ONLY MEDIA"

You made a GPT/UEFI stick and the PC tried to boot it in legacy mode. Either disable CSM/Legacy boot in the firmware settings, or recreate the stick with Partition scheme MBR and Target system BIOS.

The stick boots but setup says the PC doesn't meet requirements

You either didn't tick the first option in the Windows User Experience dialog, or you're running an in-place upgrade from inside Windows. For upgrades, run setup.exe from the Rufus stick. Rufus 4.6 and later add a wrapper that applies the bypass to 24H2 in-place upgrades too. The PopCnt/SSE4.2 check still applies.

Rufus vs Ventoy vs the Media Creation Tool

• Media Creation Tool: A plain, supported Windows 11 installer. No bypasses TPM / account checks.
• Rufus: One Windows (or Linux) installer, with customisation. Yes, via the Windows User Experience dialog.
• Ventoy: Several ISOs on one stick, added by copying files. Yes, by default for standard Windows 11 ISOs.

For a single Windows 11 install, Rufus is the safer choice: it writes the image properly and tells you when something is wrong. If you carry a toolkit of installers and rescue disks, Ventoy wins. Its common failures are covered in the Ventoy Windows 11 fix guide.

Is Rufus safe?

Yes, from the official sources. Rufus is open source (GPLv3), signed by Akeo Consulting, and has been maintained by the same developer for over a decade. The risk is copycat download sites that bundle extra software. Use rufus.ie or GitHub only.

Some antivirus tools flag it because it writes directly to disks. That's expected for a tool of this kind. Check the signature rather than trusting the alert or ignoring it.

If you're setting up a batch of machines for a small office and want it done properly, or need a website built or fixed, that's the work I do. See how to hire me.

FAQ

What are the best Rufus settings for Windows 11? Partition scheme GPT, Target system UEFI (non CSM), File system NTFS, Image option Standard Windows installation, default cluster size. Use MBR with BIOS (or UEFI-CSM) only for an old PC that boots in legacy BIOS mode.

Should I use GPT or MBR in Rufus for Windows 11? GPT. Windows 11 PCs boot in UEFI mode, which expects GPT. Rufus makes MBR sticks boot in BIOS mode only and GPT sticks in UEFI mode only, so choose the one that matches how the target PC boots.

How do I bypass TPM 2.0 with Rufus? Select a Windows 11 ISO, press START, and in the Windows User Experience dialog tick 'Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0'. Since 24H2 the CPU must still support PopCnt and SSE4.2; that check cannot be bypassed.

Where is the Microsoft account bypass option in Rufus? It appears after you press START, in the Windows User Experience dialog: 'Remove requirement for an online Microsoft account'. For it to work, disconnect the network before setup re