WarOnPrivacy
3 months ago
Mount a Windows 11 ISO. Open an administrative command window. Navigate to the new drive letter. Enter this command:
.\setup.exe /product server /auto upgrade /EULA accept /migratedrivers all /ShowOOBE none /Compat IgnoreWarning /Telemetry Disable
I've used this to upgrade 10 to 11 on non approved hardware, going back to at least 2nd gen Intel CPUs. I've used it to upgrade existing Pro, EDU and IOT that didn't want to upgrade.The install window will say server but it isn't.
dlcarrier
3 months ago
…going back to at least 2nd gen Intel CPU.
Would that be the 4040 or the 8008?WarOnPrivacy
3 months ago
> Would that be the 4040 or the 8008?
Heh, yeah. In the moment I couldn't come up with the brief, unique descriptor and reached for the modern shorthand.
dlcarrier
3 months ago
It wasn't confusing enough that Intel named their CPU core 'Core' or that they put 'Duo' after it if there wre two 'Core' cores packaged together, but they also put a '2' after it if it was the second generation, then they dropped the generation number from the name in the third generation, making that the first generation of their new numbering scheme of which you're discussing the second generation.
The only clear option is to use the internal code name, but that's technically not valid once it's released so "Products formerly Sandy Bridge" is the best Intel can come up with. (https://www.intel.com/content/www/us/en/ark/products/codenam...)
xattt
3 months ago
Physical harm realized because boot took eternity.
moritzwarhier
3 months ago
Only if you work in a hospital. And who would be crazy enough to build hospital IT on Windo.. oh, wait.
I haven't tried Win11 on personal hardware so far, but since Win8, boot times are not much of an issue in my experience.
Making the whole OS the vehicle for a rent-seeking vendor lock-in scheme built to make you pay more and more to keep up the same set of functionality is more of a problem I think.
jonathanlydall
3 months ago
Thanks, this is great.
Just a note for others that that the language of the ISO needs to match what you used to install Windows 10.
For example, I installed Windows 10 with the "International English" ISO and if I try this with the Windows 11 "US English" ISO, then it doesn't let me do an upgrade where it keeps installed programs and drivers.
jasomill
3 months ago
Or just use Rufus[1] to create a bootable USB installer from the ISO.
Another trick that should still work, though I haven't tested it with newer Windows 11 builds: to create Windows 11 install media that will install and boot via BIOS — useful on machines where Windows doesn't work correctly under UEFI, e.g., older MacBooks that only work properly with Windows when booted via CSM — create writeable, BIOS-bootable Windows 10 x64 install media, then replace the install.wim file with one from an appropriate Windows 11 ISO.
baoluofu
3 months ago
I have an old gaming pc (i5 3570k) that I thought needed replacing since Windows 10 stopped security updates. Downloading the ISO from the Microsoft website and running this command worked a charm. Zero issues upgrading to Windows 11 and everything works exactly the same as before. Thank you!
Der_Einzige
3 months ago
Will this work on a version which is part of LTSC or IoT or whatever factory debloated version microsoft makes? As in, will the upgraded version preserve the IoT or LTSC designation and “debloatedness”?
WarOnPrivacy
3 months ago
> Will this work on a version which is part of LTSC or IoT
I've used the command with a Win11 LTSC/IoT 24H2 ISO. I upgraded Win10 LTSC/IoT 21H2 to Win11 24H2 LTSC/IoT. I've done this on two old notebooks, a Dell Core2Duo and a Thinkpad T430.
Der_Einzige
3 months ago
Can I modify the command to go from regular windows 10 to debloated windows 11? Do I just need debloated ISO for that to work automatically?
WarOnPrivacy
3 months ago
> Can I modify the command to go from regular windows 10 to debloated windows 11?
I setup a virtual Win10 edu to try and convert to Win11 LTSC/IoT. The only option setup gave me was to wipe out my apps and keep my personal files. That's what it did.
So the command doesn't offer much improvement over a wipe and a reload. Sorry I don't have better news.
WarOnPrivacy
3 months ago
I don't know yet. I've got a Win10 EDU I'm going to try to upgrade to Win11 IOT but I haven't pulled the trigger yet. It's in place doing some NAS duty atm.
The command doesn't ask any questions so there's no opportunity to tweak it. I'm getting a recovery plan in place before I pull the trigger on mine.
edit: I might also go another way. There are some other setup methods that might be a better fit for cross-upgrading Windows types. I'm actively investigating but it may be a month before I'm in a position to try them out.
uxcolumbo
3 months ago
What's the benefit of upgrading from W10 IoT to W11 IoT?
Any specific features?
W10 IoT gets support until 2032 I believe.
WarOnPrivacy
3 months ago
Mostly to see what works. In this case tho I've found some remote management on workgroup PCs works better when it's Win11->Win11 (instead of Win10->Win11).
ex: With Win10->Win11 I get a fair number of crashes when remotely viewing the event log mmc.
EvanAnderson
3 months ago
Does this work with 25H2? I haven't tried it yet.
WarOnPrivacy
3 months ago
Yes. I've done Win10 to Win11 with a 25H2 ISO. I've also used it to push 24H2 to 25H2 when WU wasn't offering the upgrade.
EvanAnderson
3 months ago
Thanks. Good to know it still works. I've got a few unsupported machines I need (ugh, not want) to do.
lax4ever
3 months ago
Schneegans.de autounattend XML files generator
seam_carver
3 months ago
Oooo, might try this with my 2011 PC.
jqpabc123
3 months ago
Windows cannot parse the provided command line options
WarOnPrivacy
3 months ago
I managed to recreated your error.
I setup a virtual Win10 edu guest in hyper-v. I mounted a Win11 LTSC/IoT iso as a drive using hyper-v tools. When I ran the command I got the same error you did.
Next. I copied the Win11 LTSC/IoT iso to a folder in the Win10 edu guest. I mounted the ISO and ran the command and didn't get the error.
It's installing now but the setup only gave an option for saving my files, not the apps. It's not great but it makes sense.
WarOnPrivacy
3 months ago
It's possible something got lost in HN's formatting.
The line should look like this: https://i.postimg.cc/VLHfF4H3/commandline.png
If it's correct, I'd like to know some specifics, if you don't mind. Current OS and ISO you're working with.
I've never had this fail and if there's an instance where it will, I'd like to know about it.
jqpabc123
3 months ago
This is correct.
Using updated Win 10 and current 25H2 iso downloaded direct from Microsoft.
The only thing that is perhaps a little unique is that this is a Win10 Home installation that was previously upgraded to Win10 Pro.
EDIT: Well, there is one more little detail. I used RUFUS to produce a bootable USB drive. Apparently, the install is checking for this somehow.
I reformatted and used WinRAR to extract the ISO to the USB drive and it is currently in the process of installing (30% complete). I'll post the final results.
WarOnPrivacy
3 months ago
I did a follow up reply to your op. I ran into your issues when the ISO was mounted as a drive outside of Windows. https://news.ycombinator.com/threads?id=WarOnPrivacy#4586361...
Mounting an ISO from within Windows seems to expose an upgrade-centric version of the installer.
jqpabc123
3 months ago
Yes, the problem seems to be using a *bootable* USB drive.
Just don't do it. Instead, simply format the drive and extract the ISO to it using WinRAR.
Then the install works as prescribed.
fuzzfactor
3 months ago
>Windows cannot parse the provided command line options
I got the same behavior on one that had W10 22H2.
But got a more descriptive error message [/product not a recognized switch].
To fix this, had to replace the setup.exe file that is now provided with the 25H2 ISO. The current setup.exe now appears to be badly lobotomized by a decision-maker who has got to be equally brainless (less-brainful?) compared to how it was before.
Using setup.exe from the 23H2 ISO seems to be a workaround for this next annoying decline in Windows 11 suitability for industrial and sensitive enterprise applications. If I said it was like the "canary in the coal mine" some would say I was exaggerating because it is too late for that and there have been earlier warning signs for years. Not much like the tweety bird who thought he saw a puddy cat, more like the chicken on the dinner table now, or a goose who is more than fully "cooked".
Going further, it's also good to prevent the "surprise" data loss, when you are using a local "account" and not on line at all, which threat only comes from Microsoft itself with their auto-bitlocker encrypting your whole drive more aggressively on new installs like never before, the result can be worse than many types of malware/ransomware. To prevent that you need to interrupt the first boot after the upgrade files are copied, and boot instead to the Recovery Console or alternatively a separate Windows install so you can do an offline Regedit creation of a new DWORD in the target Windows\System32\Config\SYSTEM hive being upgraded; adding \HKLM\system\ControlSetXXX\Control\BitLocker\PreventDeviceEncryption, then setting value=1. This needs to be done carefully and some renaming in Regedit can be involved.
Unfortunately, even if this Registry setting preventing encryption has been previously set=1 before this type upgrade, that PreventDeviceEncryption DWORD is completely removed by this setup process. Which is why I go a little further and check manually, replacing it if necessary.
Then on the second reboot, the DWORD needs replacement again, so repeat the above process :\
Allowing you to re-live the experience as only malware-type persistence can ;)
After that when you reboot back to the target volume being upgraded (rather than the alternate utility bootmedia), the W11 setup process will proceed without encrypting. Otherwise it can be very likely to encrypt everything it has access to and it's not intended to be recoverable without a Microsoft account. Even with a Microsoft account I don't trust this, seems like the opposite of "trustworthy computing" to me :\
Anyway with that in mind the command line does perform as expected and took this PC from W10 pro 22H2 to W11 pro 25H2, preserving my installed programs and files as far as I can tell. And this is on an MBR-booting PC where Windows 10 was installed to an MBR partition, using legacy CSM with UEFI disabled. No GPT, no EFI folder, none of that.
In W10, was only using the first 64GB of a HDD as NTFS, with the remainder unallocated. My Recovery folder (containing winre.wim) was intentionally the one on the same volume as Windows 10. This direct W11 upgrade created a new 750mb type 27 ("hidden" recovery) partition immediately following the 64GB. With the new 750mb containing its new Recovery folder.
If there would not have been enough unallocated space on the drive, I believe the upgrade process would have replaced the W10 winre.wim in my C:\Recovery folder with the W11 version? Not sure at this point, but C:\Recovery\WindowsRE still contains the previous W10 winre.wim, and the new recovery partition contains the W11 winre.wim.
Edit: found a recent article documenting bitlocker problems that might be related, look at the comments:
https://www.guru3d.com/story/windows-11-25h2-update-causes-u...
fukka42
3 months ago
Crazy how windows 11 objectively works fine on pretty much all hardware you'd expect but Microsoft is insisting it doesn't and we need to upgrade
RobotToaster
3 months ago
They want everyone to have neo-clipper-chip "TPM"s.
luciferin
3 months ago
My understanding is that TPM is secure, and Win 11 still supports TPM. Am I mistaken and/or misunderstanding your statement that Microsoft is enforcing a hardware requirement with a known back door?
baby_souffle
3 months ago
TPM can be secure. But secure for whom against what? Microsoft and “against you” are not implausible answers to that question…
web3-is-a-scam
3 months ago
TPM is not secure. At all. At least when when you’re using Windows.
jabwd
3 months ago
Do you also have a source thats not a youtuber? Would be far more interesting to read on apparently it being a spy chip rather than just a HSM.
tyami94
3 months ago
Here's a significantly more credible (stacksmashing) video that demonstrates how ineffective some TPM implementations are. If the TPM was integrated into the CPU die, this attack would likely not be possible. https://www.youtube.com/watch?v=wTl4vEednkQ
Despite the TPM being a pretty good and useful idea as a secure enclave for storing secrets, I'm concerned that giving companies the ability to perform attestation of your system's "integrity" will make the PC platform less open. We may be headed towards the same hellscape that we are currently experiencing with mobile devices.
Average folks aren't typically trying to run Linux or anything, so most people wouldn't even notice if secure boot became mandatory over night and you could only run Microsoft-signed kernels w/ remote attestation. Nobody noticed/intervened when the same thing happened to Android, and now you can't root your device or run custom firmware without crippling it and preventing the use of software that people expect to be able to use (i.e. banking apps, streaming services, gov apps, etc.).
Regardless, this is more of a social issue than a technical issue. Regulatory changes (lol) or mass revolt (also somewhat lol) would be effective in putting an end to this. The most realistic way would be average people boycotting companies that do this, but I highly doubt anyone normal will do that, so this may just be the hell we are doomed for unless smaller manufacturers step up to the plate to continue making open devices.
compsciphd
3 months ago
isn't the TPM integrated into the cpu die on many modern systems? i.e. AMD's PSP.
web3-is-a-scam
3 months ago
It’s not like these things aren’t publically documented by Microsoft.
You just need to be able to translate their doublespeak.
propaganja
3 months ago
A tall order, and that's if you can even find it.
nativeit
3 months ago
Apparently not.
web3-is-a-scam
3 months ago
Sure let’s just centralize hardware attestation to Microsoft’s cloud tied to a Microsoft account with keys you can’t change what could possibly go wrong?
This is all publicly documented by Microsoft you just need to translate their doublespeak.
Google is doing does the exact same thing and people were sounding the alarms when they did it but Microsoft gets a pass?
Use ChaGPT to outsource your critical thinking for you because I’m not gonna do it.
tyami94
3 months ago
I've looked into this fella before because he didn't pass the smell test. He's running a grift selling schlocky cell phones and cloud services. His videos are excessively clickbait-y and show minimal understanding of the actual tech, it's more or less concentrated disinformation and half-understood talking points. GrapheneOS devs also had something to say about him: https://discuss.grapheneos.org/d/20165-response-to-dishonest...
Brian_K_White
3 months ago
That video contains many specific statements. This comment addresses none of them.
tliltocatl
3 months ago
Secure against what threat model?
verandaguy
3 months ago
I've had to learn about TPMs to figure out if they're the right technology with which to integrate a product I've worked on. I don't agree that they're a "neo-clipper-chip" in any real way based on my exposure to them.
While I'm not a cryptographer... I never really understood the appeal of these things outside of one very well-defined threat model: namely, they're excellent if you're specifically trying to prevent someone from physically taking your hard drive, and only your hard drive, and walking out of a data centre, office, or home with it.
It also provides measured boot, and I won't downplay it, it's useful in many situations to have boot-time integrity attestation.
The technology's interesting, but as best as I can tell, it's limited through the problem of establishing a useful root-of-trust/root-of-crypt. In general:
- If you have resident code on a machine with a TPM, you can access TPM secrets with very few protections. This is typically the case for FDE keys assuming you've set your machine up for unattended boot-time disk decryption.
- You can protect the sealed data exported from a TPM, typically using a password (plus the PCR banks of a specific TPM), though the way that password is transmitted to the TPM is susceptible to bus sniffing for TPM variants which live outside the CPU. There's also the issue of securing that password, now, though. If you're in enterprise, maybe you have an HSM available to help you with that, in which case the root-of-crypt scheme you have is much more reasonable.
- The TPM does provide some niceties like a hardware RNG. I can't speak to the quality of the randomness, but as I understand it, it must pass NIST's benchmarks to be compliant with the ISO TPM spec.
What I really don't get is why this is useful for the average consumer. It doesn't meaningfully provide FDE in particular in a world where the TPM and storage may be soldered onto the same board (and thus impractical to steal as a standalone unit rather than with the TPM alongside it).
I certainly don't understand what meaningful protections it can provide to game anti-cheats (which I bring up since apparently Battlefield 6 requires a TPM regardless of the underlying Windows version). That's just silly.
Ultimately, I might be misunderstanding something about the TPM at a fundamental level. I'm not a layperson when it comes to computer security, but I'm certainly not a specialist when it comes to designing or working with TPMs, so maybe there's some glaring a-ha thing I've missed, but my takeaway is that it's a fine piece of hardware that does its job well, but its job seems too niche to be useful in many cases; its API isn't very clear (suffering, if anything, from over-documentation and over-specification), and it's less a silver bullet and more a footgun.
AnthonyMouse
3 months ago
> I never really understood the appeal of these things outside of one very well-defined threat model: namely, they're excellent if you're specifically trying to prevent someone from physically taking your hard drive, and only your hard drive, and walking out of a data centre, office, or home with it.
So basically the same thing you'd get by having an internal USB port on the system board where you could plug a thumb drive to keep the FDE key on it?
> It also provides measured boot, and I won't downplay it, it's useful in many situations to have boot-time integrity attestation.
That's the nefarious part. You get adversarial corporations trying to insist that you run their malware in order to use their service, and it's giving them a means to attempt to verify it.
Which doesn't actually work against sophisticated attackers, so the security value against real attacks is none, but it works against normies which in turn subjects the normies to the malware instead of letting someone give them an alternative to it that doesn't screw them.
propaganja
3 months ago
If I knew absolutely nothing about TPM other than the circumstances in which it was made (who, what, why, when) I would have predicted from that alone that it wouldn't benefit consumers, wouldn't be secure, and that it was motivated by business, not technology.
p_ing
3 months ago
The unsupported CPUs lack the support for Virtualization Based Security, which is a major security feature in Windows 11.
https://learn.microsoft.com/en-us/windows-hardware/design/de...
rstat1
3 months ago
VBS is also in Windows 10 and has no problem working on CPUs that aren't "supported" in Windows 11
p_ing
3 months ago
This is incorrect. Not all CPUs supported by Windows 10 supported the VBS feature.
Microsoft is making the VBS mandatory for OEMs, hence the CPU needs support, hence the ~7 year old minimum requirement for CPUs in what Microsoft supports for Windows.
Yes, you can disable it during setup as a workaround, but it's exactly that. And why you'd want to make your system less secure, well I'll leave that to the exercise of the reader when they'll turn around two weeks from now and complain about Windows security.
rstat1
3 months ago
Most of the requirements for that feature are UEFI features or a TPM, and have nothing to do with the CPU
The actual CPU requirements are VMX, SLAT, IOMMU and being 64 bit, which have all been available on the Intel side at least, since at least 2008, with some coming available even before that.
The CPU requirement was just an attempt to force people to buy new hardware they didn't need. Nothing more.
A perfect example of this is the Ryzen 5 1600. Its not officially supported but meets every single one of the requirements and had no trouble enabling the feature in the run up to the release of Win11 (before it was blocked for no reason). I know this because I did it.
Also they marked all but one 7th Intel Core CPU as unsupported, and the one they did add just so happens to be the one they were shipping in one of their Surface products. No way you can tell me this list was based fact and not the whims of some random PM when they do stuff like that.
WarOnPrivacy
3 months ago
> and why you'd want to make your system less secure,
I'd offer that the likely goal here is the most usable system possible, working with what one has. If folks are here, there's usually a lot of necessity factors in play.
adammarples
3 months ago
I have literally spent all evening trying to get this to work so I can play arc raiders. Turns out I needed to update my BIOS. So fun.
xbar
3 months ago
It is not a mandatory feature.
p_ing
3 months ago
Yes, it is mandatory for OEMs.
yard2010
3 months ago
They are lying to make money. It's a common tactic.
api
3 months ago
They might sell more Windows 11 if it ran on more hardware. How does this make them money?
It's worth asking, but I think there's an answer: they want the OS to be transformed into an interface to their cloud where recurring revenue is easier. To do that, they need to make it more like a mobile OS and more locked down. TPM helps this.
dymk
3 months ago
Dropping windows 10 support is a pretty big lever to apply pressure to get people to upgrade to 11. Oh turns out you also “need” to buy new hardware to run it.
Fabricio20
3 months ago
Dropping windows 10 support is a really reasonable decision. The focus is on 11, it's been out for almost 5 years. I'm guessing they are close to releasing 12 at this point, maybe in a year or two. Supporting three entire fully fledged oses is quite alot of work. I also understand supporting newer hardware, they dropped 32bit on 11 and moved the instruction set up a bit. You gotta do a cutoff somewhere and I'm happy that they are at least allowing us to use the improved performance our modern CPUs have. I'm not happy with alot of stuff, but I get this at least.
tyami94
3 months ago
I'd argue it's probably time to drop 32-bit x86 support, but the rest of this stuff is arbitrary and doesn't have any tangible benefit except conveniently providing hardware manufacturers with an excuse to unload new hardware onto people when there's nothing wrong with what they have. (not to mention, pardon the conspiracy theory, they're probably trying to use the TPM to turn the PC into a smartphone-like platform)
hakfoo
3 months ago
It's surprising that when we had Win7 they did that brief "XP Mode" experiment with some virtualized-penalty box.
Why didn't that go further? Presumably virtually any x86-64 box currently in circulation would be fast enough to run a VM running a full copy of 32-bit XP/Win7/Win10, or even a full carousel (or download store) of DOS and early-windows releases. It could be the most compatible Windows ever, solving the weird "64-bit systems can't run some 16-bit apps" gotcha and perhaps allowing some way to bridge in support for devices that can only be driven by old 32-bit XP drivers.
HighGoldstein
3 months ago
> They might sell more Windows 11 if it ran on more hardware. How does this make them money?
Given the free Win 7/8->10->11 upgrade path, almost every end user who'd want a Windows license probably already has one. This leaves enterprise licensing and computer manufacturers (laptops, mini-PCs, desktops), who wouldn't care about this because they'll have newer hardware anyway.
austin-cheney
3 months ago
No they will make the same money either way because they are selling the OS, not the hardware. They are requiring only newer hardware to limit their surface of exploitation and reduce their compatibility list.
Forbo
3 months ago
They also sell a license with the new hardware. The bulk majority of the public never buy hardware without an OS. So yes, they are making more money with each new hardware sale. Plus the increase of forced advertising means they make more per user, effectively double dipping.
Why do you feel the need to defend a convicted monopolist for engaging in user hostile behavior?
dymk
3 months ago
Microsoft and their OWM partners sell hardware and have done so for a very long time.
fukka42
3 months ago
[dead]