# Clean install Windows 11 26H2: UEFI, TPM 2.0 and partitions

> Install Windows 11 26H2 from official media: check UEFI, TPM 2.0 and Secure Boot, create the USB, partition the disk, finish OOBE and verify build 26300.9457.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E2
- Risk: R2
- Verified: 2026-10-28
- Test machine: PVE 9.2.2 VM 361; Windows 11 Pro 26H2 26300.9457; UEFI + Secure Boot + vTPM 2.0; 8GB/4 vCPU; SATA install path

msinfo32 on VM 361: Windows 11 Pro, build 26300, UEFI, Secure Boot On. Click to open full size.

## The short answer

A clean install is four things in the right order: **official 26H2 media**, **UEFI firmware with TPM 2.0 and Secure Boot**, **the installer’s own partition layout**, and **drivers after first boot**. If the machine is supported, do not use a “TPM bypass” or a modified ISO. Fix the firmware instead.

> **Danger: This wipes the system disk**
>
> A clean install removes the old Windows installation and every partition you delete. Back up files, export BitLocker recovery keys, and write down the Microsoft account and product key before you boot the USB.

## Before you start

| Item | Minimum | Check |
|---|---|---|
| Firmware | UEFI, 64-bit | BIOS mode is UEFI, CSM/legacy off |
| Security | TPM 2.0, Secure Boot capable | `tpm.msc`, `msinfo32` |
| CPU / RAM | 64-bit CPU, 4GB RAM | 26H2 supported CPU list |
| Disk | 64GB or larger | Free space after backup |
| USB | 8GB or larger | It will be erased |
| Network | Ethernet or known-good Wi-Fi driver | Have the driver on a second USB if Wi-Fi is missing |
| Licence | Windows 11 key or digital licence | Linked to your Microsoft account |

Windows 11 26H2 is a client release. This page does **not** cover Windows Server, ARM64, or an in-place upgrade from 25H2/24H2. Those are separate paths.

## Step 1 — Get the official ISO and verify it

Download from Microsoft’s [Download Windows 11](https://www.microsoft.com/software-download/windows11) page, not from an “optimized” or “LTSC” mirror. The 26H2 consumer ISO contains Home, Pro and Education images; Setup asks which one to install.

The lab image used here:

```text
Windows11_Client_x64_en-us_26300_9457.iso
SHA-256: BD4307DF32BC8AF33B39CCECB1174AEB345386630F89A2B86C7A4E36B55EA650
```

Verify it before writing the USB:

```powershell
Get-FileHash .\Windows11_Client_x64_en-us_26300_9457.iso -Algorithm SHA256
```

> **Note: Hash scope**
>
> The hash above is the English 26H2 image verified in this lab; it matched the published English 26H2 hash at test time. Other languages and future refreshes have different hashes. Always use the hash Microsoft shows for the file you actually downloaded.

## Step 2 — Make the USB

Use one of these, in order of preference:

1. **Media Creation Tool** from the same Microsoft page. It downloads 26H2 and writes a UEFI-bootable USB.
2. **Rufus 4.x** with the official ISO: partition scheme **GPT**, target **UEFI (non-CSM)**, file system default.
3. **Ventoy**: copy the ISO to the Ventoy partition; boot the ISO in UEFI mode.

> **Caution: Do not tick the bypass options on supported hardware**
>
> Rufus may offer to remove the 4GB RAM, Secure Boot and TPM 2.0 requirements. That is for unsupported lab machines, not for a normal install. A bypassed install can still fail later at driver or update time, and it is not the configuration Microsoft supports.

If you format manually, do not use plain FAT32 for the whole USB when `install.wim` is larger than 4GB. Let the tool split the image or use Rufus’s NTFS/UEFI:NTFS layout.

## Step 3 — Boot the USB in UEFI mode

Enter the firmware menu, confirm **UEFI**, **TPM 2.0** and **Secure Boot** are on, disable CSM/legacy boot, then choose the USB from the one-time boot menu.

| Vendor | Firmware setup | Boot menu |
|---|---|---|
| Dell | F2 | F12 |
| HP | F10 | F9 |
| Lenovo | F2 or Fn+F2 | F12 |
| ASUS | F2 or Del | Esc or F8 |
| MSI | Del | F11 |
| Gigabyte | Del | F12 |

- [ ] **Confirm the firmware mode** (Settings)

  If Secure Boot is off, turn it on and save. If TPM is hidden, enable the firmware TPM (Intel PTT / AMD fTPM) or plug in the discrete TPM. Do not continue with a bypass on a machine you intend to keep supported.

  Expected: UEFI boot, Secure Boot On, TPM 2.0 present.

## Step 4 — Start Setup

1. Choose language, time and keyboard, then **Next → Install now**.
2. Enter a product key, or choose **I don’t have a product key** if you will activate later. Setup can install without a key; activation is separate.
3. Select the edition that matches your licence. The ISO’s index matters: **Pro** is not Home, and a Pro key will not activate a Home install.
4. Accept the licence terms.
5. Choose **Custom: Install Windows only (advanced)**. “Upgrade” is for an in-place upgrade, not this procedure.

> **Note: Lab note: answer file**
>
> The E2 run used an `Autounattend.xml` to create a local admin and skip some OOBE screens. The product-key and edition screens were still completed manually. That is why this page describes the normal UI path, while the lab table records what was automated.

## Step 5 — Partition the disk

On a blank disk, select **Unallocated space** and click **Next**. Setup creates the UEFI layout itself:

| Partition | Size | Purpose |
|---|---|---|
| EFI System Partition | about 100MB | Boot files |
| Microsoft Reserved (MSR) | 16MB | Reserved |
| Windows (primary) | remaining space | Windows, apps, user data |

If the disk already has partitions, delete only the ones you are replacing. **Delete** on the wrong partition destroys data. For dual boot, shrink the existing Windows partition from the running system first, leave unallocated space, and install the second Windows there; do not delete the existing EFI partition.

> **Caution: “No drives were found” is a driver problem**
>
> Setup cannot see a disk when the storage controller needs a driver (Intel VMD/RST, RAID, or a VirtIO SCSI disk in a VM). Load the vendor’s storage driver with **Load driver**, or switch the VM disk to a controller Setup can see. Do not switch a physical machine from RAID to AHCI after Windows is installed without the matching driver.

## Step 6 — Copy, reboot, and don’t boot the USB again

Setup copies files and reboots. At the **“Press any key to boot from CD or DVD”** prompt, **do not press a key**; let it time out so the disk boots. If the machine keeps returning to Setup, remove the USB or change the boot order to the internal disk.

The first boot can take several minutes. A black screen with a spinner is normal; a firmware “no bootable device” error is not. Check that the disk is GPT and that the EFI partition exists.

## Step 7 — OOBE and the account

Choose region, keyboard, and network. OOBE may ask for updates and a Microsoft account. For a personal PC, a Microsoft account is the supported consumer path and makes activation and device recovery easier.

For a lab or shared machine, use the local-account option that the edition offers. If the build does not offer one, use an answer file or the edition’s supported work/school join flow; do not run a third-party “bypass” script. This lab used an answer file, so it did not exercise the consumer account screens.

## Step 8 — Drivers, updates, and verification

- [ ] **Install chipset, network and GPU drivers** (Settings)

  Use the OEM’s support page for the exact model. Windows Update is a good second pass, not a substitute for a missing Wi-Fi or storage driver. Install the GPU driver from AMD, Intel or NVIDIA, not from a driver-pack site.

  Expected: Device Manager has no unknown devices; network and display work.

- [ ] **Run Windows Update** (Settings)

  Install updates, reboot, and check again. If an update fails repeatedly, note the KB number and error code before changing the system.

  Expected: 26H2 cumulative updates install; no repeated reboot loop.

- [ ] **Verify the build and security state** (Terminal (admin))

  Run `winver`, then `msinfo32`, then `tpm.msc`. Record the build and the Secure Boot/TPM state before installing apps.

  Expected: Windows 11 Pro, build 26300.9457, UEFI, Secure Boot On, TPM ready.

## Lab check (E2)

| Item | Observed on VM 361 |
|---|---|
| Edition | Windows 11 Pro (`Professional`) |
| Display version | 26H2 |
| Build | 26300.9457 (`UBR` 0x24f1) |
| Firmware | UEFI, Secure Boot **On** |
| TPM | 2.0, “The TPM is ready for use.” (IBM vTPM) |
| Install type | Clean install, 256GB disk |
| Account | `winlab` local admin, created by answer file |
| Install date | 2026-10-28 |
| ISO | `Windows11_Client_x64_en-us_26300_9457.iso`, SHA-256 `BD4307…A650` |

### TPM check

tpm.msc : TPM 2.0 ready; IBM vTPM. The QEMU / Standard PC strings are expected in a VM. Click to open full size.

These are VM captures, so `System Manufacturer: QEMU` and `Standard PC (Q35 + ICH9, 2009)` are expected. The evidence is the Windows edition/build and the UEFI, Secure Boot and TPM state, not the hardware strings.

**Scope:** clean install only. In-place upgrade from 25H2/24H2, ARM64, and activation were **not** verified in this run. The VM used a SATA system disk because Setup could not see the VirtIO SCSI disk before drivers; that is a VM workaround, not a recommendation for physical hardware.

## Troubleshooting

| Symptom | Likely cause | First move |
|---|---|---|
| “This PC can’t run Windows 11” | TPM/Secure Boot/CPU not enabled or unsupported | Check firmware and `tpm.msc`; do not bypass on supported hardware |
| “No drives were found” | Storage driver missing (VMD/RST/RAID/VirtIO) | Load the OEM driver, or use a controller Setup supports |
| Setup keeps restarting | USB is still first in boot order | Remove the USB or boot the internal disk |
| Product key rejected | Key edition does not match the image | Skip the key, install the matching edition, activate later |
| No Wi-Fi after install | OEM Wi-Fi driver not in the image | Install the driver from another USB; Ethernet/USB tether as a bridge |
| Apps fail with DLL/0xc000007b | Runtime or bitness mismatch | See [DLL and 0xc000007b](https://windows.homes/en/windows/fixes/dll-runtime/) |

## What this page does not decide

- **Which edition or version** you should run: see [Which Windows 11?](https://windows.homes/en/windows/start/versions/).
- **Whether an in-place upgrade is safer** than a clean install: back up first; upgrade keeps apps, clean install gives a known state.
- **How to bypass requirements**: this page deliberately does not provide that. Use supported hardware, or accept that an unsupported install is outside Microsoft’s support boundary.

> **Tip: Next step**
>
> Installed successfully? Continue with [First 10 minutes on a new Windows 11 PC](https://windows.homes/en/windows/start/first-hour/) for updates, drivers, privacy and the BitLocker key.

## Sources

- [Microsoft Learn — Windows 11 requirements](https://learn.microsoft.com/en-us/windows/whats-new/windows-11-requirements)
- [Microsoft — Download Windows 11](https://www.microsoft.com/software-download/windows11)
- [Microsoft Learn — UEFI/GPT-based hard drive partitions](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions)
- [Microsoft Learn — Windows Setup command-line options](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-command-line-options)

---

Source: https://windows.homes/en/windows/install/clean/