Unable to create a ISO that works on Secure Boot enabled System

Question

Unable to create a ISO that works on Secure Boot enabled System

akhil sudan 21

Hi Community,

I am trying to create a custom Win11 ISO for deployment on secure boot enabled environment. Boot Manager files were updated using the latest patch for ADK but the ISO installation from bootable USB fails.
ADK Patch - https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-servicing#download-and-install-the-windows-adk-patches-1

I'm trying creating ISO using ocdimg utilty and tried different command lines as -

oscdimg -LIOT -m -o -u2 -udfver102 -befisys_noprompt.bin -pEF "C:\Users\xx\ISO17" "C:\Users\xx\ISO17.iso"
oscdimg -LIOT -m -o -u2 -udfver102 -bootdata:2#p0,e,b"C:\Users\asudan\OneDrive - Stryker\Documents\Work\ISO\Synapse\SDC5k_ISO17_V1002146_MDDS\boot\etfsboot.com"#pEF,e,b"C:\Users\xx\ISO17" "C:\Users\xx\ISO17.iso"

Wim files are greater than 4 GB, it has to use NTFS partition thus Burning the ISO into USB using Rufus utility.
Unable to identify the root cause.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

As far as I can tell, the issue might be the USB boot layout. On Secure Boot systems, the firmware must be able to read the EFI bootloader from a FAT32 EFI System Partition (ESP). If Rufus creates a single NTFS partition because install.wim exceeds 4 GB, it relies on its UEFI:NTFS loader. Some firmware, Secure Boot implementations, or updated Microsoft boot manager binaries might not work with this approach, causing boot failures before Windows Setup starts.

In addition, verify that the oscdimg syntax is correct. AFAIK, for a UEFI-only installation, the boot image should be efisys.bin (or the updated ADK equivalent), not the root folder. For BIOS+UEFI media, try using -bootdata with etfsboot.com and efisys.bin. Using efisys_noprompt.bin is valid, but from what I recall, it should reference the actual EFI boot image file from the ADK, not the ISO source directory. Verify that the patched ADK boot files replaced all boot manager files (efisys*.bin, bootmgfw.efi, etc.) as documented by the ADK servicing update.

If the media still fails, test whether the issue is with the media or the image by creating a USB directly with Media Creation Tool or DISM + BCDBoot, or by splitting install.wim into .swm files (DISM /Split-Image) so the USB can remain entirely FAT32. If the split-image media boots successfully, the problem is likely the NTFS/UEFI boot path rather than the custom ISO itself.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin