Can't clean install W11 from usb on a new laptop


P

pat3

New member
Local time
2:34 PM
Posts
2
OS
Windows 11
I have a brand new HP laptop and i want to do a clean install of W11 to get rid of the pre installed software and other unnecessary stuff. I prepared the installation media (usb stick) succesfully, just like i've done so many times on W10. Then i went to check that the stock bios/uefi settings are ok (secure boot, tpm, usb boot all enabled). Finally i tried to boot from the usb stick (it said uefi next to the boot option) and it fails to do that, telling me "Invalid signature detected. Check secure boot policy in setup."

I have no idea why this is happening. I've done this so many times on W10 machines. I even tried to update the BIOS, but no help. The laptop model has just been released and came with W11, so hardware is obviously compatible. Any ideas?
 

My Computer

System One

  • OS
    Windows 11
Secure Boot is disallowing the USB's boot file due to your UEFI's current set of security certificates.

With a brand new laptop, it'll depend on how it was shipped from the factory. The possibilities are:
- UEFI only recognizes the older CA 2011 certs, and doesn't allow USB drives with newer CA 2023-signed boot files​
- UEFI recognizes both CA 2011 and CA 2023 certs, and allows all USB drives to boot​
- UEFI only recognizes the newer CA 2023 cert, and doesn't allow USB drives with older CA 2011-signed boot files​

For now, temporarily disable Secure Boot in BIOS and you'll be allowed to boot whatever you want. After you get W11 up and running, it will be easier to run a script or set of commands to see what is your exact situation with UEFI certs and the original USB drive.

It's ideal to have Secure Boot for a live system, but it's not required for the purpose of installing Windows.
 

My Computer

System One

  • OS
    Windows 7
pat3 said:
i tried to boot from the usb stick (it said uefi next to the boot option) and it fails to do that, telling me "Invalid signature detected. Check secure boot policy in setup."
Click to expand...
Welcome to Eleven Forum.

garlin said:
Secure Boot is disallowing the USB's boot file due to your UEFI's current set of security certificates....
....For now, temporarily disable Secure Boot in BIOS and you'll be allowed to boot whatever you want.
Click to expand...
Garlin is correct, Secure Boot is not allowing you to boot from the USB.

You can turn off Secure Boot and still be able to install Windows 11. The requirement is that the PC is capable of Secure Boot, it doesn't need to be turned on to qualify as a supported device.
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    Laptop
    Manufacturer/Model
    Acer Aspire 3 A315-23-R9VY
    CPU
    AMD Athlon Silver 3050U
    Memory
    8GB
    Graphics Card(s)
    Radeon Graphics
    Monitor(s) Displays
    laptop screen
    Screen Resolution
    1366x768 native resolution, up to 2560x1440 with Radeon Virtual Super Resolution
    Hard Drives
    1TB Samsung EVO 870 SSD (from April 2026: 250GB EVO 850)
    Internet Speed
    150 Mbps
    Browser
    Edge, Firefox
    Antivirus
    Defender
    Other Info
    fully 'Windows 11 ready' laptop. Windows 10 C: partition migrated from my old unsupported 'main machine' then upgraded to 11. A test migration ran Insider builds for 2 months. When 11 was released on 5th October 2021 it was re-imaged back to 10 and was offered the upgrade in Windows Update on 20th October. Windows Update offered the 22H2 Feature Update on 20th September 2022. It got the 23H2 Feature Update on 4th November 2023 through Windows Update, 24H2 on 3rd October 2024 through Windows Update by setting the Target Release Version for 24H2, and 25H2 on 30th September 2025 through Windows Update by setting the Target Release Version for 25H2.

    UPDATE - 11 April 2026: due to mechanical deterioration this PC has been retired from active duty. The OS with all software and files has been migrated to my System Seven below to carry on as my general purpose 'main machine'.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro.

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 8GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Dev, Beta, and RP 24H2 as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 8GB RAM, 1TB NVMe ssd, supported device running Windows 11 Pro, plus Insider Beta, Dev, and Canary builds (and a few others) as a native boot .vhdx.

    My SYSTEM SIX is a Dell Latitude 5550, Core Ultra 7 165H, 64GB RAM, 1TB NVMe SSD, supported device, Windows 11 Pro 24H2, Hyper-V host machine. Updated to 25H2 on 30th September 2025.

    My SYSTEM SEVEN is a Lenovo Thinkpad T580, Intel Core i7-8650U, 16GB RAM, 512GB NVMe SSD + 2nd 512GB NVMe SSD, a supported device for Windows 11. This is my current general purpose 'main machine'. The installed Windows 11 Home from my System One has been migrated to this machine.
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell Latitude E4310
    CPU
    Intel® Core™ i5-520M
    Motherboard
    0T6M8G
    Memory
    8GB
    Graphics card(s)
    (integrated graphics) Intel HD Graphics
    Screen Resolution
    1366x768
    Hard Drives
    500GB Crucial MX500 SSD
    Browser
    Firefox, Edge
    Antivirus
    Defender
    Other Info
    unsupported machine: Legacy bios, MBR, TPM 1.2, upgraded from W10 to W11 using W10/W11 hybrid install media workaround. In-place upgrade to 22H2 using ISO and a workaround. Feature Update to 23H2 by manually installing the Enablement Package. In-place upgrade to 24H2 using hybrid 23H2/24H2 install media. Upgraded to 25H2 by Enablement Package. Also running Insider Dev, and Canary builds and Windows 10 as native boot .vhdx.

    My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro.

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 8GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Dev, Beta, and RP 24H2 as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 8GB RAM, 1TB NVMe ssd, supported device running Windows 11 Pro, plus Insider Beta, Dev, and Canary builds (and a few others) as a native boot .vhdx.

    My SYSTEM SIX is a Dell Latitude 5550, Core Ultra 7 165H, 64GB RAM, 1TB NVMe SSD, supported device, Windows 11 Pro 24H2, Hyper-V host machine. Updated to 25H2 on 30th September 2025.

    My SYSTEM SEVEN is a Lenovo Thinkpad T580, Intel Core i7-8650U, 16GB RAM, 512GB NVMe SSD + 2nd 512GB NVMe SSD, a supported device for Windows 11. This is my current general purpose 'main machine'. The installed Windows 11 Home from my System One has been migrated to this machine.
Another option: in the UEFI setup [BIOS], look for the option "Enable MS UEFI CA key". If present, enable it and exit saving changes.

If the option exists but is grayed out, disable Sure Start, exit and save the change, before enabling the UEFI CA Key.
 

My Computer

System One

  • OS
    Windows 10
garlin said:
Secure Boot is disallowing the USB's boot file due to your UEFI's current set of security certificates.

With a brand new laptop, it'll depend on how it was shipped from the factory. The possibilities are:
- UEFI only recognizes the older CA 2011 certs, and doesn't allow USB drives with newer CA 2023-signed boot files​
- UEFI recognizes both CA 2011 and CA 2023 certs, and allows all USB drives to boot​
- UEFI only recognizes the newer CA 2023 cert, and doesn't allow USB drives with older CA 2011-signed boot files​

For now, temporarily disable Secure Boot in BIOS and you'll be allowed to boot whatever you want. After you get W11 up and running, it will be easier to run a script or set of commands to see what is your exact situation with UEFI certs and the original USB drive.

It's ideal to have Secure Boot for a live system, but it's not required for the purpose of installing Windows.
Click to expand...
Maybe I'll try if i can see what certs are supported on the machine right now.

About disabling secure boot: i've read somewhere that disabling it may trigger bitlocker and lock the machine, requiring the key to unlock it. Is this true and can i prevent this from happening by disabling bitlocker first in Windows? This is a good thing to note as i think bitlocker is on by default nowadays.
 

My Computer

System One

  • OS
    Windows 11
You're probably thinking of "if you change the Secure Boot certs without suspending BitLocker first, BitLocker wants you to provide a recovery key".
 

My Computer

System One

  • OS
    Windows 7
You can run this PS script (as Administrator) to check your current UEFI certs:
Code: 
powershell -ep bypass -f \path\to\save\folder\Check_EFIBootFile.ps1
 

Attachments

My Computer

System One

  • OS
    Windows 7
pat3 said:
Any ideas?
Click to expand...
Not an idea, but experience says do not do a so-called clean install. You will end up inducing problems, part of which is because of the integrated hardware of Laptops.

Some of the pre-installed software is useful. You can uninstall at your leisure stuff like Trial versions of MS Office, AV Apps, etc, possibly other stuff.
 

My Computer

System One

  • OS
    Windows 11
why you want to delete hp recovery oem partition? many people search for that after accidentally delete. You can do reset under windows 11 setting instead of install from usb
 

My Computers

System One System Two

  • OS
    windows 11 home 23H2 22631.6199
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    Intel core i7 (2nd gen) Turbo 3.10 ghz
    Memory
    6gb
    Graphics Card(s)
    Amd Radeon HD 7400m 1GB & Intel hd graphics
    Sound Card
    BeatsAudio
    Hard Drives
    128gb SSD
  • Operating System
    macOS Sequoia
    Computer type
    PC/Desktop
    Manufacturer/Model
    iMac 24"
    CPU
    M1 3.2 ghz
    Memory
    8gb onboard
    Graphics card(s)
    igpu
    Monitor(s) Displays
    Retina 4.5K
    Screen Resolution
    4480x2520
    Hard Drives
    512gb SSD
You must log in or register to reply here.

Similar threads

Solved Dell Latitude. Can't Clean-Install because of "AHCI" and "RAID" complications.
2 3 4
Replies
64
Views
20K
_william
_william
Bonkers challenge -- install W11 from within an XP VM !!!
Replies
3
Views
1K
RazorKat83
RazorKat83

Latest Support Threads

Latest Tutorials

Back
Top Bottom