Solved How to install Windows 10 22H2 with secure boot 2023 enabled

this was done because a forum member was having problems installing Windows 10 22H2
on a system with the new secure boot and secure boot 2023 certs enabled.

good news, i have done it.
i now have a Rufus bootable USB pen drive with Win10 22H2 booting and installing Windows 10 22H2 using the Windows 11 25H2 boot-loader with no secure boot violations with the new secure boot 2023 cert being used for the install of Win10 22H2.

you can use Win10 and Win11 ISO's if you have already downloaded them to create the Rufus bootable USB pen drive
or you can use Rufus to download the Win10 and Win11 ISO's if you dont have them already.

first.
you will need a 16GB USB pen drive (8GB isnt big enough)
the latest copy of Rufus from the Microsoft Store.


### Part A ###
this is using Rufus to download the Win11 25H2 ISO
then create a bootable USB pen drive from this download.

once the download has completed and you start to create the Rufus Win11 bootable USB
an option window will open tick any or all options you require but make certain you enable/tick
>>> 'use 2023 secure boot option' <<< at the bottom of the Rufus option window.

once the Rufus bootable Win11 USB pen drive has been created
open explorer and from within the Win11 USB drive COPY and PASTE 2 folders to the desktop

boot folder
efi folder

the boot folder is about 18.1MB
the efi folder is about 24MB


### Part B ###
this is using Rufus to Download the Win10 22H2 ISO
then create a bootable USB pen drive from this download
you can use the same USB pen drive that you have already used.

once the download has completed and the bootable Win10 USB pen drive has been created (using the same USB pen drive)
open explorer and from within the Win10 USB drive DELETE (or cut and paste) these 2 folders

boot folder
efi folder


### Then ###
then copy and paste from the desktop the 2 folders (boot and efi) that came from the Win11 USB pen drive
into the Win10 bootable USB pen drive.

once this has finished transferring the two folders from the desktop to the Rufus bootable pen drive
close all open windows and restart the system. then on restart bring up the boot menu and boot from this Rufus bootable pen drive

it will take a few seconds but the Win10 22H2 install window will appear
and from there you can install Windows 10 22H2 with secure boot enabled and the new 2023 certs in place.

best of luck Steve ..
edit by me to add a detail that i missed and to report a successful trail of the above HowTo

This method bypasses the Secure Boot check for booting WinPE, however it doesn't solve the problem if your W10 22H2 install image has a SVN mismatch (assuming a CA 2011 revocation was already performed on the target system). You must find an updated install image (UUP dump) or integrate the later ESU updates to get the latest boot manager inside the install image.

Otherwise when Setup exits WinPE, and reboots into the newly extracted Windows, it might fail if the new Windows' SVN is lower than the UEFI's current DBX SVN.

There are two boots that matter: first boot into WinPE, and a second boot into the installed Windows. Both need the right boot file. The first one belongs to the ISO, the second one is embedded inside the install image. Make sure you're using the latest W10 22H2 ISO (most users can use UUP dump).

garlin said:

This method bypasses the Secure Boot check for booting WinPE, however it doesn't solve the problem if your W10 22H2 install image has a SVN mismatch (assuming a CA 2011 revocation was already performed on the target system). You must find an updated install image (UUP dump) or integrate the later ESU updates to get the latest boot manager inside the install image.

Otherwise when Setup exits WinPE, and reboots into the newly extracted Windows, it might fail if the new Windows' SVN is lower than the UEFI's current DBX SVN.

There are two boots that matter: first boot into WinPE, and a second boot into the installed Windows. Both need the right boot file. The first one belongs to the ISO, the second one is embedded inside the install image. Make sure you're using the latest W10 22H2 ISO (most users can use UUP dump).

Click to expand...

the image i used for the Rufus bootable USB is the latest available for Win10 22H2
which should be all updated if not then it should be possible to update from within a new install.

that will be tested shortly and i shall report back with the results as and when i get them.
best of luck Steve ..

The thing to remember is W10 22H2's always had a CA 2023 version of the boot file since April 2025.

The problem is the boot file keeps getting replaced every time they fix a reported security issue. Once you apply the PCA 2011 revocation, some SVN number gets written and it will be enforced. If you haven't revoked PCA 2011, then any version of W10 image from Apr 2025 onward is eligible.

But after you revoke PCA 2011, and get a SVN number (and possibly bump the SVN number), you will need a specific version of W10 in order to satisfy the minimum SVN requirement. If you want to make an ISO which installs on any PC, then it has to be a June 2026 build of W10 22H2 or later. (Since the last SVN switch happened with the June 2026 update).

Moving forward, the SVN rule is going to confuse a lot of users. It's no longer a simple thing of having CA 2023 vs. CA 2011, but also having the right SVN. Finding the latest possible image means you won't be blocked for booting.

I suspect some users will get frustrated, and temporarily turn off Secure Boot because they don't want to keep track of what ISO version they have.

garlin said:

The thing to remember is W10 22H2's always had a CA 2023 version of the boot file since April 2025.

The problem is the boot file keeps getting replaced every time they fix a reported security issue. Once you apply the PCA 2011 revocation, some SVN number gets written and it will be enforced. If you haven't revoked PCA 2011, then any version of W10 image from Apr 2025 onward is eligible.

But after you revoke PCA 2011, and get a SVN number (and possibly bump the SVN number), you will need a specific version of W10 in order to satisfy the minimum SVN requirement. If you want to make an ISO which installs on any PC, then it has to be a June 2026 build of W10 22H2 or later. (Since the last SVN switch happened with the June 2026 update).

Moving forward, the SVN rule is going to confuse a lot of users. It's no longer a simple thing of having CA 2023 vs. CA 2011, but also having the right SVN. Finding the latest possible image means you won't be blocked for booting.

I suspect some users will get frustrated, and temporarily turn off Secure Boot because they don't want to keep track of what ISO version they have.

Click to expand...

i agree the SVN can cause problems after install but in this instance the boot manager and install of the EFI/BOOT is from Win11 25H2. the install of Win10 will/should be using this boot loader after install but as you have stated there could be problems but to find these problems out first an install must take place

we shall decide how to move from there. but you have to admit this is a bit of a new area and is quite novel.
best of luck Steve ..

The new procedure is the same for both W10 & 11. Every time a new boot manager is announced, it forces a new SVN and you have to presume in the worst case your target PC may have the latest SVN. Unless you're always behind on Monthly Updates.

Unlike W11 25H2, where MCT cranks out a new fully updated ISO every month, W10 users don't have such a luxury and must either learn to integrate update themselves (unlikely for normal users) or learn to use UUP dump (more likely).

Teaching them to open ConvertConfig.ini in Notepad, and changeUpdtBootFiles=1is a simple lesson.

i have just rebuilt a small test computer
chuwi corebox 2nd generation
i7 6560u 2 core, 4 thread
16GB DDR3 1600
256GB M2 type SSD (operating drive)
240 GB 2.5" SSD (storage and ISO drive)

15.6 portable monitor with speakers
compact WiFi keyboard and mouse

first i will have to update the secure boot certs
then i can test the Rufus Win10 22H2 USB with the 25H2 efi/boot partition and boot manager

at the moment i am awaiting a couple of items monitor/keyboard and mouse
i will post back with the results

edit
secure boot 2023 certs updated.
but the Win10 22H2 install failed 'no drivers' found

best of luck Steve ..

just to update a successful install of Windows 10 22H2 using a Rufus USB pen drive with the Windows 11 25H2 boot-loader
has been installed on a test system that i have upgraded for this test with the new secure boot 2023 certs.

the test system is
Chuwi CoreBox 2nd generation micro tower compact PC.
Intel i7 6560u CPU. 2 cores, 4 threads
16GB DDR3 1600 SoDimm ram
256GB M2 type SATA SSD

first i installed Windows 11 25H2 from a Rufus USB pen drive and updated the secure boot to the latest 2023 secure boot certs.

then i copied and pasted the boot folder and efi folder from the Win11 USB pen drive to the desktop
i then used Rufus to download Windows 10 22H2 and created a Rufus bootable USB pen drive from this download
using the same USB pen drive as before.

once the Win10 bootable USB drive had been created i removed the boot folder and efi folder from the USB drive and copied and pasted the boot and efi folders from the desktop that had come from the Win11 25H2 bootable USB drive to the bootable USB drive.

closed all windows and restarted into the boot menu, selected the Win10 bootable USB drive and installed Windows 10 22H2 without a problem.

best of luck Steve ..