Macrium Reflect X Home Rescue USB Fails to Boot Without C Drive Present (Dell Optiplex 7070, CA 2023)

Environment
* System: Dell Optiplex 7070
* OS: Windows 11 24H2 (booted last week, but not this week; Windows Update updated the BIOS on its own since installation last week)
* Storage: Dual OS drives (two 111GB PNY SSDs) configured in RAID mode (not SATA AHCI)
* Software: Macrium Reflect X Home (new paid version)
* Security: CA 2023 applied (verified via Garlin's script)

Problem
I am trying to verify that my backup image can be restored to a secondary drive without risking my current working setup. However, the Macrium Reflect X Home rescue flash drive fails to boot if the primary C drive is not present (simulating a dead drive scenario).

* If the C drive is present, the rescue flash boots up fine and loads Macrium.
* If the C drive is absent, the rescue flash will not boot unless I manually disable Secure Boot in the BIOS.

Expected
The rescue flash drive should be able to boot independently of the internal C drive's presence while keeping Secure Boot enabled.

Actual
With the C drive removed, the rescue flash fails to boot under Secure Boot. I managed to restore the image to the second backup OS drive, but only by leaving the C drive connected during the process.

What I tried
* I temporarily assigned a drive letter to the 4th partition (system drive) to generate a WIM file in an attempt to make the rescue flash compliant with CA 2023. This successfully created a WIM file, but the USB still will not boot without the C drive.
* I read that Macrium suggests turning Secure Boot off to perform the restore. While this works, it feels risky given the complexities of PK, KEK, and the CA 2023 updates, which I do not fully understand yet.
* I am considering using Garlin's script to update the boot partition, on the flash, but I have not run it yet. I would but I don't understand how to direct it towards the Flash drive only. I suppose if I really studied that Script I would understand how to make a bootable flash. ?

If you run the check scripts (either Check_UEFI-CA2023.ps1 or Check-UEFI.bat), you can add the option -BootMedia on the command line.

It will report which version of the boot files are present on the USB. Sometimes it's a mismatch with the boot files.

Another reason could be you have a SkuSiPolicy file present. The SkuSiPolicy isn't directly a Secure Boot file, but it's additional security for booting by restricting which versions of winload.efi are allowed. If your recovery media is WinRE-based (as opposed to WinPE), then it has a winload.efi which might be blocked.

Why does it matter whether you have a C drive? It's not so much as the drive, but there's a working EFI partition with an installed boot manager. Depending on your BIOS's boot priority order and the BCD entries, the C drive's boot manager may be taking over. Without the C drive, you're entirely dependent on the USB to boot itself (gets no help from boot manager).

1. Check if you have the right version of the boot files using the -BootMedia option.

2. Check if you have a SkuSiPolicy file, the script will report if you have one. This might need to be removed, as it can interfere with bootable USB drives when the base version of WinRE/WinPRE isn't what the policy file allows.