Native Boot of Windows from a VHD on a System with BitLocker

I should note before I start that I already know how to deploy Windows to a VHD and boot from it, but it's something that I just have not done in several years. I made myself some very detailed notes regarding the process, even wrote a script to automate it for me, but in reviewing my notes I see that there are a few bits of information that I never notated for myself.

So, let's assume this scenario:

I have a laptop with a single drive (C:), and C: is BitLocker encrypted. In my notes, I made a note that if the primary OS drive is BitLocker encrypted, I need to suspend the BitLocker protection temporarily so that editing the BCD and adding the instance of Windows on a VHD won't trigger a request for the BitLocker recovery key. I also note that the VHD then needs to be installed on another drive other than C:.

Here is the part that I am missing:

In this scenario, can the VHD with Windows be deployed to a USB connected HDD / SSD or does it need to be deployed to an internally connected drive? Taking that one step further, can that deployment of Windows to a VHD be stored and booted from a flash drive?

NOTE: This is intended only to be a temporary installation for some testing, not anything permanent.

Well, I recently transferred from a Surface Book 1 to a new new Surface Laptop Studio (SLS), and because I had been running Win 11 Release Preview in a native-boot VHDX on the Surface Book 1, I decided to see if I could transfer the VHDX to a USB SSD drive and boot it (from USB) on the SLS. So, I first prepared the USB to make it bootable, transferred the VHDX to the main partition, and then (on the SLS) I mounted the USB's UEFI boot partition as Drive X (using diskpart), I mounted the VHDX as Drive F, then ran bcdboot F:\Windows /s X: /f UEFI.

I then opened Advanced Startup Options in the Win 11 on the SLS, and clicked Restart Now under Advanced Startup. This booted the machine to the UEFI boot menu, from which I could select the boot drive. This worked fine (obviously it took some time for the machine to find all its drivers, but it all worked OK).

However, booting into the drive that way got boring, so instead I booted into the UEFI firmware and changed the boot order so that the machine will automatically boot from a plugged-in bootable USB. This also works fine. BitLocker encryption on the SLS doesn't in anyway prevent booting from an external USB.

It might be worth noting that only the OS partition is BitLocker encrypted, not the UEFI boot partition. This is by design, so that the system can boot without having to decrypt. You're right that any bootable VHDX should be on an unencrypted drive, but the system OS inside the VHDX could be encrypted as far as I'm aware (I haven't tried this).

Thanks, Peribanu.

In the meantime, I found some answers myself. In my script, I had some comments that I neglected to transfer over to my notes.

It would appear that a VHD / VHDX can be booted from an external HDD / SSD but NOT device considered to be a removable disk such as a flash disk.

I tested it on an external HDD and it worked fine. I may still try on a flash drive just to be 100% certain that it will in fact not work on a flash drive, but it may take me a day or two to get around to that.

Yes, I seem to remember on my Surface Book 1 that it wasn't able to native boot from the microSD card, but I was able to native boot from a USB SSD. Basically I think this is because you can't partition SD/microSD with the partitions needed, but to be honest, I never tried, as it would quite quickly destroy a flash drive to be running a complex OS on it (too much I/O degrades the drive). Much better to use flash for relatively stable data, though it should always be backed up because it's quite easy to destroy a microSD card with too many writes, as I've discovered to my cost.

Peribanu said:

Yes, I seem to remember on my Surface Book 1 that it wasn't able to native boot from the microSD card, but I was able to native boot from a USB SSD. Basically I think this is because you can't partition SD/microSD with the partitions needed, but to be honest, I never tried, as it would quite quickly destroy a flash drive to be running a complex OS on it (too much I/O degrades the drive). Much better to use flash for relatively stable data, though it should always be backed up because it's quite easy to destroy a microSD card with too many writes, as I've discovered to my cost.

Click to expand...

Hi there
It's nothing to do with the partitioning of the SD card. The main problem is that the SD card needs a driver to access the sd card reader. It's usually a proprietary storage controller. This means that until the OS kernel and driver get loaded the SD hardware is unknown by the bios and therefore isn't bootable, Standard USB ports etc are enabled in the BIOS so USB drive's etc can boot.

If using an OS with bitlocker and vhdx files ensure the efi file is in its own separate partition formatted as fat32, size 100M and the windows OS is a standard (non gpt partition - no efi) one formatted NTFS. If you have a huge disk the main disk will be EFI/GPT anyway so the disk geometry will look something like this efi, vhdx1, vhdx2,vhdx3

the vhdx files will be the "C" drive for the OS and "D" for the main disk.

The trick is NOT to have a standard classical windows installation on the "C" drive but completely from vhdx files and just one SINGLE EFI file where you install the boot loader -- at boot you'll then get the standard "Blue" Ms boot options of the installed os'es etc --no need to enter BIOS for boot disk choice - and you can in the bootloader the default boot system too.


cheers
jimbo

Update: It appears that my notes in my script were incorrect. I just successfully installed Windows to a VHD (VHDX if you want to get technical) on a USB flash drive and was able to dual boot between the two installations.

I am now in the process of updating my script so that it no longer checks to see if the drive that the VHD is being deployed to is a removable drive since it works perfectly well on a removable drive.

hsehestedt said:

Update: It appears that my notes in my script were incorrect. I just successfully installed Windows to a VHD (VHDX if you want to get technical) on a USB flash drive and was able to dual boot between the two installations.

I am now in the process of updating my script so that it no longer checks to see if the drive that the VHD is being deployed to is a removable drive since it works perfectly well on a removable drive.

Click to expand...

Minor point but usb drive has to be NTFS or exFAT formatted - you might want to check if flash drive is fat32 formatted?

hsehestedt said:

Update: It appears that my notes in my script were incorrect. I just successfully installed Windows to a VHD (VHDX if you want to get technical) on a USB flash drive and was able to dual boot between the two installations.

I am now in the process of updating my script so that it no longer checks to see if the drive that the VHD is being deployed to is a removable drive since it works perfectly well on a removable drive.

Click to expand...

Could you please share some of these notes/ scripts?

I had done a lot of similar stuff with Native Boot of VHDs back when Win 8 first allowed it. I had played with MBR vs GPT & BIOS vs UEFI booting (lots of reading and dynamically scripting VHDs using Powershell & Batch files) (Lots of BCDEDIT, BCDBOOT, EasyBCD and similar tools).

It all seems so long back, and having a bit of trouble recalling or finding without having to start from scratch.

For right now I am trying to quickly pop some Win 8.1 and Win 10 VHDs (to mess around with) onto an external SSD. No bitlocker for now.

Im doing something wrong unlike before

jimbo45 said:

Hi there
It's nothing to do with the partitioning of the SD card. The main problem is that the SD card needs a driver to access the sd card reader. It's usually a proprietary storage controller. This means that until the OS kernel and driver get loaded the SD hardware is unknown by the bios and therefore isn't bootable, Standard USB ports etc are enabled in the BIOS so USB drive's etc can boot.

If using an OS with bitlocker and vhdx files ensure the efi file is in its own separate partition formatted as fat32, size 100M and the windows OS is a standard (non gpt partition - no efi) one formatted NTFS. If you have a huge disk the main disk will be EFI/GPT anyway so the disk geometry will look something like this efi, vhdx1, vhdx2,vhdx3

the vhdx files will be the "C" drive for the OS and "D" for the main disk.

The trick is NOT to have a standard classical windows installation on the "C" drive but completely from vhdx files and just one SINGLE EFI file where you install the boot loader -- at boot you'll then get the standard "Blue" Ms boot options of the installed os'es etc --no need to enter BIOS for boot disk choice - and you can in the bootloader the default boot system too.


cheers
jimbo

Click to expand...

As mentioned above in previous comment, I am having some recall issue :)

Years back I had experimented a lot with Native Boot VHDs of various types (in all manner of permutations & combinations):
1 partition vs 2 + partition VHDs
MBR vs GPT
Legacy BIOS vs UEFI Booting (all of the above) -

From Primary Physical Drive vs other ways.. various alternative ways of directiong the boot chain.

I was quite savvy with BCD stuff back then, and now its all a mixed mush in the head.

What would be easiest way to dump my 1 part MBR VHDs to an external USB 3 SSD drive and Boot off it?

What might be the best way to point its Boot to my Primary SSD's Boot Options?

I used EasyBCD to add the VHD as my BCDBOOT KungFu has become weak and something failed.

Not sure its a Legacy vs UEFI thing or something else.

xbliss said:

Could you please share some of these notes/ scripts?

I had done a lot of similar stuff with Native Boot of VHDs back when Win 8 first allowed it. I had played with MBR vs GPT & BIOS vs UEFI booting (lots of reading and dynamically scripting VHDs using Powershell & Batch files) (Lots of BCDEDIT, BCDBOOT, EasyBCD and similar tools).

It all seems so long back, and having a bit of trouble recalling or finding without having to start from scratch.

For right now I am trying to quickly pop some Win 8.1 and Win 10 VHDs (to mess around with) onto an external SSD. No bitlocker for now.

Im doing something wrong unlike before

Click to expand...

I'll look for my notes on this in the morning. Bear with me a bit. I have a couple of priorities to deal with in the morning first, but I'll get to this as soon as I can.

xbliss said:

As mentioned above in previous comment, I am having some recall issue :)

Years back I had experimented a lot with Native Boot VHDs of various types (in all manner of permutations & combinations):
1 partition vs 2 + partition VHDs
MBR vs GPT
Legacy BIOS vs UEFI Booting (all of the above) -

From Primary Physical Drive vs other ways.. various alternative ways of directiong the boot chain.

I was quite savvy with BCD stuff back then, and now its all a mixed mush in the head.

What would be easiest way to dump my 1 part MBR VHDs to an external USB 3 SSD drive and Boot off it?

What might be the best way to point its Boot to my Primary SSD's Boot Options?

I used EasyBCD to add the VHD as my BCDBOOT KungFu has become weak and something failed.

Not sure its a Legacy vs UEFI thing or something else.

Click to expand...

I need to test this because I dont normally use MBR or vhd

It in theory should work if you create a small (non efi) boot partition and a big ntfs partition .Copy the vhd's to the big partition. Format the small one to fat32.
Now with some sort of windows installl disk / macrium or whatever get into the command line and go through the following steps in turn for each vhd-- attach the vhd with diskpart, install the boot loader to it (bcdboot w:\windows s S: /f MBR

should work in theory. Maybe someone has a better idea though.

Cheers

jimbo

Here is the procedure:

NOTE: These notes are a little on the rough side. I never cleaned them up and made them look pretty, just have not [placed a priority on that task yet . If you have any questions, please feel free to let me know.

Open an elevated command prompt.

If your C: drive is BitLocker encrypted, run this command:

manage-bde -protectors -disable C:

Run the following two commands. Replace the W: with the drive letter of the large partition on the external SSD where you want to install Windows. For the description on the second command, feel free to change it to anything you want. This description will be displayed for the OS on the SSD when you boot your computer.

bcdboot W:\Windows
bcdedit /set {default} description "Win11 PRO 22H2 on External SSD"

Reboot your computer. I suggest booting into your original OS the first time (not the OS on the external SSD).

Once booted, if your C: drive is BitLocker encrypted, then right-click on C: in File Explorer, select "Manage BitLocker", select "Suspend Protection". The next step would normally cause the system to prompt you for the BitLocker recovery key. Suspending BitLocker prevents that. BitLocker automatically reenables the next time you boot into Windows (the one not on the external SSD).

Continue here whether or not C: is BitLocker encrypted.

Run "MSCONFIG" and go to the "Boot" tab. Click on the Windows boot menu item for the copy of Windows NOT on the external SSD. It should include the text "C:\Windows" in the description. Now, click on "Set as default, and then click on "OK". Allow the system to reboot.

I suggest booting one last time into the original copy of Windows. This will allow BitLocker to re-enable itself and will also allow you perform the next step.

If you want to install all the drivers for your system into the new copy of Windows on the external SSD, do this:

Open an elevated command prompt. Run the following commands (replace W: with the drive letter for the large partition on the external SSD):

MD W:\Drivers
pnputil /export-driver * W:\Drivers

Be patient! This may take several minutes.

Reboot and boot into the copy of Windows on the SSD.

Open an elevated command prompt and run this command, replacing W: with the correct drive letter:

pnputil /add-driver W:\Drivers\*.inf /subdirs /install

This will install all the drivers. Again, this may take several minutes.

NOTE: When the display driver is installed, the screen may go black for a little while. This is normal.

After all drivers are done installing, reboot for the drivers to take effect.

-------------------------------------

If you want to clear the pagefile of the external SSD when Windows is shutdown (for security), follow these steps:

In registry editor of Windows installed on the external drive, navigate to: HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management

Set the value for "ClearPageFileAtShutdown" to "1".

^ Was this response for me? Thanks :)

I do not need bitlocker so ignoring that would be fine for other steps?

I'll read up on the rest of the above again, when I wake up fresh :)

xbliss said:

^ Was this response for me? Thanks :)

I do not need bitlocker so ignoring that would be fine for other steps?

I'll read up on the rest of the above again, when I wake up fresh :)

Click to expand...

Yes, that was intended for you.

Absolutely, you can ignore the lines related to BitLocker if you don't have BitLocker installed. That is why I noted "If your C: drive is BitLocker encrypted, run this command:", the implication being that if you don't use BitLocker, you don't need to do this.

One other thing I neglected to note:

My scripting is not in the form of a batch file. I incorporated that functionality into a program that I have written. Because it's not in the form of a batch file, I didn't include any scripting. I'm sure that you can work that out from the procedure.

hsehestedt said:

Yes, that was intended for you.

Absolutely, you can ignore the lines related to BitLocker if you don't have BitLocker installed. That is why I noted "If your C: drive is BitLocker encrypted, run this command:", the implication being that if you don't use BitLocker, you don't need to do this.

One other thing I neglected to note:

My scripting is not in the form of a batch file. I incorporated that functionality into a program that I have written. Because it's not in the form of a batch file, I didn't include any scripting. I'm sure that you can work that out from the procedure.

Click to expand...

Thank you :)
Now you've tempted me to ask you more :) ... like a bag of chips..

What program did you write? a .NET or VB one?
Can you share it? or put it on GitHub?