Is it now worth trying Windows 11?

[iMo]

Win11 25h2 works fine on my 10y old i5, i3 (gen6, unsupported hw), no issues with it. The entire story with the need for the latest cpus (except sse4.2) comes from the bitlocker, imho, which wants TPM built into the cpu for best security (instead using an external TPM chip). Do not enable bitlocker for your sys disk and you are fine with older cpus and the latest 11 (rufus install)..
PS: I use the bitlocker for external usb sticks only and it works fine straight out of the box in 7/10/11/Mint22.2 (no TPM chips)..

[peter-h]

For 25H2 you used Rufus, I guess?

I also always put a win7 UI on win11. There are several of them; I use Classic Shell. All the rest of the win11 UI is just pure pointless crap but you can disable it.

[iMo]

Download the Win11 25H2 iso from M$, and use the Rufus latest for creating the usb stick installer. You may (actually you want if none TPM) disable the bitlocker/TPM and the need for M$ account in the Rufus, etc. (among other settings in the Rufus). Install the win11 and that it is..
All upgrades (via the regular win11 update) inclusive the latest one in Dec2025 worked fine here, absolutely no issues here (10y old i3+nvme_SSD, none TPM module).
BTW., the "issues" indicated by various bloggers re Win11 upgrades during year 2025 were not present here, interestingly..

For 25H2 you used Rufus, I guess?

I also always put a win7 UI on win11. There are several of them; I use Classic Shell. All the rest of the win11 UI is just pure pointless crap but you can disable it.

There are megatons of various optimization tools for win11 available you may play with, indeed..

PS: a lesson learned when I did in-place upgrade from win10 to win11 on my i5 (also via Rufus) -> you must consider the "English" language version of the Win11 and Win10 isos. There are two - the "US English" and the "International English" iso versions -  which are NOT compatible for that upgrade..
You have to use the same English language iso version always.. 

[paulca]

The problem is that mainstream software devs tend to be really arrogant and put in OS version tests just for fun.

It's not for "fun".

Do you want to access your online banking with Chrome?

That is just one strawman example. 

It's not because we want to for fun, it's because we get told to.  There isn't  choice.  Security researchers always win.

I believe most banks will block you if you use GrapheneOS which they don't control.  They do control Android.  The same with VPNs, my online banking app doesn't like my VPN one bit, even if I put the end point in the UK.  Banks know more than most governments they just stay quiet about it.

[Karel]

I believe most banks will block you if you use GrapheneOS which they don't control.  They do control Android.

That's why I don't do important things like banking and email on a smartphone.
I use Firefox on a Linux computer with a physical token generator provided by my bank.
Google/android and apple can kiss my <censored>.

[David Hess]

I believe most banks will block you if you use GrapheneOS which they don't control.  They do control Android.

That's why I don't do important things like banking and email on a smartphone.
I use Firefox on a Linux computer with a physical token generator provided by my bank.
Google/android and apple can kiss my <censored>.

Because phone companies so readily allow phone accounts to be stolen, I do not consider any phone secure.  They sure should not be used for authentication, but here we are.

[Marco]

Because phone companies so readily allow phone accounts to be stolen, I do not consider any phone secure.

That's only a problem for SMS verification. They still have one of the best sandboxes and protections against on-device MitM attacks outside of completely dedicated devices regardless (like the calculator device from my bank, which can read QR type codes and then show you what you are authorising on its own screen, getting phased out for a mobile phone app based system though).

It's putting a lot of eggs in one basket, but alternatives like say U2F dongles or NFC cards without UI have a fundamental unsolvable problem with MitM. How many dedicated devices with displays should we have?

[peter-h]

The same with VPNs, my online banking app doesn't like my VPN one bit, even if I put the end point in the UK.

Funny that... the only way I do online banking when away from my home PC is over a VPN to my house The reason is that my bank likes to block my account if they see a login from a different IP. Morons... AFAICT they cannot tell if I am on a VPN+RDP. How could they tell? Only by the RGB pixel depth...

That's why I don't do important things like banking and email on a smartphone.

I do simple emails but never anything financial on my phone, otherwise if I lose it I have to change the passwords.

[Monkeh]

The same with VPNs, my online banking app doesn't like my VPN one bit, even if I put the end point in the UK.

Funny that... the only way I do online banking when away from my home PC is over a VPN to my house The reason is that my bank likes to block my account if they see a login from a different IP. Morons...

Has nobody explained to them that the vast majority of people do not have a stable IP address and that indeed, if they catch up to 20 years or so ago in technology, machines will choose an address essentially at random? I always get lost this high up in the scale, 2⁶⁴ is what.. 18 quintillion addresses? And I've got the whole /48 to play with. And they've no idea if that's what I was allocated, or a /56, or a single address (I could absolutely just NAT out that lone /128 the router gets, even if people call that wrong).

I would tend to abandon any such criminally ignorant institution, but I doubt the competition is better, only different.

To be fair, though, blocking known VPN providers who provide a means to attempt to anonymise abusive access to their services makes a degree of sense. It is unfortunate for those looking to access their own service legitimately without disclosing information the bank need not know, of course.

E: I guess I should say static IP address, I suppose for most people it is fairly stable so long as they get a routable one - anything can happen with CGNAT (which is another nail in the coffin of IP address being a valid identifier).

[peter-h]

Sure the banks are stupid but all UK banks are stupid, in different ways. They have dumb IT people and they are overwhelmed by a combination of clever fraudsters and their own dumb staff - even though online related fraud actually amounts to a miniscule % of their profits.

They can't work on just the IP because as you say lots of people are on DHCP etc. But try accessing a UK bank on a PC or laptop, not their phone app, from say Greece and see what happens. In fact you can bet on half your credit cards getting blocked on a holiday. Nowadays some send you an SMS to check it "was you".

When I say VPN I mean my own VPN, terminating on the router in my house.

Then the bank sees my normal PC and my normal browser and all its normal cookies...

Back to win11... interesting that Rufus should work just fine on my win7-64 i7-970. Does one not lose application config?? In most windows upgrades one lost the lot. WinXP to win7, etc. Only win3.1 to NT3.51 and NT4 was app config preserved, IIRC. I know win10 to win11 is supposed to work fine.

[abeyer]

It's not because we want to for fun, it's because we get told to.  There isn't  choice.  Security researchers always win.

While it's true these things get implemented by fiat, I would argue that it's more security theater and security by checklist than actual security research.

[peter-h]

With Rufus, is it possible to install latest win11 on a machine with the SATA controller configured as IDE?

That is the "dead easy" config for Trueimage backup and restore, absolutely 100% reliable.

[Monkeh]

I don't see why not, as far as I'm aware non-AHCI drivers are still present. Easy enough to try.

[peter-h]

I think this is highly problematic.

I have a win11 machine, ex Ebay and one of these, i7, about £350
https://www.ebay.co.uk/itm/115710830111?var=415848756074
Came with win11 24H2 preinstalled. This cowboy is selling win11 machines which are not UEFI, not TPM, so obviously hacked with Rufus or similar.

I spent days setting it all up (for a friend).

Then installed Trueimage 2025. Backed up OK to a Synology NAS, even with a bootable DVD of TI2025 (earlier TI do not boot from their bootable media for some reason).

Then thought... let's try restoring just ONE file, using the boot media. Worked.

The machine would not boot!

The file appeared to recover ok (just a tiny PDF, recovered to c:\temp) but then the PC fails to boot, saying the boot device is not there. It displays a menu with error code 0xc0000225. On another screen, inaccessible boot device 0x7B.

TI2025 shows the SSD as normal, so I guess just the boot files got corrupted by TI2025 when it recovered that one little file to it.

I do have, on the NAS, a 24 Dec TI2025 backup of the whole drive but a) that would lose some recent work and b) I don't even know if the restore works at all to make a bootable drive.

If I had to restore the whole drive image, should I [re]partition the SSD first, with some other tool first? AFAICT TI has no partitioning tool.

I do have win7-64 install DVDs so could create an NTFS partition on the SSD, but doesn't win11 need a load of other stuff?

I bought EasyRE for win11 (£20). But EasyRE failed to repair it. Still the same boot issue, error 7B. I used the automatic repair option.

So I am stuck and wonder what is the best way. TI2025 can see the non-bootable drive and files on it, so I can make another image backup to the NAS which should have the latest stuff (but probably still won't boot if restored?).

Someone suggested BCDBOOT...

[Messtechniker]

Moved away from TI a long time ago. 2013 or so me thinks. Because it was getting convoluted and unreliable then. And seemingly still is. Never looked back.

[rob77]

I believe most banks will block you if you use GrapheneOS which they don't control.  They do control Android.  The same with VPNs, my online banking app doesn't like my VPN one bit, even if I put the end point in the UK.  Banks know more than most governments they just stay quiet about it.

it's not about control but liability... if the phone's OS is not secure the bank will simply not take the risk of some malware stealing your account because they would have to compensate your loss.  if the phone's loader is signed and the OS is trusted the bank will take the risk because it's orders of magnitude lower.

regarding VPN - same thing , liability... but in this case i'm on your side.. VPNs should not be banned.. the fact is the VPN endpoints in your country would be exactly the entry points of foreign scammers but if you're using your credentials and 2nd factor authentication then i see no reason why to ban VPNs.

[peter-h]

I have just wasted days with a win11 machine.

As I posted, there are several firms selling "refurbished" machines with win11 on them, almost certainly hacked with Rufus and some other stuff, and occassionally, under some circumstances, win11 activates its "auto boot repair" process and trashes the thing.

I've been digging around as to what might be causing that the machine starts up ok after a whole-disk Trueimage restore, and then fails to start (error 0x7B) after the next reboot. Clearly there must be some auto boot modification task and sure enough:

According to google: Windows 11 features an Automatic Repair process that runs automatically in the background when the system detects critical boot failures. This process operates within the Windows Recovery Environment (WinRE) and attempts to fix issues, including corrupted boot records, without user intervention.

To stop Windows 11 Automatic Repair, boot into the Advanced Startup (by interrupting startup three times), select Troubleshoot > Advanced options > Command Prompt, and use the command bcdedit /set {default} recoveryenabled No to disable it.

There is a registry entry for this too.

Apparently this "auto fix" can blow up systems where the HD was cloned, too. Just what you want

[Monkeh]

I have just wasted days with a win11 machine.

As I posted, there are several firms selling "refurbished" machines with win11 on them, almost certainly hacked with Rufus and some other stuff, and occassionally, under some circumstances, win11 activates its "auto boot repair" process and trashes the thing.

I've been digging around as to what might be causing that the machine starts up ok after a whole-disk Trueimage restore, and then fails to start (error 0x7B) after the next reboot. Clearly there must be some auto boot modification task and sure enough:

According to google: Windows 11 features an Automatic Repair process that runs automatically in the background when the system detects critical boot failures. This process operates within the Windows Recovery Environment (WinRE) and attempts to fix issues, including corrupted boot records, without user intervention.

To stop Windows 11 Automatic Repair, boot into the Advanced Startup (by interrupting startup three times), select Troubleshoot > Advanced options > Command Prompt, and use the command bcdedit /set {default} recoveryenabled No to disable it.

There is a registry entry for this too.

Apparently this "auto fix" can blow up systems where the HD was cloned, too. Just what you want

That should not trigger just because you cloned the drive, it's supposed to occur after multiple boot failures. Simply imaging a drive and writing it back should not impact anything - indeed, I've done this (not using proprietary tools with undefined behaviour, mind you) untold times with Windows systems successfully.

[peter-h]

I would agree cloning should not trigger it, but the "windoze auto boot recovery" is clearly capable of trashing the boot process on a machine on which the boot process was initially hacked with e.g. Rufus.

[Monkeh]

I would agree cloning should not trigger it, but the "windoze auto boot recovery" is clearly capable of trashing the boot process on a machine on which the boot process was initially hacked with e.g. Rufus.

Rufus doesn't touch any part of the boot process.

[iMo]

@peter-h: What did you set in Rufus?

Perhaps you want to "clone" the win11 image from that "refurbished machine" to your system (via the Trueimage) - that requires some prerequisites - like identical BIOS settings (uefi/legacy, secure boot, raid/sata/nvme, GPT/MBR), storage drivers..

[iMo]

..This cowboy is selling win11 machines which are not UEFI, not TPM, so obviously hacked with Rufus or similar.

The Win11 requires uefi, afaik. So a cloning requires to clone (AI):

Where it sits in the partition layout

Typical Windows 11 GPT layout:

EFI System Partition (ESP) – ~100–300 MB, FAT32

Microsoft Reserved Partition (MSR) – 16 MB, unformatted

Windows (C:) – NTFS

Recovery partition – ~500–1000 MB

AI:

Windows 11 firmware & disk requirements
Mandatory requirements

Windows 11 must be installed with:

UEFI firmware mode

GPT partition style

EFI System Partition (ESP)

A standard Windows 11 system disk will have:

EFI System Partition (FAT32)

Microsoft Reserved Partition (MSR)

Windows (NTFS)

Recovery partition

Legacy BIOS + MBR is not supported for Windows 11.

Secure Boot & TPM

UEFI is mandatory

Secure Boot is required by specification, but Windows 11 can technically run with it temporarily disabled after install

TPM 2.0 is required (with some documented exceptions)

Important:
Secure Boot and TPM are firmware/security checks, not partition requirements themselves — but they rely on UEFI.

What happens if you try Legacy/MBR

If someone:

Restores a Windows 11 image to an MBR disk

Boots in Legacy/CSM mode

You may see:

Boot failure

0x7B or 0xc000000e

“No boot device found”

Even if it boots once, it is unsupported and unstable.

Imaging & restore implication (important for your case)

When copying or restoring Windows 11:

Target disk must remain GPT

EFI System Partition must exist and be intact

Firmware must boot in UEFI mode

CSM / Legacy boot must be disabled

If any of those differ from the source system, boot issues are very likely.

You better download the win11 latest .iso from M$ site and use the latest Rufus (with proper settings). It will care about the TPM, secure boot, M$ account, bitlocker, etc.. Aprox 10minutes job to create a bootable usb stick for the win11 install..

[peter-h]

I didn't use Rufus.

I just bought a "win11" machine which was built on sub-win11-spec hardware. They used some hack to get win11 24H2 onto it.

https://forum.acronis.com/forum/acronis-true-image-2026-forum/can-latest-trueimage-work-win11-disks-no-partition-table

Go to the end of it

Clearly there is something win11 does after it successfully boots which prevents another boot. But it isn't the standard automatic repair because I disabled that.

[paulca]

Sure you "booting" from cold or did you use "Shutdown"?

Shutdown does not shut down, it saves memory to disk.  Reloaded on next start.  The restore process might be tied to the bits they disabled like TPM support maybe.

If you want clean memory boot, you need to "Restart".

So 1st boot != 2nd boot.

[peter-h]

I use Restart.

What you are thinking is (in windoze) Standby. Laptops have that; PCs not usually.