I just built a new desktop and want to install Windows 11 from scratch, but I’m confused about the exact steps, BIOS settings, and whether I need to change anything for Secure Boot or TPM. I also don’t know the best way to create a bootable USB and handle partitions so I don’t mess anything up. Can someone walk me through the full process to get Windows 11 properly installed on a fresh system?
Short version.
-
Prep the USB
• On another PC, download “Media Creation Tool” from Microsoft
• Run it, pick “Create installation media for another PC”
• Choose Windows 11, your language, 64‑bit
• Point it to an 8 GB or larger USB stick
• Let it finish, eject the USB -
Plug stuff in right
• New PC, plug in keyboard, mouse, monitor, and the USB installer
• Plug SSD or NVMe where you want Windows
• If you have multiple drives, disconnect extras to avoid installing to the wrong one -
Enter BIOS / UEFI
• Power on, spam Del or F2 (sometimes F10 or F12, depends on board)
• Load “Optimized Defaults” once, save
• Make sure boot mode is “UEFI” not “Legacy” or “CSM”
• Disable “CSM” if there is a toggle
• Put USB drive as first boot device -
TPM and Secure Boot
On AMD:
• Look for “AMD fTPM” or “Firmware TPM” and set to Enabled
On Intel:
• Look for “PTT” or “Platform Trust Technology” and set to Enabled
Then:
• Find “Secure Boot” and set to Enabled
• If mode is “Custom”, switch to “Standard” or “Default”
• Save and exit
-
Install Windows 11
• System should boot from the USB
• Pick language, keyboard, etc
• Click “Install now”
• If you have a key, enter it. If not, click “I don’t have a product key” and pick your edition (usually Home or Pro)
• When you see the drive list, delete all partitions on the target SSD so it shows as one big “Unallocated space”
• Highlight that unallocated space and click Next
• Installer will make the needed EFI, MSR, Recovery partitions automatically
• Wait while it copies and restarts -
First boot setup
• Pick your region and keyboard
• For internet, either connect or skip with “I have no internet” if you want an offline account
• On Home edition, online setup tries to force a Microsoft account. To avoid that, disconnect ethernet and skip WiFi, then you should see “limited setup” for a local account
• Create username and password
• Turn off data collection options if you care about privacy -
Drivers and updates
• Once on desktop, connect internet
• Open Settings > Windows Update, run “Check for updates” until it shows no more important updates
• Go to your motherboard support page, grab chipset drivers, LAN, audio
• For GPU, get latest driver from Nvidia, AMD, or Intel
• Install chipset first, then GPU, then the rest
• Restart when prompted -
Check Secure Boot and TPM inside Windows
• Press Win + R, type tpm.msc, press Enter
• It should show TPM 2.0 and “The TPM is ready for use”
• Press Win + R, type msinfo32
• In “System Summary”, confirm “Secure Boot State: On” and “BIOS Mode: UEFI” -
Optional tweaks
• Turn on XMP or DOCP in BIOS for RAM so it runs at rated speed
• Set your Windows SSD as first boot drive if it is not already
• Create a restore point or backup once everything feels stable
If something fails
• If installer says “this PC cannot run Windows 11”, TPM or Secure Boot or UEFI is off. Go back to BIOS and double check: CSM disabled, Secure Boot enabled, firmware TPM/PTT enabled.
• If drive does not show, check SATA/NVMe cables, or M.2 slot usage in the manual. Some boards kill a SATA port when a certain M.2 slot is used.
Couple of extra angles to add on top of what @nachtdromer already wrote, without rehashing the same checklist.
- BIOS / UEFI “gotchas”
- I actually don’t recommend enabling Secure Boot right away on some boards.
- First: set UEFI only, disable CSM, install Windows.
- After Windows is installed and booting fine, then turn Secure Boot on.
- Reason: some motherboards freak out on Secure Boot if the keys are not initialized, and you get stuck wondering why the USB won’t boot.
- If you see something like “Install default Secure Boot keys” or “Factory keys,” run that once before enabling it fully.
- TPM specifics
- On some AMD boards, enabling fTPM can slightly change boot behavior if you toggle it later, which can trigger BitLocker prompts down the road.
- Easiest flow: enable fTPM / PTT before install and keep it that way. Don’t flip it on and off after Windows is installed unless you like surprise recovery key hunts.
- Partitioning strategy
- If the SSD is new, you can let Windows do its thing.
- If it’s used or you re-installed 5 times already:
- Use “Shift + F10” on the Windows setup screen, run
diskpart, then:list diskselect disk 0(double check it is the right drive size!)clean
- Close the window, hit refresh, you now have truly clean unallocated space.
- Use “Shift + F10” on the Windows setup screen, run
- That avoids leftover weird EFI partitions from previous installs.
- Internet / account stuff
- If you do want a Microsoft account (for OneDrive, activation syncing, etc.), it is actually easier to just plug in the network and let it sign in during setup.
- If you really want a local account and Windows keeps trying to force the cloud account, you can:
- Hit Shift + F10, type
taskkill /F /IM oobenetworkconnectionflow.exe(varies by build, but this trick works surprisingly often). - It kicks you back to a screen that lets you pick offline options.
- Hit Shift + F10, type
- Installation media alternatives
- Instead of Media Creation Tool, I prefer using Rufus with a Windows 11 ISO from Microsoft:
- Lets you choose GPT, UEFI only, and sometimes tweak things like TPM checks.
- Helpful if your board has immature firmware or you are fighting weird boot behavior.
- That said, MCT is simpler, so if you’re already confused, stick to what @nachtdromer outlined.
-
Order of BIOS tuning
I like this order to avoid chasing ghosts: -
First boot into BIOS, load optimized defaults.
-
Turn off CSM, set UEFI only.
-
Enable fTPM / PTT.
-
Leave Secure Boot OFF for the very first USB boot if your board is finicky.
-
Install Windows.
-
After first successful boot, go back in and:
- Enable XMP/DOCP for RAM.
- Turn on Secure Boot and confirm keys installed.
- Make sure your NVMe/SSD with Windows is first boot device.
-
Quick sanity check list when stuff breaks
- USB not booting:
- Check Boot override section in BIOS and pick the USB directly.
- Try rear USB 2.0 ports, not front panel or fancy USB 3.x.
- “Can’t install to this disk, GPT/MBR issues”:
- You’re probably in UEFI with an MBR disk or the opposite. Use
diskpart cleanand let setup recreate GPT.
- You’re probably in UEFI with an MBR disk or the opposite. Use
- System reboots in loop:
- After the first restart, yank the USB or change boot order so it doesn’t keep booting the installer.
Do it once carefully, and later reinstalls are trivial. First time usually just involves a bit of BIOS menu hide-and-seek and a couple of “oh, that’s why it wouldn’t boot” moments.