How to Install Windows 11 From an ISO: A Safe Clean Install Guide

To clean install Windows 11, download it only from Microsoft's Download Windows 11 page, confirm the PC has TPM 2.0, UEFI with Secure Boot capability and a supported 64-bit processor, and back up your files. Build a USB with the Media Creation Tool (or download the ISO and check its SHA256), boot from it, and choose Install Windows 11.

That page offers three routes: the Installation Assistant upgrades the PC you are using, the Media Creation Tool builds a bootable USB or DVD, and the multi-edition ISO is for building media yourself or creating a virtual machine. On 23 October 2026 it lists the current release as Windows 11 2026 Update, version 26H2.

Every step below comes from Microsoft's own pages, fetched on 23 October 2026. This guide does not cover installing on hardware that fails the requirements, which Microsoft says leaves the PC unsupported and not entitled to updates.

Key takeaways

• One source only. Get the Installation Assistant, the Media Creation Tool and the ISO from microsoft.com/software-download, and drivers from Windows Update or your PC maker's own site.
• Check hardware first. TPM 2.0, UEFI with Secure Boot capability, a compatible 64-bit processor, 4 GB of RAM and 64 GB of storage. Run PC Health Check while the old system still works.
• Verify the ISO. Run Get-FileHash and compare it with the SHA256 value Microsoft lists for your language under Verify your download.
• A clean install erases the disk. Back up files and any BitLocker recovery key, and link your digital license to a Microsoft account first.
• Delete partitions on Disk 0 only. Leave Disk 1 and higher alone.
• After setup, check encryption, updates and Windows Security. Device encryption only fully protects the drive once a recovery key is backed up to an account.
• Reinstall the edition your license covers, and choose I don't have a product key if your license is digital.

Which Windows 11 download should you use?

The Download Windows 11 page has three options. Microsoft's Ways to install Windows 11 article adds a fourth that sits ahead of all of them for Windows 10 PCs: wait for Windows Update to offer the upgrade.

Three details matter. Both tools are x64 only, and Microsoft warns a USB built from the Arm64 ISO may need the device maker's drivers to boot. Mounting the ISO and running setup.exe is an upgrade, not a clean install. And you must choose the same language you use now (Time and language in Settings shows it).

What hardware does Windows 11 need?

Microsoft publishes the minimums on its consumer Windows 11 specifications page and in the Windows 11 requirements article on Microsoft Learn. They agree on the hardware.

Microsoft's supported processor lists on Microsoft Learn are published per maker. Its Intel list says the models shown meet "the minimum floor for the supported processor generations", and later generations meeting the same principles count as supported even before they are listed.

Run PC Health Check while the old system still works

Microsoft's Ways to install article recommends running PC Health Check in the current installation before booting installation media, because the media only checks some requirements. Search the taskbar for PC Health Check (Microsoft's help page points to aka.ms/GetPCHealthCheckApp if it is missing) and select Check now. The result says why the device is or is not eligible. Microsoft notes it does not check the graphics card or display.

Check the TPM

Microsoft's Enable TPM 2.0 article gives two checks. In Windows Security > Device security, open Security processor details and confirm Specification version is 2.0. Or press the Windows key + R and run:

tpm.msc

Compatible TPM cannot be found means the TPM may be disabled. Otherwise, check Specification Version under TPM Manufacturer Information.

Microsoft says many retail motherboards for home-built PCs ship with the TPM switched off even though it can almost always be enabled. The setting lives in UEFI firmware under names such as TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology. To reach firmware from Windows: Settings > System > Recovery, Restart now under Advanced startup, then Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

Check UEFI and Secure Boot

Microsoft's Windows 11 and Secure Boot article (KB5005381) says the requirement is that the PC is Secure Boot capable, meaning it runs in UEFI mode rather than Legacy BIOS (CSM). If firmware offers both, UEFI must be first or only. Microsoft suggests turning Secure Boot on for better security.

Two cautions. Microsoft's BitLocker overview says an OS installed in Legacy mode stops booting when firmware switches to UEFI, and names mbr2gpt.exe to prepare the disk first; a clean install makes this moot, but it explains why a working PC can stop starting after a firmware toggle. And on a BitLocker protected drive, firmware and Secure Boot changes can trigger a recovery prompt. Our guide to Windows boot problems, BitLocker recovery and boot loops covers finding the key and suspending protection before firmware work.

What if the PC does not meet the requirements?

Microsoft's position is the same on the download page, the Ways to install article and its article on devices that do not meet requirements: installing there is not recommended, the device will not receive support, and it is not guaranteed updates, including security updates. Damage from incompatibility is not covered by the manufacturer warranty, and the desktop shows a watermark.

We will not describe ways around the checks. A machine that cannot count on security updates is the opposite of what a security guide should produce. The supported options are to check whether TPM 2.0 or Secure Boot is simply switched off in firmware, to replace the PC, or, for organisations, to use Windows 365 Cloud PCs, which stream Windows 11 to other devices.

Microsoft's Ways to install article still suggests leaving an ineligible device on Windows 10, while the banner on the same pages says Windows 10 support ended on 14 October 2025, with no more free security fixes. Read together, a Windows 10 PC that cannot move to Windows 11 needs a replacement plan, not a bypass.

Where to download Windows 11 safely

Get Windows 11 media for a home or retail PC only from Microsoft's software download pages: microsoft.com/en-us/software-download/windows11 for x64 PCs and microsoft.com/en-us/software-download/windows11arm64 for Arm. The Installation Assistant, MediaCreationTool.exe and the ISO links all come from there. Organisations get Volume Licensing keys through their program's web portal, per Microsoft's activation article.

An operating system image is the most trusted software you will ever install. It runs before your antivirus, writes the boot loader and decides what the first account can do. A modified image from a lookalike site or a "pre-activated" repack could ship anything, and nothing installed afterwards is in a position to notice. So type the address or use a bookmark rather than following ads, never use a repacked image, and hash every ISO before it goes near a USB stick or VM.

How to verify the Windows 11 ISO with Get-FileHash

After you choose an edition and language in the ISO section of the download page, Microsoft shows a Verify your download panel with a SHA256 value per language, with separate rows for "English 64-bit" and "English International 64-bit". Compute the hash of your file with Get-FileHash and compare. A match, in Microsoft's words, confirms the file has not been "corrupted, tampered with or altered from the original."

On Windows

Open PowerShell (no administrator rights needed). Get-FileHash uses SHA256 by default, according to its Microsoft Learn reference. Use your own path; the file name varies by release and language.

Get-FileHash C:\Users\you\Downloads\Win11_English_x64.iso | Format-List

The output shows Algorithm : SHA256 and a Hash : line. Compare every character with the row for your language and architecture.

On macOS or Linux

Microsoft documents PowerShell for Windows, macOS and Linux, and the Get-FileHash reference's first example hashes a Linux path. Install PowerShell using Microsoft's instructions, open a session, then run:

Get-FileHash ~/Downloads/Win11_English_x64.iso | Format-List

What a hash does and does not prove

A match means your file is byte for byte the file Microsoft published under that row. It is only as trustworthy as the place you read the expected value from, so read it on microsoft.com, not a forum or the site that served the file. On a mismatch, delete the file and download again from Microsoft.

The table changes with each release, so use the values shown on the day you download. The Installation Assistant and Media Creation Tool build media themselves, so there is no ISO to hash; their protection is that you got them from Microsoft's page and run them on a machine you trust.

How to make a Windows 11 USB with the Media Creation Tool

Warning: the USB drive will be erased. Microsoft says any content on the flash drive will be deleted. Use a blank drive of at least 8 GB, and unplug other USB storage so you cannot pick the wrong one.

You need a Windows 11 license (or a Windows 10 device that qualifies for the upgrade) and an internet connection. Then, from Microsoft's download page and its Create installation media article:

1. Under Create Windows 11 Installation Media, select Download Now to get MediaCreationTool.exe.
2. Run it as an administrator and select Accept on the license terms if you agree.
3. On What do you want to do?, choose Create installation media for another PC, then Next.
4. Select the language, edition and architecture (64-bit), matching the target PC's language.
5. Choose USB flash drive (blank, 8 GB or more, erased) or ISO file (which you can burn to a DVD of at least 8 GB with Open DVD burner).
6. Wait for it to finish, then eject the USB safely.

If you downloaded the ISO directly, Microsoft's page shows how to burn it: set Windows Explorer as the program that opens ISO files (right-click > Properties > General > Change), then right-click the ISO and choose Burn disc image. If you get a disc image file is too large message, Microsoft suggests a dual layer DVD.

The Microsoft pages we fetched document building bootable USB media on Windows with the Media Creation Tool. If you only have a Mac or Linux machine, the route that stays within Microsoft's documentation is the one its reinstall article uses: create the media on any working Windows PC.

Clean install or Reset this PC?

Microsoft's Recovery options article lists several ways to get a fresh Windows. A clean install from USB is the most disruptive.

Reset this PC runs from Settings or the Windows Recovery Environment without external media, so try it first if the hardware is unchanged. Choose a clean install when you want control of the partitions, are installing to a blank drive, or need confidence that nothing from the old installation survives.

Before you wipe anything: the pre-flight checklist

Microsoft's reinstall article calls a clean install "an advanced option" and says it removes personal files, apps, maker customisations and Settings changes. Do all of this while the old system still runs.

1. Back up your files to an external drive, USB flash drive or cloud storage such as OneDrive, and check the backup opens elsewhere.
2. Back up any BitLocker recovery key. Search Start for BitLocker, open Manage BitLocker, select Back up your recovery key. Microsoft Support cannot retrieve a lost key. You need it if anything goes wrong before the wipe, and for any second drive you keep.
3. Check your edition in Settings > System > About. Microsoft says the reinstalled edition must match your license.
4. Link your digital license. Settings > System > Activation should say Windows is activated with a digital license linked to your Microsoft account. If not, add your Microsoft account there first.
5. Find any product key. Many modern PCs store it in firmware and setup applies it automatically. A refurbished PC's key comes from the refurbisher, not Microsoft.
6. Download critical drivers, especially the network adapter, from your PC maker's site onto a second USB.
7. Note your disks and sizes. You will delete partitions on Disk 0 only.
8. Have your Wi-Fi password and Microsoft account sign-in ready.

Step by step: clean install Windows 11 from USB

Warning: this deletes everything on the drive you install to. Complete the checklist first. The steps follow Microsoft's Download Windows 11 page and its Reinstall Windows with the installation media article; screen names can differ slightly between releases.

Step 1: plug in the USB and restart

Attach the USB and restart. If the PC boots straight back into the old Windows, Microsoft says it may not have fully shut down; choose Shut down from the power menu and power on again.

Step 2: open the boot menu

If the PC does not boot from the USB on its own, open the boot menu or change the boot order. Microsoft says this usually means pressing a key such as F2, F12, Delete or Esc right after power on; your PC's documentation or maker has the exact key.

If the USB is not listed, check that the PC is in UEFI mode and that the USB was built for x64. Microsoft's download page says you may then need the PC maker's instructions for temporarily disabling Secure Boot, and its Secure Boot article recommends turning it back on once the issue is resolved.

Step 3: language and keyboard

In Select language settings and Select keyboard settings, make your choices and select Next.

Step 4: choose a clean install

In Select setup option, choose Install Windows 11, tick I agree everything will be deleted including files, apps, and settings, then Next.

Step 5: product key and edition

If the Product key window appears and your license is digital, select I don't have a product key, then in Select Image choose the edition that matches your license. Windows applies the key linked to your Microsoft account after installation.

Microsoft warns: if you have no product key and it is not linked to your Microsoft account, stop, close setup and link the license first. The Product key window may not appear at all when setup finds a key in firmware. On a new device or motherboard with no license yet, Microsoft's activation article says to choose I don't have a product key and buy a digital license from Settings > System > Activation afterwards.

Step 6: accept the license terms

In Applicable notices and license terms, select Accept.

Step 7: delete partitions on Disk 0 only

Warning: this is the step that destroys data. In Select location to install Windows 11, Microsoft says to delete every partition on Disk 0 that is not already Unallocated Space: select each one and choose Delete Partition.

If the device has more than one disk, Microsoft warns not to modify or delete partitions on any disk other than Disk 0. Compare sizes with your notes first. If Disk 0 is not the drive you expect, stop.

When only Disk 0 Unallocated Space remains, select it and choose Next. Microsoft's BitLocker overview confirms Windows creates the partitions BitLocker needs automatically on a new install.

Step 8: install

In Ready to install, select Install. The PC restarts several times. If the first Install Windows screen appears again after installation completes, Microsoft says to revert the boot order change so the internal drive boots.

Step 9: finish setup

Microsoft's reinstall article says to connect to the internet and sign in with your Microsoft account so the digital license linked to it is applied. The account choices are covered next.

Upgrading instead of wiping

To keep files and apps, sign in to the existing Windows, open the USB in File Explorer and run setup.exe from its root (or mount the ISO and run it). Select Change what to keep and choose Keep personal files and apps (the default), Keep personal files only or Nothing.

Microsoft account or local account?

The answer depends on edition, and Microsoft's two requirement pages word it differently.

• The Windows 11 requirements article on Microsoft Learn says Windows 11 Home requires an internet connection and a Microsoft account to complete device setup on first use.
• The consumer Windows 11 specifications page says both Windows 11 Pro for personal use and Windows 11 Home require internet connectivity and a Microsoft account during initial setup.

Follow whatever setup asks of you.

You can add a local account after setup. Microsoft's Manage user accounts article says: Settings > Accounts > Other users > Add account, then I don't have this person's sign-in information, then Add a user without a Microsoft account. Microsoft says it recommends a Microsoft account over a local account.

The account choice directly affects disk encryption, as the next section explains.

BitLocker and device encryption after a clean install

What device encryption does

Microsoft's Device Encryption article says device encryption turns on BitLocker automatically for the OS drive and fixed drives, and is available more widely than full BitLocker, including on Windows Home. The BitLocker overview adds that Windows 11 version 24H2 removed the older DMA and HSTI/Modern Standby prerequisites, so more devices qualify. It does not encrypt external or USB drives, and it uses XTS-AES 128-bit by default.

Why the account matters

After a clean install, the BitLocker overview says, device encryption starts with a clear key, equivalent to BitLocker's suspended state, and File Explorer shows a yellow warning icon on the drive. The clear key is removed, a TPM protector created and the recovery key backed up only when an administrator signs in with a Microsoft account (the key goes to that account) or the device joins Microsoft Entra ID or Active Directory. Microsoft states that a device using only local accounts "remains unprotected even though the data is encrypted."

If you prefer a local account, turn encryption on yourself and keep the recovery key away from the PC.

Check and turn it on

Sign in as an administrator, open Settings > Privacy & security > Device encryption and turn it on. If the setting is missing, run System Information as administrator and look for Automatic Device Encryption Support or Device Encryption Support:

If a device qualifies later, for example after Secure Boot is turned on, Microsoft says device encryption enables BitLocker automatically. On Pro, Enterprise and Education, full BitLocker is also available through Manage BitLocker.

Back up the new recovery key

The key is new with the new install. Open Manage BitLocker and select Back up your recovery key: to your Microsoft account, a USB drive, a file (not on the encrypted drive) or a printout. Microsoft says not to keep a USB or printout with the computer. Make more than one backup. When a firmware update later triggers a recovery prompt, the BitLocker recovery and boot loops guide picks up from here.

Drivers: Windows Update first, then the maker's site

Microsoft's driver article says the best way to get drivers is automatically through Windows Update. After a clean install, run it first. For anything still missing, open Device Manager (right-click Start), right-click the device, choose Update driver and then Search automatically for updated driver software, or Browse my computer for drivers to point at a driver you downloaded from the maker.

Microsoft is explicit: download drivers matching your Windows version and architecture from the maker's site, and avoid drivers from any other site. That rules out driver bundles and "driver updater" tools, which ask for the same kernel level trust as the operating system. If an update causes problems, Roll Back Driver on the device's Driver tab restores the previous one.

First updates and keeping Windows 11 patched

A fresh image is only as current as the day it was built. Select Start > Settings > Windows Update > Check for Windows updates, then Download & install, restart when prompted, and repeat until nothing is left.

Microsoft's release information page says monthly cumulative security updates ship on the second Tuesday, and feature updates once a year in the second half, with 24 months of support for Home and Pro editions and 36 months for Enterprise and Education.

Microsoft notes 26H1 is only for new devices that came to market in early 2026, not an update for existing ones.

Microsoft's Secure Boot article also says it is updating Secure Boot certificates issued in 2011, which begin expiring in June 2026, automatically on supported Windows versions. A patched install is how you get them. Our post on Secure Boot certificate rotation in 2026 covers what can break.

Windows Security baseline after install

Microsoft describes the Windows Security app as bringing together Microsoft Defender Antivirus, Windows Firewall and Smart App Control. Open it from Start and check:

1. Virus & threat protection. Run a Quick scan, and under Manage settings confirm Real-time protection is On.
2. Firewall & network protection. Confirm the firewall is on for each network profile.
3. Device security. Confirm Security processor details shows TPM Specification version 2.0.
4. Single files. Right-click a file you are unsure of and choose Scan with Microsoft Defender (under Show more options on Windows 11).

Then a few free habits:

• Use a standard account for daily work and keep the administrator account for installs.
• Set up Windows Hello with a PIN, biometrics or a security key, which Microsoft's requirements page lists as options.
• Keep Secure Boot on. If you turned it off to boot the installer, turn it back on now. Device encryption needs it too.
• Install apps from their publishers' own sites or the Microsoft Store, the same rule as for Windows itself.

Activation basics after a clean install

Microsoft's activation article notes that activation pairs a product key or digital entitlement with the hardware; it does not judge whether the copy is genuine. Validation, a separate check that licensing files are intact, is needed for some updates.

After a clean install, a digital license activates online once you sign in with the linked Microsoft account. A product key goes in during setup or later in Settings > System > Activation > Change product key. A matching firmware key is applied automatically. After a big hardware change such as a new motherboard, the Activation troubleshooter can reactivate a license linked to your Microsoft account.

A key you did not get from Microsoft, a retailer, your device maker or your organisation does not belong in that box.

Installing Windows 11 in a virtual machine

Microsoft's requirements article lists the settings for a Windows 11 VM:

On Hyper-V hosts, virtualisation (VT-x, VT-d) must be enabled in firmware, and the virtual TPM 2.0 is emulated in the guest regardless of the host TPM. Hash the ISO before you attach it.

For Macs with Apple M1, M2 or M3 chips, Microsoft's Options for using Windows 11 with Mac article lists Windows 365 Cloud PCs, and Arm versions of Windows 11 Pro and Enterprise in a virtualisation product it names as authorised. That setup has no nested virtualisation (so no Windows Subsystem for Linux, Windows Sandbox or virtualisation-based security), and each Windows 11 Pro instance needs its own license.

Common errors and how to fix them

This PC doesn't meet the minimum system requirements. Run PC Health Check for the exact reason, and check whether TPM or Secure Boot is just switched off in firmware. Do not bypass the check.

The USB does not appear, or the PC boots back into the old Windows. See Step 1 and Step 2 above: shut down fully, confirm UEFI mode and x64 media, and only then follow the maker's steps to disable Secure Boot temporarily.

Setup starts again after installation finishes. Revert the boot order change so the internal drive starts first.

The Installation Assistant will not run. It needs an x64 PC on Windows 10 version 2004 or later, 9 GB of free space, administrator rights and a Windows 10 or 11 license. It does not run on Arm.

Windows Update does not offer the upgrade. Microsoft lists three reasons: it is not ready for that device yet, a compatibility hold is delaying it, or the hardware does not qualify. Install pending updates, restart and check again.

Device encryption is missing. Check System Information for the reason in the table above.

Windows is not activated after reinstall. Confirm the edition matches your license, that you signed in with the linked Microsoft account and that the PC is online. After a motherboard change, use the Activation troubleshooter.

Common mistakes

• Downloading from anywhere but Microsoft. Lookalike pages, repacks and "lite" builds are the real risk with an OS image.
• Skipping the hash check. One command, and the expected values are on the download page.
• Deleting partitions on the wrong disk. Disk 0 only; note sizes and unplug external drives.
• Wiping before linking the digital license. Reactivation becomes a support problem.
• Installing a different edition from your license. Home stays Home.
• Assuming a local account means an encrypted disk. Microsoft says data can be encrypted yet unprotected until the key is backed up.
• Leaving Secure Boot off after the install. It removes boot protection and blocks device encryption.
• Getting drivers from driver bundle sites instead of Windows Update or the maker.
• Skipping the first round of updates. The image is already behind on security fixes.
• Bypassing the hardware checks. Microsoft says such a PC is unsupported and not entitled to updates.

Where Safeguard fits, honestly

Safeguard does not install Windows, verify ISOs, manage devices, escrow BitLocker keys or replace Windows Security. Everything in the install itself is Microsoft's software and Microsoft's process.

The connection starts after the install, on developer and build machines. A freshly installed PC gets its toolchains, language runtimes, package managers and project dependencies all over again, usually in one afternoon, and those open source components carry their own vulnerabilities. Safeguard scans repositories, container images and SBOM files, matches components against vulnerability data, shows which projects contain a given component and version, and can open fix pull requests when a fixed version exists. That keeps the software you build on the new machine current. It does not touch the operating system underneath.

Fix it without waiting for upstream

Windows itself is patched by Microsoft through Windows Update, as above. This section is about the open source dependencies and container images you pull onto the machine once it is running, which nobody patches for you.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

FAQ

Is it safe to download the Windows 11 ISO from Microsoft?

Yes, from microsoft.com/software-download. It is Microsoft's own distribution point and publishes a SHA256 value per language so you can confirm the file with Get-FileHash. The risk is in lookalike sites and modified images.

Can I install Windows 11 without TPM 2.0?

Not as a supported installation. Microsoft lists TPM 2.0 as a minimum and says PCs below the requirements are unsupported and not entitled to updates. Many PCs have a TPM that is just switched off in firmware, so check tpm.msc first.

What is the difference between the Media Creation Tool and the ISO?

The Media Creation Tool is a Windows program that downloads Windows 11 and writes a bootable USB or saves an ISO for you. The ISO is the disk image itself, which you can hash, mount for an upgrade, burn to DVD or attach to a VM. Both are x64 on that page; Arm has its own ISO page.

Does a clean install of Windows 11 delete everything?

Yes, on the disk you install to. Microsoft says it removes personal files, apps, maker customisations and Settings changes, and the steps delete every partition on Disk 0. Other disks are untouched if you leave them alone.

Do I need a product key to reinstall Windows 11?

Usually not. With a digital license linked to your Microsoft account, select I don't have a product key, install the same edition and sign in with that account. A key stored in firmware is applied automatically.

Can I set up Windows 11 with a local account?

Microsoft's Learn page says Windows 11 Home needs an internet connection and a Microsoft account to finish first setup; its specifications page says the same for Home and Pro for personal use. You can add a local account afterwards in Settings > Accounts > Other users. Turn on device encryption and back up the key yourself if you use local accounts only.

Is BitLocker turned on automatically in Windows 11?

Device encryption turns on automatically on eligible devices when you sign in with a Microsoft account or a work or school account, and the recovery key is backed up there. With only local accounts it is not. Check Settings > Privacy & security > Device encryption.

How do I check the Windows 11 ISO hash?

Run Get-FileHash in PowerShell on the ISO and compare the SHA256 output with your language's value in the Verify your download panel on Microsoft's page. PowerShell also runs on macOS and Linux.

See how Safeguard would help

None of these demos install Windows, check an ISO or manage BitLocker. They show what happens on a newly installed developer machine once code and dependencies land on it.

The first is a real CLI session. It opens the interactive terminal with safeguard, asks it to "fix the lodash CVE in this repo", and shows it reading the finding and advisory, asking before each command, editing package.json to lodash 4.17.21, running npm install and npm test with approval, and pushing nothing. On a freshly installed workstation, the same flow brings a newly cloned project onto fixed versions with a person approving every command.

Click through it at your own pace, or open it full screen.

The second sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. If you rebuild a build server or lab PC from a clean install, this is how scanning of the repositories and images on it runs on hardware you control. See how the local runner and offline mode work.

Click through it at your own pace, or open it full screen.

The third connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. After a fleet of machines is reimaged, it lets someone ask in plain language which projects contain a component and version, with only the access you grant.

Click through it at your own pace, or open it full screen.

To try the CLI yourself, download it from safeguard.sh/download and read the CLI docs.

Quick check

Sources

• Microsoft: Download Windows 11
• Microsoft: Download Windows 11 for Arm-based PCs
• Microsoft: Windows 11 specifications and system requirements
• Microsoft Learn: Windows 11 requirements
• Microsoft Learn: Windows 11 supported Intel processors
• Microsoft Support: Ways to install Windows 11
• Microsoft Support: Create installation media for Windows
• Microsoft Support: Reinstall Windows with the installation media
• Microsoft Support: Recovery options in Windows
• Microsoft Support: How to use the PC Health Check app
• Microsoft Support: Enable TPM 2.0 on your PC
• Microsoft Support: Windows 11 and Secure Boot (KB5005381)
• Microsoft Support: Windows 11 on devices that don't meet minimum system requirements
• Microsoft Support: Device Encryption in Windows
• Microsoft Learn: BitLocker overview
• Microsoft Support: Back up your BitLocker recovery key
• Microsoft Support: Stay protected with the Windows Security app
• Microsoft Support: Manage user accounts in Windows
• Microsoft Support: Activate Windows
• Microsoft Support: Install Windows updates
• Microsoft Support: Update drivers through Device Manager in Windows
• Microsoft Learn: Windows 11 release information
• Microsoft Learn: Get-FileHash
• Microsoft Learn: Install PowerShell on Windows, Linux, and macOS
• Microsoft Support: Options for using Windows 11 with Mac computers with Apple M1, M2, and M3 chips

Last reviewed: 23 October 2026. Microsoft updates its download page, hash table and release information with each Windows release; check them on the day you install.