Installing Windows 11¶

Practical 2.5 installing-windows-11-annex.pdf · PDF

Imagine you own a fast, expensive gaming PC. You run Microsoft's checking tool to see if it can get the new Windows, and it answers: This PC can't run Windows 11. The reason is a chip you have never heard of.

That happened to many people in 2021. Debian and Ubuntu installed on your VMs without asking for anything special. Windows 11 checks your hardware first, asks for a product key and wants an online account. Today you build a VM that passes the check, and on the way you meet a disk that is there — but Windows cannot see it.

The system that checks your hardware¶

On 24 June 2021 Microsoft presented Windows 11. The surprise was not the new Start menu. It was one line in the requirements: TPM 2.0. People with powerful PCs read "This PC can't run Windows 11" and searched the web for a chip they had never heard of. Windows 11 came out on 5 October 2021 with the requirement still in place.

You wrote these numbers in your installation plan.

What is a TPM?¶

A TPM (Trusted Platform Module) is a small chip, or a protected part of the CPU, that creates and keeps secret keys and never gives them out.

Think of a small safe bolted to the wall, which opens only for the owner it recognises. Windows keeps two kinds of secrets in it:

• the key that encrypts the disk, and
• the secrets behind PIN and fingerprint login.

Steal the disk without the safe, and its content is unreadable.

A safe in a VM?¶

A VM has no chip to give. So the host — the class server — runs a small program, swtpm (software TPM), that behaves exactly like the chip and keeps its secrets in a file on the server. virt-manager calls this an emulated TPM. The guest cannot tell the difference — the same trick as the virtual disk that is really a file.

flowchart TB
    subgraph HOST["Class server (host)"]
        SW["<b>swtpm</b><br>a program pretending<br>to be the safe"]
        F["<b>OVMF</b><br>UEFI firmware<br>with Secure Boot"]
        subgraph VM["VM win11"]
            W["<b>Windows 11</b><br>sees a real TPM 2.0<br>and UEFI firmware"]
        end
    end
    SW -->|"emulated TPM 2.0"| W
    F -->|"boots with Secure Boot"| W

Build win11: four special settings¶

First connect virt-manager to the class server, as in your first VM: the address changes every class, so add the connection again with today's slip (qemu+ssh://<user>@<server>/session) and select it.

Then start the usual wizard on that connection (Windows ISO path typed in the box, memory 4096, CPUs 2, disk 64 GiB, network Bridge device... virbr0, name win11), with one new tick on the last screen: Customize configuration before install. Then Finish opens the hardware list instead of starting.

A VirtIO disk is a kind of virtual disk designed for VMs: faster than pretending to be an ordinary SATA disk. Remember it — Windows has never heard of it.

Then Begin Installation. The firmware shows Press any key to boot from CD or DVD... for a few seconds: click inside the window and press a key at once.

Setup, and the invisible disk¶

Choose language and keyboard (Spanish) → Install Windows 11 → I don't have a product key → edition Windows 11 Pro → accept the licence terms. Why Pro and not Home? In Unit 6 this VM joins the domain tramuntana.internal, and the Home edition cannot join a domain.

Then the screen Select location to install Windows 11 shows... no disk at all.

Stop and think. The VM has a 64 GB disk — you saw it in the hardware list. Why is Windows blind?

An operating system talks to every device through a driver: the translator between the OS and one specific device.

Windows carries drivers for SATA and NVMe disks. For a VirtIO disk it carries none. Debian and Ubuntu saw the very same kind of disk without a word, because the Linux kernel already includes VirtIO drivers.

The fix is to give Windows the translator from the second CD:

Load Driver → Browse → the CD drive virtio-win → folder viostor → w11 → amd64 → OK.

One driver appears, Red Hat VirtIO SCSI controller → Install. The 64 GB of unallocated space appears. Select it → Next → Install.

You have just done by hand what happens silently every time you plug in a mouse: the system met a device it could not talk to, and you handed it the translator.

Installed is not licensed¶

You clicked I don't have a product key and Windows went on installing. So is Windows free? No.

A licence is the right to use a copy of a program, under the terms its maker sets.

The installer lets you finish and try. The licence is a separate matter. Without a key, the system runs not activated: a notice on the desktop, personalisation settings locked — and no right to use it for work. Activation is how Windows checks that the copy has a valid licence. You studied the kinds of licence in Software licences.

First-run questions: a local account¶

After the last restart Windows asks its own interview, the out-of-box experience. Route: country Spain → keyboard Spanish → second keyboard Skip → device name win11 → Set up for work or school → Sign-in options → Domain join instead → user student → the lab password → three security questions → privacy switches all off → Accept.

Why this detour? Windows 11 wants a Microsoft account: an online account with an e-mail address. For a lab machine that will join its own domain we want a local account — one that exists only on this PC, like student on the two Linux machines. Domain join instead is the door Windows Pro leaves open for that. Microsoft moves these screens between versions; if yours look different, the goal is the same: a local account called student.

Notice the privacy screen. Did Debian ask whether it could send your location or your typing to its maker? Only one question came close — the package usage survey — and you answered No.

Inspect the system¶

On the desktop, Win+R opens Run. Type each name and press Enter:

The yellow signs in Device Manager are more devices with no translator. Install the rest of the drivers in one go: File Explorer → the CD drive virtio-win → run virtio-win-guest-tools → Next until Finish. Back in devmgmt.msc, the yellow signs are gone.

How many drivers did you install by hand on Debian? None. Not because Linux is cleverer: because those drivers come inside its kernel, and Microsoft does not ship them.

Finally, Start → Power → Shut down. When the VM is off: View → Snapshots → + → name clean → Finish. If virt-manager refuses to snapshot this UEFI machine, your teacher will give you another way back (a clone called win11-clean).

Key takeaways¶

• Windows 11 requires UEFI with Secure Boot, a TPM 2.0 and a recent CPU; Debian and Ubuntu ask for none of them.
• A TPM is a safe for secret keys; in a VM, the program swtpm on the host (the class server) emulates it.
• Windows showed no disk because it had no driver for the VirtIO disk; the Linux kernel already includes one.
• Installing without a key gives a system that is not activated — installed, but not licensed.
• A local account exists only on that PC; Windows pushes an online Microsoft account by default.
• winver, msinfo32, tpm.msc and devmgmt.msc let you check what you built.

Quick check¶

Three systems installed in three days. Now put them side by side, with your own numbers: Three installs compared.