How to make a bootable USB stick with Rufus

A bootable USB stick holds a whole operating system that a PC can start from instead of its own drive. Use one to install or reinstall Windows 11, try Linux without changing the PC, or rescue files from a computer that won't start. This guide uses Rufus to make a Windows 11 installer and a Fedora live stick, then shows how to start a PC from it, fix problems, and wipe it back to normal. Allow about an hour, mostly downloading.

What you need

• A USB stick that will be completely erased. Copy off anything you want to keep.
  • Windows 11: Microsoft asks for at least 8 GB, but the download alone is about 7 GB, so use 16 GB or more.
  • Linux: Fedora needs 4 GB; most Linux downloads fit on 8 GB.
• A Windows PC to make it on (Windows 8 or later) where you can approve administrator prompts. Rufus needs them to write to drives.

Get Rufus

Rufus has no installer: both downloads, Standard and Portable, run as soon as you open them. Portable just keeps its settings in a file beside it rather than in the Windows registry.

1. Open our Rufus page and follow the official download link. Take Standard for Windows x64 (version 4.15 at the time of writing), or ARM64 for a PC with an Arm processor.
2. Open the file. Windows asks for permission and should show Akeo Consulting as the verified publisher.
3. Click Yes. If the publisher is unknown, click No, delete the file and download it again.
4. The first time, it asks whether it may check for updates online. Click Yes: this also enables its built-in Windows download.
5. If it offers updated DBX files (its list of blocked boot programs), click Yes.

The main window opens, with Device at the top and START at the bottom.

Part 1: a Windows 11 installer

Get the Windows 11 ISO

An ISO is a single file holding a whole installation disc.

From Microsoft's website:

1. Open Microsoft's Windows 11 download page.
2. Under Download Windows 11 Disk Image (ISO) for x64 devices, open Select Download and choose Windows 11 (multi-edition ISO for x64 devices).
3. Click Download Now. A language list appears.
4. Pick your language from Choose one (British English is English International) and click Confirm.
5. Click the download button that appears. The link lasts 24 hours.

Arm PCs need the Arm64 ISO, linked from the same page.

From inside Rufus:

1. Click the small arrow on the right of SELECT and choose DOWNLOAD.
2. Click the button, which now reads DOWNLOAD. The Download ISO Image window opens.
3. Choose Windows 11 under Version and click Continue. Repeat for Release (the latest), Edition (Windows 11 Home/Pro/Edu), Language and Architecture (x64 for most PCs); the last button reads Download.
4. Choose where to save. The ISO downloads and is selected for you.

No arrow means update checks are off or the PC was offline at start-up; use Microsoft's page. Error code 715-123130 is Microsoft refusing, usually after many downloads or through a VPN: turn off the VPN or wait a day.

Choose the settings

Plug in the stick and work down the main window:

Choose MBR only for a PC too old for UEFI (most made before about 2012); Target system then reads BIOS (or UEFI-CSM).

1. Click START. The Windows User Experience window opens (next section).
2. Tick the options you want and click OK.
3. A warning says all data on the named device will be destroyed. Check the name and click OK.
4. Wait while the bar fills: about 5 to 20 minutes on USB 3, longer on USB 2.
5. When the bar reads READY, click CLOSE.

If an error appears, close File Explorer, try another port or stick, and start again.

The Windows User Experience options

These change how Windows sets itself up on the target PC. The first two start ticked; later choices are remembered.

• Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0: Setup skips those checks, which is harmless on a PC that passes them. Microsoft's position: a PC below the requirements "will no longer be supported and won't be entitled to receive updates".
• Remove requirement for an online Microsoft account: allows setting up without a Microsoft account, but on its own only if the PC is offline (no cable, no Wi-Fi) at the account screen.
• Create a local account with username: creates the account for you, so you normally needn't go offline. The box starts with your current user name; Administrator and Guest aren't allowed. The account is an administrator with a blank password, and Windows asks you to set one at first sign-in.
• Set regional options to the same values as this user's: copies this PC's keyboard, time zone and formats.
• Disable data collection (Skip privacy questions): answers no to Setup's data-sharing questions.
• ⚠SILENTLY⚠ erase disk and install: appears once the local account, regional and data collection options are all ticked. Leave it unticked: the stick would wipe the first disk it finds and install without asking, on any PC started from it.
• Disable BitLocker automatic device encryption: stops Windows encrypting the drive by itself. Encryption protects a lost laptop, but the recovery key is only backed up automatically to a Microsoft account, and Microsoft notes a local-account-only PC "remains unprotected even though the data is encrypted". You can switch it on later.
• QoL improvements (Don't force Copilot, OneDrive, Outlook, Fast Startup, etc.): removes OneDrive and Outlook and turns off Copilot, Start menu ads, news and Fast Startup. If you use OneDrive, skip it; undoing it means a registry edit.
• Use 'Windows CA 2023' signed bootloaders (Requires a compatible target PC): tick only if you know the target PC has Microsoft's 2023 Secure Boot certificates. On other PCs the stick won't start with Secure Boot on.
• Apply SkuSiPolicy.p7b on installation (See KB5042562): expert boot hardening that can stop ordinary Windows sticks starting on that PC later. Leave it unticked.

Part 2: a Fedora live stick

Most Linux ISOs work the same way.

1. On our Fedora page, follow the official download link and save the Live ISO for x86_64 (ordinary Intel and AMD PCs).
2. Plug in the stick, open Rufus and choose the stick under Device.
3. Click SELECT and pick the ISO. Partition scheme should read MBR and Target system BIOS or UEFI, which starts on old and new PCs; if not, set MBR.
4. Click START. A window titled ISOHybrid image detected asks how to write the image.
5. Choose Write in DD Image mode and click OK.
6. Click OK on the warning.
7. When the bar reads READY, click CLOSE.

DD mode copies the image byte for byte, the same stick Fedora Media Writer makes. Afterwards Windows can't read it, so it may look tiny or offer to format it: click Cancel. The last section gets the space back.

Write in ISO Image mode (Recommended) copies files instead, so Windows can still read the stick; if a stick made one way won't start, try the other. ISO mode may show Download required, because the image uses a different GRUB or Syslinux version (the programs that start Linux) from the built-in one: click Yes.

To try or install Fedora from here, carry on with our step-by-step guide.

Part 3: start a PC from the stick

With the boot menu key

1. Plug the stick into the PC directly, not through a hub.
2. Switch the PC off and on, and straight away tap your brand's key (below) until a menu appears.
3. Pick the stick with the arrow keys (it may show a brand name or start with UEFI) and press Enter.

You should see Windows Setup or a menu that starts Fedora. If Windows starts as usual, see Troubleshooting.

From Windows

If the PC still starts Windows:

1. Plug in the stick.
2. Open Start → Settings → System → Recovery.
3. Next to Advanced startup, click Restart now, and confirm if asked.
4. On the blue Choose an option screen, click Use a device, then the stick.

No Use a device? Use the boot menu key.

Secure Boot

Secure Boot only lets signed boot programs run. Leave it on: the boot files on both sticks are signed, including the NTFS helper Rufus adds (since version 3.17). If you get a Secure Boot or security violation message:

• On a Linux stick, download the current ISO. Windows updates block older Linux boot loaders, shown as Verifying shim SBAT data failed: Security Policy Violation.
• Some business laptops (Secured-core PCs) trust only Microsoft's own key until you allow third-party certificates in the firmware's security settings; Lenovo calls it Allow Microsoft 3rd Party UEFI CA.
• If you ticked Use 'Windows CA 2023' signed bootloaders, remake the stick without it.
• As a last resort, switch Secure Boot off to install, then back on.

Troubleshooting

The stick doesn't show in Rufus

• Replug it into a port on the PC itself.
• External SSDs and hard drives are hidden so you can't wipe a backup by mistake. To list them, click Show advanced drive properties and tick List USB Hard Drives; double-check the size.
• A stick reported as write-protected or without media has almost certainly failed. Use another.

"This PC can't run Windows 11"

Setup shows this when the PC lacks TPM 2.0, Secure Boot or 4 GB of memory. Upgrading from inside Windows shows "This PC doesn't currently meet Windows 11 system requirements".

• Check the firmware first: many PCs ship with the TPM (often called Intel PTT or AMD fTPM) or Secure Boot switched off. Turning them on makes the PC supported.
• Otherwise, remake the stick with Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0 ticked. That also covers upgrades started with setup.exe on the stick.
• If the message mentions PopCnt or SSE4.2, the processor is too old for current Windows 11; no tool gets round that.

The PC ignores the stick

• Use Use a device from Windows instead of the key.
• If the firmware has a Fast Boot option, turn it off; it can skip USB devices.
• Try another port, at the back of a desktop.
• BIOS/LEGACY BOOT OF UEFI-ONLY MEDIA on screen means the PC is in Legacy or CSM mode. Switch it to UEFI in the firmware, or remake the stick with MBR.
• Remake a Linux stick in the other mode (DD or ISO).

Installation is stuck

• Slow sticks can leave Setup on one percentage for a long time. Give it an hour.
• If Setup starts over after the first restart, unplug the stick as the PC restarts.
• If Setup lists no drive to install to (common with Intel 11th-generation and newer processors), it needs the Intel Rapid Storage Technology driver. Download it from the PC maker's support page, extract it onto the stick, and click Load driver in Setup.
• If copying fails or Setup crashes, remake it on another stick. Check device for bad blocks under Show advanced format options tests a stick first, slowly.

Alternatives

• Ventoy: set up the stick once, copy ISO files onto it like normal files, and choose one from a menu at start-up. With Secure Boot on, each PC needs a one-time key enrolment.
• balenaEtcher: a simple writer for Linux and Raspberry Pi images, on Windows, macOS and Linux. It doesn't make Windows installers; it points you to Rufus for those.
• Fedora Media Writer: downloads and writes Fedora in one go on Windows, macOS or Linux, and restores the stick afterwards.

Afterwards: make it a normal stick again

The easy way is Rufus itself:

1. Plug in the stick, open Rufus and choose the stick under Device.
2. Set Boot selection to Non bootable.
3. Set File system to exFAT for computers and most devices, or FAT32 for older TVs and car stereos.
4. Type a name under Volume label.
5. Click START, then OK on the warning.
6. At READY, click CLOSE. File Explorer shows the stick at full size.

If Rufus can't see or fix it, use Windows' diskpart tool.

1. Click Start, type diskpart and press Enter.
2. Click Yes. A window with a DISKPART> prompt opens; press Enter after each command below.
3. Type list disk. Find your stick by size; it shows a little less than the size printed on it.
4. Type select disk 2, using your stick's number instead of 2.
5. Type detail disk. Check the name is your stick's and the Type line says USB. If not, type exit and stop.
6. Type clean.
7. Type create partition primary.
8. Type format fs=exfat quick label=USB.
9. Type assign. The stick appears in File Explorer.
10. Type exit.

A stick written in DD mode can also be fixed with Fedora Media Writer: choose Restore followed by the stick's name, click Next, then Restore, and Finish when done.