Make a Windows 10/11 recovery or installation USB boot successfully

A Windows recovery or installation USB is inserted, but the computer never reaches Windows Setup, the Windows Recovery Environment, or the Choose an option screen. The firmware may omit or skip the USB, fall through to the internal disk, network/PXE, diagnostics, or a UEFI shell, or Windows Boot Manager may start from the USB and reject its BCD, boot image, architecture, signature, or RAM-disk load.

This writeup ends when the Windows Setup language/keyboard page or WinRE appears. If Setup starts but cannot see the internal disk, requests a driver, rejects a target partition, or fails an installation, the USB has already booted; that later problem belongs to a different writeup.

Searchable Windows error codes and exact messages

If the Windows Setup language page or WinRE appears, BP-054 is resolved even if another error appears later.

Use this procedure when a Windows 10/11 installation USB, Recovery Drive, or supported device recovery USB does not reach Windows Setup or WinRE. It applies whether the USB is missing from the boot menu, is selected but skipped, or reaches Windows Boot Manager and displays a USB-side boot code.

Do not use it after the Setup language page, Install now, Repair your computer, or Choose an option appears. A media driver your computer needs is missing, No device drivers were found, a missing internal disk, target-disk partition errors, and install/upgrade failure codes occur after successful USB boot. Route those separately; RAID, SCSI, VMD/IRST, and specialist storage-driver cases remain deferred. This generic procedure also excludes 32-bit IA32 UEFI devices, which require genuine matching x86 media with \EFI\BOOT\BOOTIA32.EFI; never rename another architecture's loader.

The installed Windows build and the reason the first USB was malformed may remain unknown. The target computer architecture, whether the media is genuine x64 or Arm64 media, whether the required boot files exist, whether firmware lists the USB, and whether WinPE actually started may not remain unknown.

• Access to a known-good Windows computer with a reliable internet connection
• A blank USB flash drive of at least 8 GB for newly created Microsoft installation media
• A second USB flash drive when the first device is suspect
• The target computer's documented one-time boot-menu key
• Current Microsoft installation media, a Recovery Drive made on the target or same supported device configuration, or the device manufacturer's supported recovery image
• Firmware settings photographed or recorded before any change

Creating new media erases the selected USB. Verify its exact removable-disk identity and copy off any needed files before the creation tool runs.

Disconnect unrelated removable disks, card readers, hubs, docks, and external storage. Connect the candidate USB directly to a built-in laptop port or rear motherboard port before power-on. Leave a basic keyboard and display connected. Record the current boot order, USB-boot setting, UEFI/legacy or CSM setting, and Secure Boot state. Prefer the one-time boot menu so permanent firmware settings remain unchanged.

1. Record exactly what happens after selecting the USB. Distinguish these stages:

   • Firmware never lists or never selects the USB.
   • Windows Boot Manager starts from the USB and displays a code.
   • Windows Setup or WinRE starts; any remaining failure is later than BP-054.

2. On a known-good Windows PC, identify the candidate USB by label, capacity, and removable-device details. Use list volume to prove that U: is unused before assigning it. If U: is occupied, choose another unused letter and substitute it throughout this article. Assign the chosen letter only if the USB boot volume lacks a usable one:

   diskpart
   list disk
   list volume
   select volume <USB-boot-volume-number>
   detail volume
   assign letter=U
   detail volume
   exit
   

   Confirm that the second detail display still identifies the candidate USB and shows the intended letter. Stop if assignment fails or the identity changes.

3. Inspect its required files without modifying it:

   dir U:\EFI\BOOT\BOOTX64.EFI
   dir U:\EFI\BOOT\BOOTAA64.EFI
   dir U:\bootmgr
   dir U:\boot\BCD
   dir U:\sources\boot.wim
   dir U:\setup.exe
   chkdsk U:
   

4. Interpret the file check:

   • x64 UEFI media requires \EFI\BOOT\BOOTX64.EFI, \boot\BCD, and \sources\boot.wim.
   • Genuine Arm64 media requires \EFI\BOOT\BOOTAA64.EFI. Do not rename an x64 loader to that name.
   • \bootmgr is the legacy BIOS boot path.
   • A copied .iso file sitting on a USB is not bootable installation media.
   • Missing files or read-only CHKDSK errors mean recreate the media; do not hand-patch it from an unrelated Windows installation.

5. Confirm the target architecture from its model documentation or its currently running Windows if available. On a working Windows installation, Settings > System > About > System type identifies x64 or Arm64.

6. Note that the Windows 11 Media Creation Tool creates x64 media. An Arm64 computer requires supported Arm64 installation/recovery media or the device manufacturer's recovery image.

7. Test the candidate USB on another same-architecture PC if available. Stop at the Setup language page and shut it down without selecting a disk.

8. Interpret that test:

   • Fails on both same-architecture computers: media or USB device is the likely cause.
   • Boots on the second computer: target firmware, USB port/controller, architecture, or Secure Boot trust is the likely cause.

9. On the target, use the one-time boot menu. A single stick can appear twice as UEFI: <USB-name> and BIOS or Legacy: <USB-name>.

10. Select the entry that matches the detected installed layout:

    • Windows 11, or GPT Windows with an EFI System Partition: select the UEFI entry.
    • Existing Windows 10 on MBR with an active NTFS system partition: select the BIOS/legacy entry.
    • Do not change the internal disk to make it match the way the USB happened to boot.

11. If Windows still runs, another supported path is Settings > System > Recovery > Advanced startup > Restart now > Use a device > USB Storage. The wording varies slightly on Windows 10.

12. Once WinPE or Setup starts, open Command Prompt with Shift+F10 and confirm how the USB booted:

    wpeutil UpdateBootInfo
    reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType
    

    0x1 means BIOS and 0x2 means UEFI.

13. Inspect, but do not change, the internal layout:

    diskpart
    list disk
    list volume
    exit
    

14. A GPT asterisk plus an EFI System Partition should normally be repaired from UEFI WinPE (PEFirmwareType 0x2). An MBR Windows 10 disk with an active system partition should be repaired from BIOS WinPE (0x1). If they disagree, exit and boot the same USB through its other labelled firmware entry.

Branch A — Recreate incomplete, unreadable, or manually copied media

1. On the known-good PC, download current Microsoft installation media for another PC with the intended Windows version and architecture. Use recoverydrive.exe only on the target computer or a supported same-model/same-configuration device; a Recovery Drive from an unrelated PC is not generic installation media.

2. For device-specific recovery, use the computer manufacturer's supported recovery-image process. Do not copy a recovery archive to a USB without following its extraction or creation procedure.

3. Insert a blank USB of at least 8 GB.

4. In the creation tool, verify the exact removable target by capacity and name. The tool will erase that USB.

5. Let the tool download, verify, and write the media. Do not interrupt it after writing begins.

6. Safely eject and reconnect the USB. Rerun diskpart > list volume, reidentify it by capacity/label/device details, assign an unused letter if needed, and only then repeat the file checks. Do not assume it retained U:.

7. Cold-boot the target and select the exact USB entry in the one-time boot menu.

8. If the first physical USB remains suspect, repeat the official creation process on a second known-good USB rather than rewriting boot files by hand.

Branch B — Firmware does not list the USB

1. Perform a full shutdown, insert the USB before power-on, and open the one-time boot menu again.

2. Move the USB from a hub, dock, monitor, or front-panel extension to a direct built-in port. On a desktop, prefer a rear motherboard port.

3. Try another built-in port, then the second known-good USB created in Branch A.

4. In firmware setup, confirm that USB Boot, External Device Boot, or equivalent is enabled. Record the original value before changing only that option.

5. Do not change UEFI/legacy mode merely to make the device appear. A correctly created UEFI USB should have a UEFI-labelled entry on supported firmware.

6. If two same-architecture, known-good media devices remain absent from direct ports, stop for OEM firmware or USB-controller diagnosis.

Branch C — Selecting the USB returns to internal Windows, PXE, diagnostics, or a UEFI shell

1. Reopen the one-time boot menu and select the entry that contains the USB manufacturer's or volume name, not Windows Boot Manager on the internal disk.

2. If both firmware variants appear, choose UEFI: <USB> for Windows 11 or a GPT/ESP target. Use the legacy entry only for a known MBR/active Windows 10 target.

3. Respond immediately if firmware displays a Press any key to boot... prompt.

4. If firmware offers Boot from file and the x64 UEFI USB is proven valid, browse only that USB and select:

   \EFI\BOOT\BOOTX64.EFI
   

   On Arm64, use genuine Arm64 media and its BOOTAA64.EFI; never rename or substitute the x64 loader.

5. If the direct file starts Setup, the removable-media fallback entry in firmware was not being selected correctly. Continue to use the one-time entry or obtain the OEM firmware correction; do not alter the internal BCD.

Branch D — The USB displays 0xc000000f, 0xc0000098, or a blinking cursor

1. Record whether the code names \boot\BCD, \sources\boot.wim, another file, or a device.

2. Recheck the USB files and run read-only chkdsk U: on the known-good PC.

3. Recreate current official media on a second USB.

4. Test that second USB on another same-architecture PC, stopping at Setup.

5. Boot the second USB on the target through the correct one-time firmware entry.

6. Do not run BCDBoot or Bootrec against the internal disk; the failure occurred while loading the USB's own boot environment.

Branch E — Secure Boot Violation or 0xc0000428

1. Recreate the media from a current Microsoft or device-manufacturer source before changing Secure Boot.

2. Confirm that the media architecture matches the target and that it boots on another same-architecture Secure Boot computer.

3. Account for the current Windows boot-certificate transition:

   • Devices whose firmware has revoked the older Windows UEFI CA 2011 path may reject old recovery media. Create current 2023-signed media.
   • Firmware that does not yet trust the Windows UEFI CA 2023 path may reject newly signed media. Obtain the computer manufacturer's firmware and Secure Boot certificate update.
   • Custom WinPE media must be rebuilt with a current Windows ADK and its supported 2023-signed boot-media option.

4. Do not blindly restore or clear default Secure Boot keys. That can remove newly required trust entries and can also stop the installed Windows Boot Manager from loading.

5. Do not make permanent Secure Boot disablement the general repair. If current official media still fails signature verification, stop for the OEM or managed-device administrator with the exact firmware version and trust state.

Branch F — 0xc0000017 or 0xc0000225 while the USB loads WinPE

1. Fully power off instead of using Restart.

2. Recreate current media on a second USB and retest from a direct port.

3. Disconnect nonessential USB devices and expansion hardware that can consume firmware address space.

4. Manually return only individually recorded overclock, memory-timing, or firmware resource-allocation settings to documented safe values. Do not load global firmware defaults; that can silently change storage mode, UEFI/CSM mode, Secure Boot state, TPM state, and boot order.

5. If the same RAM-disk or inaccessible-device code occurs with two verified media devices, run firmware/OEM memory diagnostics. Stop Windows disk repair until RAM and firmware memory mapping are stable.

Branch G — Setup starts in the wrong firmware mode

1. Do not select Delete, Format, New, clean, or convert on the internal disk.

2. Close Setup or run:

   wpeutil shutdown
   

3. Power on and reopen the one-time boot menu.

4. For a GPT disk with an existing ESP, select UEFI: <USB> and confirm PEFirmwareType 0x2 after Setup starts.

5. For an existing MBR/active Windows 10 installation, select the BIOS/legacy USB entry and confirm PEFirmwareType 0x1.

6. Re-enter Repair your computer only after the boot mode matches the installed layout.

• The Setup language page or WinRE appears: The USB now boots. Stop this procedure and use the recovery tool required by the underlying Windows problem.
• The USB boots on another same-architecture PC but is absent on the target: Focus on target firmware, port/controller, architecture, and Secure Boot trust.
• A second officially created USB boots: The first media or flash device was incomplete, corrupt, or unreadable.
• Selecting the UEFI-labelled entry resolves a GPT-target error: The original USB boot used legacy mode; the disk did not require conversion.
• Setup asks for a storage/media driver or cannot see the internal disk: USB boot succeeded. Route to the appropriate driver or storage-path diagnosis; specialist RAID/VMD/IRST cases remain deferred.
• Current official media still produces 0xc0000428: Preserve the exact named file and firmware trust state; do not bypass signature enforcement as a permanent solution.

• Do not copy an ISO file to a USB and assume it is bootable.
• Do not rename BOOTX64.EFI to BOOTAA64.EFI or otherwise substitute x64 media on Arm64.
• Do not use a Recovery Drive made on an unrelated PC as generic Windows installation media.
• Do not rebuild the internal disk's BCD because the USB's BCD failed.
• Do not clean, initialize, convert, delete, create, or format the internal disk to make Setup accept the current boot mode.
• Do not permanently change UEFI/legacy mode when the one-time boot menu exposes the correct USB variant.
• Do not clear Secure Boot keys or permanently disable Secure Boot as the default response to an old or incorrectly signed USB.
• Do not conclude that the USB failed when Windows Setup or WinRE has already appeared.

Exit Setup or WinRE. At a WinPE Command Prompt, shut down cleanly:

wpeutil shutdown

Remove the USB. Restore every firmware boot-order, USB-boot, CSM/legacy, or Secure Boot value to the recorded starting value. A one-time boot-menu selection normally leaves nothing to undo. No internal partition or BCD should have changed under this procedure. Media Creation Tool or Recovery Drive changes to the selected USB are reversed only by restoring that USB from its own prior backup.

• The Windows Setup language/keyboard page or WinRE Choose an option appears from the USB.
• Shift+F10 opens X:\Windows\System32\cmd.exe.
• PEFirmwareType is 0x2 for a GPT/ESP Windows target or 0x1 for an existing BIOS/MBR Windows 10 target.
• diskpart > list disk and list volume can inspect the target without modifying it.
• The USB cold-boots a second time through the same one-time entry.
• The internal Windows disk and BCD remain untouched by this media-boot procedure.

Confidence is high when missing media files, wrong architecture, wrong firmware entry, or a reproducible Secure Boot trust mismatch is demonstrated and corrected. Confidence is moderate when the USB boots elsewhere but target firmware provides no precise rejection. Stop if multiple known-good same-architecture USBs are absent from direct ports; the architecture is unknown; an Arm PC has only x64 media; the device is 32-bit IA32 UEFI; current official media still fails signature verification; Secure Boot database state is unclear or organization-managed; 0xc0000017 or 0xc0000225 persists across two verified media devices; USB reads fail; or the only proposed path requires clearing Secure Boot keys, permanently disabling Secure Boot, changing the installed Windows firmware mode, or converting/formatting the internal disk.