Technical Anshu
Tutorials Blog
⏭️ Setup Bypasses

Bypass Microsoft Account and Hardware Checks Inside the Windows Image

The bypass checkboxes in the video are not hacks bolted onto Windows — they write documented setup switches into the image itself. Here is exactly what each one changes, and the honest limit of what a bypass can do.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 8 minute read
🎥 Watch the complete video — building a custom Windows ISO, removing unwanted components and setting the bypass options step by step

Two different things get called “the bypass”. The hardware checks (TPM 2.0, Secure Boot capability, minimum RAM and CPU) are policy gates that Windows Setup enforces before installing. The Microsoft account requirement is an OOBE gate that appears near the end of setup. Both can be answered inside the image you build — which is cleaner than typing commands on every machine — but they work by different mechanisms, and one real hardware wall survives them all. This page separates the three routes so you know what your tool is actually doing.

Registry — LabConfig values Setup reads before checking hardware

HKLM\SYSTEM\Setup\LabConfig

BypassTPMCheck        REG_DWORD  0x1

BypassSecureBootCheck  REG_DWORD  0x1

BypassRAMCheck         REG_DWORD  0x1

Status: Setup skips those policy checks — it does not change the hardware

These values live in the setup environment's registry. Customisation tools and answer files both write them; the mechanism is identical.
1

Route 1 — LabConfig Values for the Hardware Checks

  1. During setup, before checking the machine, Setup looks for values under HKLM\SYSTEM\Setup\LabConfig in its own environment
  2. BypassTPMCheck, BypassSecureBootCheck and BypassRAMCheck, each a DWORD set to 1, tell Setup to skip that specific check
  3. GUI customisation tools write these into the setup side of your ISO for you when you tick the bypass options — that is the entire trick, and it is the same one technicians use by hand from the setup command prompt
  4. Because the values must exist before Setup checks the hardware, they belong to the setup environment or the very first pass — which is why route 2 exists
2

Route 2 — The Answer File Issues the Same Commands

An autounattend.xml can write the LabConfig values during the windowsPE pass, before the compatibility check runs. Inside the Microsoft-Windows-Setup component, synchronous commands like this one do the job:

  1. reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f
  2. Repeat for BypassSecureBootCheck and BypassRAMCheck, each as its own ordered command
  3. This route travels with the answer file, so it works with an untouched Microsoft ISO too — no image editing needed
3

Route 3 — BypassNRO for the Microsoft Account Gate

  1. The account requirement lives in the installed system's OOBE, so this flag is set in the install image itself: mount install.wim, load its SOFTWARE hive, and set BypassNRO to 1 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
  2. With the flag set, OOBE offers the offline path and a local account can be created without workarounds
  3. Tools expose this as a single checkbox; offline, it is the same one registry value — verify it in your mounted image before committing
  4. Note the difference in scope: routes 1 and 2 change what Setup checks; route 3 changes what the installed Windows asks for at first sign-in
4

The Honesty Section — What a Bypass Cannot Do ⭐

  1. The POPCNT wall is real hardware: Windows 11 24H2 requires the POPCNT and SSE4.2 CPU instructions at runtime. A bypass removes Setup's checklist, not the code's needs — on a CPU without those instructions the system will not boot correctly, and no registry value changes that
  2. Skipped checks are skipped safety: no TPM means weaker credential protection; no Secure Boot means a weaker boot chain. On a customer's machine, that trade-off is the customer's decision to make knowingly
  3. Support position: Microsoft can change or close these switches in any build, and unsupported configurations are not entitled to the same update guarantees — keep the previous tested master ISO until the new build proves itself
  4. Used knowingly, on suitable hardware, these switches are legitimate technician tools. Presented as magic that makes any old PC "run Windows 11 perfectly", they are not

🎥 Watch the Complete Video Guide

Every checkbox, removal and bypass option from this page is shown live in the full video — watch it end to end before you build your own ISO.

▶️ Watch Full Video
❓ Frequently Asked Questions

Are these bypasses the same as the ones Rufus and other tools offer?

Yes — the mechanisms are identical: LabConfig values for the setup checks and the BypassNRO flag for the account gate. Tools differ only in where they write them (image, answer file, or both), not in what the switches do.

Will the bypass survive Windows updates after installation?

The LabConfig values only matter during setup, so later updates are unaffected by them. BypassNRO matters only during OOBE. What can affect updates is aggressive component removal — a separate issue covered in the Windows Update page of this series.

Can I bypass the CPU check on a really old processor?

You can bypass Setup's CPU list check, but not physics: Windows 11 24H2 uses POPCNT and SSE4.2 instructions in core code paths. On a processor without them the install may complete and still fail to boot. Check the CPU first — the bypass is for policy gates, not missing instructions.

This guide is based on the Technical Anshu video on building your own Windows ISO and removing unwanted components • Stuck on a step? Ask in the video comments — you will get help 🙏