One stick in your pocket, two completely different PCs on the desk: a wheezing legacy desktop and a brand-new Secure Boot laptop. There is a recipe that gives that stick the best possible chance on both — and one honest corner where no single stick can win.
Compatibility is about removing reasons to fail. A legacy BIOS PC can only boot an MBR stick. A UEFI PC can boot a GPT stick — and usually an MBR one too, as long as the stick is laid out so UEFI can read it and Secure Boot accepts its boot files. So the both-PCs recipe is: MBR scheme, a standard Microsoft-signed installer, FAT32 where possible, and picking the correct entry in the boot menu at each machine. Here is the recipe, its conditions, and the point where two sticks honestly beat one clever one.
👆 Example boot menu. The same stick listed twice is normal — the UEFI: prefix is a different door into the same stick.
Or skip the building: a Ventoy stick in its default MBR style follows the same logic and carries many ISOs at once.
The same stick appears in boot menus under two entries: its plain name and its name prefixed with UEFI:. They are two doors into the same stick. On a modern PC, choose the UEFI: door — setup then runs in UEFI mode and installs Windows onto GPT, as a modern PC should be. On the legacy desktop, only the plain door exists; choose it and setup runs in legacy mode. Picking the plain door on a UEFI PC is the classic self-inflicted wound: the install "works", but Windows lands in legacy mode on a machine that deserved better.
FAT32 cannot store a single file larger than 4 GB, and some Windows images carry an install image file bigger than that. Tools solve it two ways: splitting the big file into smaller parts (clean, works everywhere, Rufus and DISM can do it), or using NTFS plus a small UEFI driver to read it (Rufus's approach — works widely, but that helper driver is not Microsoft-signed, so a strict Secure Boot machine may refuse the stick until Secure Boot is paused). If your both-PCs stick must face Secure Boot machines untouched, the split-file FAT32 layout is the one that never argues.
A growing class of new laptops ships with CSM removed and Secure Boot enforced by policy. On those, an MBR stick built the NTFS way may not boot at all, and even the FAT32 way depends on the firmware offering a suitable entry. No recipe repeals a firmware policy. This is why working technicians carry two sticks: the both-PCs MBR stick from this page, and a pure GPT UEFI stick for the modern-only fleet. Two cheap sticks, zero refused boots — the honest end of the compatibility story.
The video shows both schemes being built and explains when each belongs on your keyring — watch it before your next multi-PC day and pack the right pair of sticks.
▶️ Watch Full VideoIf old PCs are truly out of your world, do exactly that — GPT plus UEFI is the cleaner standard. This recipe exists for mixed reality: offices, homes and repair benches where the legacy desktop still runs the accounts printer and cannot be wished away.
Both follow the same MBR logic. Rufus gives you one ISO per stick with the least machinery; Ventoy gives you every ISO you own on one stick with a menu. For a working toolkit, Ventoy in default MBR style is the common professional pick.
Likely causes: the stick was built NTFS-style and this firmware will not list it under Secure Boot, or the stick is not FAT32-readable by the firmware. Remake it with the split-file FAT32 layout. If the entry still does not appear, test the stick on another UEFI PC to separate stick faults from this one firmware.