MediaCreationTool.bat VS shim

Very long story short - the only way I was able to get it to work without BSOD was to install the latest Canary build of Win11. I used this tool: Offline Insider Enroll because I'm running a bootcamp partition on an intel macbook pro. I also needed to use this tool to bypass the TPM check because the macbook pro is not officially supported: Skip TPM Check on Dynamic Update.

I am a longtime Windows User and a big fan of it. Recently, I got the 2017 Intel Mac Pro, which can run Windows from the Mac Bootcamp. Using AveYo/MediaCreationTool.bat I managed to get Windows 21H2 on the Macbook. However, a few updates later, and the Windows software is not updating to 22H2. I tried the requirement disabler from that same url, updating all my drivers, and restarting, to no effect. Hoping someone can help. My computer: https://support.apple.com/kb/SP756?locale=en_US (16 GB RAM, 500GB storage)

You can actually use mediacreationtool.bat and it can enable streamline updates like it is natively supported. Been running it alongside macOS on my Mid 2012 MBP and I often forget that it is an unsupported system.Mediacreationtool.bat Github Though since this is a 4th gen Intel system that OP has they can also just use the Microsoft official workaround. Installing Windows 11 on devices that don't meet minimum system requirements

What I did try before uploading this post, was to use the famous mediacreationtool script from aveyo, and the script seemed to work as Windows Update downloaded and installed the update, but after logging in I found that my build number was still the same.

Use this tool to upgrade 10 to 11: https://github.com/AveYo/MediaCreationTool.bat

What I do is use https://github.com/AveYo/MediaCreationTool.bat to acquire a legitimate iso of windows 10/11 enterprise, then use massgravels MAS(a reverse engineered windows activation script) to permanently activate windows.

Microsoft doesn't really sign other people's code for UEFI. They do sign shim (https://github.com/rhboot/shim) which will look at other keys the user registered with UEFI to load other components to enable you to write custom third party UEFI modules while still supporting secure boot.

In this case, the distros first boot loader is shim, which is signed by Microsoft. Shim is FOSS: https://github.com/rhboot/shim

How do I get dual boot set up and running? There doesn't seem so much documentation about this sbat chicanery as it was introduced to shim in 2021 and patched in rEFInd a bit more than a month ago, so I suppose not enough people have had this trouble yet.

Secure boot still isn't "secure" at all because microsoft has signed multiple bootloaders with their own keys, which exist only to chain load a second bootloader. See https://github.com/rhboot/shim and https://blog.hansenpartnership.com/linux-foundation-secure-boot-system-released/

A new mechanism called SBAT (https://github.com/rhboot/shim/blob/main/SBAT.md) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource consumption

{ echo "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md" echo "systemd-boot,1,systemd,systemd-boot,1,https://systemd.io" } > sbat.csv

Yeah, that incident instigated a totally new approach to revoking bad bootloaders that everybody (including Microsoft) should be using nowadays. So I guess HP just never got the memo.