A Feasible Method for Natively Deploying Windows 11 to an External Drive in an Arch Linux Environment (All operations completed by DeepSeek-V4-Flash-0731)

Thanks to DeepSeek-V4-Flash-0731; all operations were executed by it. Arch Linux does not support Tencent's Anti-Cheat Expert (ACE) system, making Tencent games unplayable. Therefore, I attempted to install a native Windows system onto an external drive (1TB SSD + SSK enclosure, high-speed Type-C interface). While creating a system with Windows To Go or WinToUSB is simpler, Tencent's ACE does not support them at all. Native deployment was the only viable path. On Windows, this is typically handled using the DISM tool, but although equivalent tools exist in Linux, the process remains highly complex. Full Deployment Workflow This section provides a fully reproducible workflow. Each step includes a "Verification Point" — do not proceed to the next step if verification fails. Conventions ISO = Windows 11 installation image ( zh-CN preferred) TARGET = Target USB drive (e.g., /dev/sdb ), must be accessed via by-id throughout , using drive letters/kernel device names is prohibited PE = Custom bootable image ( pe.raw ) Formatting and partitioning the target drive is handled automatically by Windows Setup ( WillWipeDisk in unattend.xml ), with no manual partitioning required §1 Disk Identity Verification (Prevent Target Mismatch, Run Every Time) ls -la /dev/disk/by-id/usb- lsblk -o NAME,SERIAL,VENDOR,SIZE,RM # The target disk must have RM=0 (non-removable flag) or a verified serial number; execute operations strictly by-id §2 Unpack the ISO (Full Extraction Required) 7z x /path/Win11.iso -o/path/isorebuild # Verify critical files: ls isorebuild/sources/install.wim isorebuild/sources/boot.wim ls isorebuild/sources/lang.ini && ls isorebuild/sources/zh-CN # Missing these will cause language errors in setup §3 Build the PE Boot Disk Core configuration: Two partitions. Partition Size Filesystem Contents P1 ESP 2G FAT32 EFI boot files + sourcesboot.wim + bootboot.sdi P2 PE 8G NTFS sourcesinstall.wim + full sources directory (setup.exe, lang.ini, zh-CN...) truncate -s 16G pe.raw L=$(sudo losetup -f); sudo losetup -P $L pe.raw sudo sgdisk -o /dev/$L sudo sgdisk -n 1:0:+2G -t 1:ef00 -c 1:ESP /dev/$L sudo sgdisk -n 2:0:0 -t 2:0700 -c 2:PE /dev/$L sudo partprobe /dev/$L; sleep 1 sudo mkfs.vfat -F32 -n ESP /dev/${L}p1 sudo mkntfs -Q -L PE /dev/${L}p2 # P1: EFI boot files sudo mount /dev/${L}p1 /mnt/esp sudo mkdir -p /mnt/esp/EFI/boot /mnt/esp/EFI/microsoft/boot /mnt/esp/sources /mnt/esp/boot sudo cp isorebuild/efi/boot/bootx64.efi /mnt/esp/EFI/boot/ sudo cp -r isorebuild/efi/microsoft/ /mnt/esp/EFI/microsoft/ sudo cp isorebuild/sources/boot.wim /mnt/esp/sources/ # Must be placed here (referenced by BCD [boot] volume) sudo cp isorebuild/boot/boot.sdi /mnt/esp/boot/ # P2: Installation sources (install.wim must reside on NTFS to exceed FAT32's 4GB limit) sudo mount /dev/${L}p2 /mnt/pe sudo mkdir -p /mnt/pe/sources sudo cp -r isorebuild/sources/. /mnt/pe/sources/ # Full set: includes lang.ini, zh-CN, setup.exe # unattend file is placed here as well (setup reads it via CLI arguments) sudo cp assets/autounattend.xml /mnt/pe/sources/unattend.xml Verification Point : ls /mnt/esp/EFI/boot/bootx64.efi /mnt/esp/sources/boot.wim ; ls /mnt/pe/sources/install.wim /mnt/pe/sources/lang.ini . §4 Inject Boot Hook (Key to Installation Automation) Modify files directly inside the extracted directory and capture the WIM again. Do not use wimlib update (modifying official Microsoft WIMs with it has proven unreliable in tests). # Method: apply -> modify -> capture (100% reliable) mkdir -p pe-tree wimlib-imagex apply isorebuild/sources/boot.wim 1 pe-tree # winpeshl.ini: Comma syntax required (space syntax failed in testing) cat > pe-tree/Windows/System32/winpeshl.ini <<'EOF' [LaunchApps] %WINDIR%\System32\cmd.exe, /c X:\run-install.cmd EOF # run-install.cmd: LabConfig hardware check bypass + setup cat > pe-tree/Windows/run-install.cmd <<'EOF' @echo off reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\Setup\LabConfig /v BypassCPUCheck /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f C:\sources\setup.exe /unattend:C:\sources\unattend.xml EOF wimlib-imagex capture pe-tree /tmp/boot-fixed.wim "Windows PE" --compress=LZX --check sudo cp /tmp/boot-fixed.wim /mnt/esp/sources/boot.wim ⚠️ If the captured WIM fails to boot (black screen / firmware restart), revert to the original boot.wim (the installation can still be completed interactively; see the manual branch in §5-2). §5 Launch Fully Automated KVM Installation Key Parameter Considerations sudo qemu-system-x86_64 \ -machine "pc,accel=kvm" -cpu host -smp 4 -m 4096 \ -drive "if=pflash,format=raw,readonly=on,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd" \ -drive "if=pflash,format=raw,file=vars.fd" \ -drive "file=pe.raw,format=raw,if=ide" \ -drive "file=/dev/sdX,format=raw,if=ide" \ -device "usb-ehci" -device "usb-kbd" \ -net none -vga std -display none \ -monitor "tcp:127.0.0.1:4444,server,nowait" \ -serial file:serial.log -no-reboot -machine pc (i440fx) is mandatory : q35 introduces numerous device enumeration issues in WinPE. if=ide is mandatory : Virtual media over AHCI, SCSI, and USB all failed under this setup. -net none : Offline installation (avoids NDUP network path issues). Boot disk = IDE0 → Disk 0 ; Target disk = IDE1 → Disk 1 (Set DiskID=1 in unattend.xml !). unattend.xml Critical Rules (See assets/autounattend.xml for details) windowsPE must contain Microsoft-Windows-International-Core-WinPE (language component; without it, setup stalls on the language screen). CreatePartition only accepts Order/Type/Size/Extend — Format / Active must be configured inside ModifyPartitions (incorrect placement causes an error stating the component or setting does not exist). InstallFrom should use /IMAGE/INDEX or /IMAGE/NAME (e.g., "Windows 11 Pro"). ProductKey can use the generic retail Pro key VK7JG-NPHTM-C97JM-9MPGT-3V66T . Monitoring Screenshot polling (via QEMU monitor TCP interface and socat): echo "screendump /tmp/s1.png" | socat - tcp:127.0.0.1:4444 # Perform OCR to confirm "Copying Windows files / Getting files ready for installation (NN%)" Manual Fallback Branch (If the Captured Boot WIM Fails) The original boot.wim launches setup by default. When the language screen appears: send sendkey alt-n to continue. If "This PC can't run Windows 11" appears, exit to trigger a reboot, press Shift+F10 to execute the four LabConfig reg add commands, and rerun setup (or boot from the injected PE image directly). §6 Phase B: Specialize + Interception Once file installation finishes ("Finishing up" → guest reboots automatically → QEMU terminates due to -no-reboot ): # Relaunch attaching only the target disk qemu-system-x86_64 ... -drive "file=/dev/sdX,format=raw,if=ide" ... -no-reboot Second boot = specialize phase (black screen for several minutes). Power off the VM (via monitor quit ) immediately before or upon the appearance of the initial OOBE screen = Interception point. When booted on physical hardware for the first time afterward, OOBE will begin directly from the Country/Region selection screen without triggering the "Why did my PC restart?" prompt. Verification : sudo sgdisk -p /dev/sdX should display EFI (300M) + MSR + Primary Partition; PortableOperatingSystem must not be set (see §8). §7 Bootloader Repair (Fallback Using Official bcdboot if Setup Leaves ESP Empty) In certain environments, setup's BFSVC fails to write the boot files (logged as BiCreateEfiEntry failed c0000225 ). The root cause remains unconfirmed, but running Microsoft's official bcdboot resolves it. Boot using the PE boot disk (the unmodified boot.wim works) and wait for the "A media driver your computer needs is missing" setup screen. Press Shift+F10 (may require 2–3 attempts to open) → CMD. Run diskpart (execute line by line, allowing each command to complete before entering the next): ​ select…