The open-source MultiOS-USB tool just eliminated one of the most awkward steps in deploying Windows from a multiboot drive: turning off Secure Boot. Version 0.12.1, released on July 12, 2026, finally allows Windows installation without first venturing into firmware settings to weaken system security. The update also moves the default file system to exFAT, making it far easier to handle installer images larger than 4GB.

The release addresses a persistent headache for anyone who carries multiple bootable ISOs on a single USB stick or external SSD. Previously, the project’s documentation explicitly warned that Secure Boot had to be disabled before starting a Windows 10 or Windows 11 setup—a detour that varies unpredictably across device manufacturers and often leaves less experienced users stranded in opaque UEFI menus.

Secure Boot Support Finally Lands

According to the project’s GitHub release notes, the headline change is a new path for installing Windows that doesn’t require Secure Boot to be turned off. This is a major convenience upgrade, but it’s not a completely seamless experience. MultiOS-USB’s own documentation clarifies that on a PC booting the drive for the first time with Secure Boot enabled, you may need to enroll the drive’s custom certificate from the EFI system partition.

In practical terms, you’ll still be asked to enter the UEFI firmware menu, navigate to the Secure Boot settings, and select the option to enroll a new key or certificate from the USB drive. Once enrolled, the drive will be trusted and subsequent boots should proceed without intervention. This means the tool remains squarely aimed at people who are comfortable poking around in firmware settings—it’s not a one-click replacement for Microsoft’s Media Creation Tool, but it removes the need to fully disable Secure Boot, which many users are understandably reluctant to do.

exFAT Replaces FAT32 as the Default File System

The second significant change: newly created MultiOS-USB drives now default to the exFAT file system instead of FAT32. This is a pragmatic adjustment driven by the realities of modern Windows ISOs. A single Windows 11 image can easily surpass the 4GB file-size limit that FAT32 imposes. With exFAT, you can drop multiple large ISOs onto the drive without splitting them or resorting to workarounds.

The trade-off, acknowledged by the developer with a tongue-in-cheek “sorry Ubuntu” in the changelog, is reduced compatibility with some Linux distributions. Older or minimal Linux boot environments may lack the built-in exFAT support that Windows and macOS have long included. If you’re assembling a recovery toolkit for aging hardware or a fleet of mixed-age machines, test boot on your target Linux ISOs before ditching existing FAT32 media. For most modern systems—Windows 10/11, recent Ubuntu releases, and popular live distros—exFAT should work without issue.

A Nod to Microsoft Account Bypass

The third bullet in the release notes adds documentation on bypassing the Microsoft account requirement during Windows 11 setup. This isn’t a new automated feature; rather, the project is pointing users toward existing methods (such as using a generic offline account email or the OOBE\BYPASSNRO command). Treat this as helpful guidance rather than a guarantee that every install image and setup path will behave identically. If you frequently set up machines without Microsoft account sign-in, the note serves as a handy reminder, but you must still adapt to the quirks of your specific Windows version.

Who Benefits Most

Home users and PC builders. If you keep a single bootable USB stick to install Windows on a new PC or revive an older one, the Secure Boot change removes a major anxiety point. You no longer need to research your motherboard’s specific key combination to enter setup, hunt for the Secure Boot toggle, and remember to re-enable it afterward. The initial certificate enrollment is a one-time step per drive, and it’s far less risky than disabling Secure Boot entirely.

IT administrators and support technicians. The ability to combine Windows installers, WinPE recovery environments, Linux live media, and diagnostics on one drive just became significantly more practical. Many enterprise environments mandate Secure Boot, so having a tool that works within those policies simplifies device deployment and troubleshooting. Test the new workflow on a sample of your hardware fleet, paying special attention to older UEFI implementations that might handle certificate enrollment differently.

Developers and tinkerers. The exFAT default is a double-edged sword. It’s ideal for Windows-focused workflows, but if you often boot obscure or outdated Linux ISOs, you may want to stick with FAT32 or reformat after creation. The project’s own recommendation: use the image-based installation method for Windows, then copy ISO files into the drive’s ISOs directory. That approach keeps the boot loader tidy and makes it easy to add or remove images later.

How We Got Here

MultiOS-USB emerged as an open-source alternative to tools like Ventoy and YUMI, offering BIOS and UEFI support, ISO-based Linux boot, WIM-based WinPE loading, and locally installed OS booting from a single drive. Until version 0.12.1, Secure Boot had been a known limitation: the project’s own documentation carried a clear warning that it must be disabled for Windows setup. That put it at a disadvantage for anyone working in security-conscious contexts, and it created an extra step that could break if the user forgot to restore the Secure Boot state afterward.

Microsoft introduced Secure Boot with Windows 8 in 2012, and it became a requirement for Windows 11-certified hardware. The feature relies on cryptographic signatures to ensure that only trusted software runs during the boot process. Multiboot tools have historically struggled with Secure Boot because they need to load their own boot loader before handing off control to the selected operating system—a chain that the firmware may reject if it isn’t signed with a trusted key. MultiOS-USB’s solution to offer its own certificate for enrollment is a proven approach, also used by other multiboot utilities, but it’s the integration into a free, open-source tool alongside seamless Windows installation that makes this release notable.

The shift to exFAT mirrors a broader trend away from FAT32 for bootable media. Microsoft’s own Media Creation Tool has long formatted USB drives as NTFS for Windows installer images larger than 4GB, but NTFS can pose compatibility issues with non-Windows boot environments. exFAT offers a middle ground: broad modern OS support, no file-size cap, and the lightweight directory structure that suits BIOS and UEFI boot loaders.

What You Should Do Right Now

If you already use MultiOS-USB, download the 0.12.1 release from the project’s GitHub page and test the new Secure Boot Windows installation path on a spare machine or VM. Pay close attention to the certificate enrollment dialog—you may need to interact with it only once per drive, but the exact steps will vary by firmware vendor.

When creating a new drive, the default filesystem is now exFAT. If you need to support older Linux distributions that lack exFAT drivers, consider reformatting to FAT32 after installation (the tool allows that, though you’ll need to split any ISO files larger than 4GB). Alternatively, keep two drives: one exFAT-based for modern Windows and Linux ISOs, and one FAT32 for legacy hardware.

For Windows 11 installs, the Microsoft account bypass methods remain unofficial and may change with future Windows updates. If you rely on them, keep a note of the current workaround (like using the email address [email protected] and a random password, or triggering the OOBE\BYPASSNRO command via Shift+F10) and verify that it still works with your image version before heading out on a deployment job.

Outlook

Secure Boot compatibility brings MultiOS-USB closer to parity with commercial tools, but the certificate enrollment step means it will likely never become a truly invisible consumer product. That’s fine for its intended audience of technicians and hobbyists, who will appreciate the transparency and control. Future releases may refine the enrollment process or expand the list of trusted certificates to reduce manual steps further. For now, the 0.12.1 update removes a major irritant and makes one of the most versatile multiboot utilities significantly more usable for Windows deployments.