Booting live Linux (Mint) from USB flash drive on Win11-Pro laptop = Nightmare?
 

Life was good on Win7 laptop with BIOS.

Now I also have a rather recent HP Elitebook 865 with Win11 Pro, Secure boot is checked and Bitlocker enabled on the C:Drive. Mint Cinnamon 22.3, 'burnt' with Rufus on USB flas drive.

I ran into problems and investigated a bit the following areas, here is what I found so far:
- Secure Boot --> Should not be a problem. I was for me, though.
- Bitlocker can be/is? a problem
- Device Control Access Mode can be/is? a problem?

What else? The remedies for the above problem areas sound very un-appealing. I am very hesitant to play around with BIOS/UEFI settings (other than selecting boot device) and things that can impact my Win11 laptop. I will not bore you with the specific problems I ran into yet, rather ask a general question first:

Are there any Linux Distros which do NOT have any issues with systems like the one I described here? I.E., distros that 'just work', at least for booting a Live Linux session from a USB flash drive? I can not believe the hoops (potentially) required to achieve a task which was a snap on older systems, like laptops with Win7/BIOS.

#1 I solve by always turning off secure boot. IF it is GONE it is not a problem. And it was never really secure anyway.
#2 IS not a problem unless you decide you want to access encrypted drives from a non-native operating system. (WHY? What is the point of encryption if you are going to open the lock anyway?)
#3 has never been a problem for me, but then I never tried anything likely to MAKE it a problem. I am thinking someone else might be the better one to respond there.

I use a VENTOY device with about 12 live distributions loaded, two with persistence. I never access any native local storage that is not on a USB device when I use those, unless I am troubleshooting hardware or software issues.

Is your windows 11 installed on a gpt drive which would require windows to be installed in UEFI mode?

Did you shrink the windows partition to create unallocated space on the drive, if you are installing to the same drive on which you have window?

You should be able to install Mint or many other Linux distributions on that computer. You indicate that you had problems but don't indicate what they are so it will be impossible to give specific problems without know what the problems are. Are you having problems installing or booting the usb and what are the problems?

Which generation? There are three generations of the 865 (G9, G10, G11).

Secure Boot:
Mint 22.3 supports Secure Boot out of the box, it's not a Linux issue, but most likely your HP BIOS having "Microsoft Third-Party CA", if you don't want to disable Secure Boot, make sure "Microsoft Third-Party CA" is enabled.
BitLocker:
This is a non-issue for a Live session. BitLocker encrypts the Windows partition, but it does absolutely nothing to stop the laptop from booting a completely separate operating system from a USB drive. It only matters if you try to mount your Windows drive from inside Linux.
Windows Fast Startup:
When you click "Shut Down" normally, Windows 11 doesn't actually turn off, it enters a hybrid hibernation state.
To bypass this without changing permanent Windows settings, you could hold down the Shift key while clicking on Shut Down.

Following the Mint installation guide, and verifying the download is also important, using Balena Etcher as recommended in the guide instead of Rufus might worth a try. I recommend version 1.18.11

Toggling an option in the BIOS to allow third-party certificates won't break or impact your Windows 11 installation.

That said, without knowing the specific errors or symptoms you ran into, it is impossible to give you a solution.
Mint is one of the distros that "just works".

To make clear what I want, step by step:

Step 1: Boot a Live Linux session from the USB flash drive. On Windows 7 and Vista laptops I NEVER had a problem with this step, including now with Mint 22.3 Cinnamon, using Rufus for ISO 'burning'.
Problem with this step on Win11 Pro, HP Elitebook 865 G11:
a) Did nothing in UEFI/BIOS (except boot sequence - getting into that is another lottery on my laptop, have to be very fast with pushing ESC) and the boot failed immediately with some nasty 'can not authenticate' (or something like that) message. So I disabled Secure Boot, and then ran
into (after overcoming that nasty Bitlocker recovery key screen) the next issue:
b) Boot started, I saw a lot of Linux commandline stuff scrolling by, with a lot of "Success/OK" status, but then I got a KERNEL PANIC, without any code or status. The Mint logo never showed up and the laptop 'hung' and had to be restarted brute force, pushing power button to shut down.

Step 2: Run the Life session, see if all (Wifi, external drives) works, including access to Windows files on the hard disk.

Step 3: Run Linux in a Virtualbox (this is another Win11 Pro nightmare with Hyper-V etc., not the point here).

Step 4: Dual boot linux with win11.


I did all that in a snap on Windows 7 and Vista machines, but on Win 11 Pro I do not even get over step 1, as described.

Linux is around for a long time, so is Windows 11. Why aren't there complete, comprehensive and authoritative guidelines about these in principal
trivial issues? It is obvious that I am not very knowledgeable in this (yet), but I am a (retired since quite some time) scientist and (SW) engineer (lots of Linux command line work with SW development) and can learn and comprehend. For that I prefer pointers to contextual documentation rather than "try this and try that", some of which I never heard of. I am not in a hurry, so a from-the-ground-up approach is fine with me. Of course I also am willing to experiment, but armed with some comprehensive material that is much easier for me.

That would be because Microsoft does not WANT there to be and keeps intentionally breaking things that have been known to work in the past. It is a tech game of Whack-a-Mole trying to keep up with every "fix" they add that breaks everything ELSE!

I gave up dual booting LONG ago (Win7 was the last one I used that worked). But I still have been able to boot a live session from USB key, generally using Ventoy. I cannot tell if you have hardware settings issues (perhaps with fixes that have been blocked at the BIOS level). And since I do not run into the problem I have not run into a fix.

Which specific ISO image did you use, and where did you get it? Did you check the CRC code to ensure it was not corrupted or tampered with?

PS. I hopped over to the forums for DEBIAN and DEVUAN and there are traces of the ISO images having boot issues on some platforms. I am not saying this is related, but it may be.

linuxmint-22.3-cinnamon-64bit from the Mint website, did the CRC OK and, as said, it worked fine on my win7 laptop, which it would not if it was corrupted in any way, no?

So, when you were able to boot a live session (on Win11, I assume?), what exactly did you tweak in the BIOS/UEFI, in addition to the initial boot device selection?

That suspicion about MSFT came to my mind, too.

As far as wanting to run full linux on the hard drive while giving up on dual boot on 'modern' win11 laptops, what to do? Buy a dedicated Linux machine (where?),
or buy a (cheaper) Win 11 Home (not Pro) laptop and install Linux over it, once the live session is OK?

Another thing: Might putting the bootable USB (type A) into an USB hub (I did that) instead of directly into a USB slot on the win11 machine itself be a problem? On the win 7 machine, where it worked, I put it directly into a laptop slot. Another 'modern' pest are the slim laptops these days, with few USB-A slots, hence the hub.

In the best of all worlds I would like to have a thick laptop with at least 2 distinct hard drives. My old dual boot vista/linux lite laptop is of that type and dual boot setup was easy. Where to get thick, multi drive laptops these days?

I suspect that if ther was a download flaw or it had been tampered with the CRC would show a mismatch. I do not think Mint is the issue.

About your boot question: If you mean me, the latest WIN machine I have access to now is running WIN10. No one wants to run WIN11 here.
With MINT, the last time I booted it, there was no special BIOS setting required. We used a single-boot menu option available on our DELL laptops and it just works. Your HP is a very different machine, and I have no access to that model hardware to review or test.

I am hoping someone else with hardware from HP that either matches or is very close will run some tests and see if they can replicate your issue. I cannot.

This sounds like the "Microsoft Third-Party CA" issue mentioned earlier, there is no need to disable Secure Boot.

According to the User Guides for the HP Elitebook 865 G11, specifically the HP PC Commercial BIOS (UEFI) Setup Administration Guide, under "4.5 Secure Boot Configuration Menu":

" This sounds like the "Microsoft Third-Party CA" issue mentioned earlier, there is no need to disable Secure Boot.

According to the User Guides for the HP Elitebook 865 G11, specifically the HP PC Commercial BIOS (UEFI) Setup Administration Guide, under "4.5 Secure Boot Configuration Menu":"

I think that is very helpful and might be 'it'. I will study that guide to bring myself up-to-speed on these issues, which I am not very competent in (yet).