You did a lot out of the ordinary, you disabled services and uninstalled/removed/disabled features like Defender through Winaero Tweaker. You have no idea how many PCs I've seen broken by this type of s**t. Never use these "privacy" apps without a full backup of the OS partition.
Is there a trick to making SecureBoot-friendly USBs with these larger install.wim NTFS-only refresh builds? The old Win7 USB tool can't do it (won't boot at all), RUFUS outright says it can't do it (and it also makes the USB weird anyway) and the MCT still uses FAT32 with install.esd. Note that I am not opposed to using an install.esd if it's a newer build (316, etc.)
Yeah, because the install.xxx is less than 4GB, so it's using FAT32. FAT32 has a hard file size limit of 4GB, and newer install.wim files, like the February 2019 edition, are over 4GB. Rufus will automatically set it to NTFS when it detects these, and it gives a blurb about using it's own mechanism for making the UEFI NTFS USB, and explicitly says SecureBoot won't work with it.
Is there a tool that lets you create a UEFI NTFS flash drive that works with SecureBoot? Currently I am converting WIM to ESD when the install.wim file is over 4GB.
I should've been more clear, I stopped using Rufus and just use the Windows Media Creation Tool and forget about it. I'm just using the regular Windows ISOs that it provides but the older version of Rufus can burn larger than 4GB ISOs whilst still being able to enable Secure Boot
I was having issue dual boot of windows 10 with GPT format and using rufus 3.4 to boot , but thanks solved.
there is not a tool but with a custom winpeshl.ini put in boot.wim you can start setup.exe from a ntfs volume with custom command line. i have a flashdisk like this which works with secure boot and has a ntfs partition.