The latest Windows 26H2 release is too large to fit on dual-layer DVDs. I'm looking for installation media that can be kept effectively read-only because the target computer may be compromised, and I don't want malware to modify the installer or spread to other systems.
I'm hesitant to rely on SD cards because their lock switches may only signal the device firmware rather than physically prevent writes. Do I need to move to Blu-ray, or is there a better air-gapped solution for Windows installation media?
4 Answers
A USB installer generally isn’t at risk just because the target machine has an infected installed operating system. Boot from the USB before mounting the existing system, then erase or replace the system drive before installing. Verify the ISO hash and create a fresh installer when needed.
For a repeatable rebuild process, isolate the machine, remove or wipe the old system drive, and install from trusted media. In larger environments, PXE or another network-boot system can work well, but it doesn’t meet the air-gapped requirement. Some teams instead keep installers on offline storage and recreate USB media only when required.
If you specifically need a physical read-only medium and want to remain offline, Blu-ray is basically the modern replacement for dual-layer DVD. Just remember that the optical drive itself must still be available on the systems being rebuilt.
For truly immutable physical media, Blu-ray is the straightforward optical option. Otherwise, most administrators use a verified ISO written to USB, an IODD-style device with a read-only mode, or a dedicated write-protected flash drive. Hardware write protection is preferable to relying only on operating-system permissions.
An IODD or similar device can mount ISOs from an internal SSD and present them as read-only virtual media, which is convenient when you need to keep several installers available.
If the machine is sufficiently compromised that you don’t trust its firmware or boot process, replacing the drive and investigating the hardware is more important than choosing between USB and optical media.