Migrate Windows from BIOS to UEFI

To convert Windows from a “legacy”/BIOS installation to UEFI with minimal effort, Microsoft has provided the MBR2GPT tool since the “Creators Update” (1703). This means you no longer have to reinstall Windows for the BIOS-to-UEFI conversion!

As the name suggests, the tool converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT). During the conversion, it also shrinks the system partition and creates an EFI system partition.

The process can be run either in a Windows PE environment or directly in the running OS. Since this is a deep intervention in the system, I recommend backing up critical data beforehand!

Video tutorial

Microsoft Mechanics has put the process into a demo video:

Procedure

The following procedure has worked well for me:

1. Check that the disk to be converted is actually running under MBR.
2. Back up the BitLocker recovery keys.
3. Suspend BitLocker.
4. Run MBR2GPT in “validate” mode and check for errors.
5. Run the MBR2GPT conversion.
6. Reboot the machine and switch from BIOS (legacy) to UEFI (native). If needed, enable Secure Boot right away.
7. If BitLocker doesn’t start again automatically, rename the file ReAgent.xml in the directory <C:\Windows\System32\Recovery> to .bak and start BitLocker manually.

The process can’t be automated 100%, because you have to change the firmware settings manually during the reboot. The individual steps can be done well with PowerShell, though.

Check the system partition

Check the PartitionStyle of the system partition with Get-Disk:

Get-Disk | select Number,FriendlyName,OperationalStatus,PartitionStyle

Number FriendlyName          OperationalStatus PartitionStyle
------ ------------          ----------------- --------------
     0 KINGSTON SH103S3240G  Online            MBR

Back up the BitLocker key

Back up the BitLocker recovery key to either Active Directory or the AAD/Intune device account:

$BLV = Get-BitLockerVolume -MountPoint "C:"

# Local AD
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId

# Azure AD / Intune
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId

MBR2GPT validation

Validate the system partition with MBR2GPT. To use the tool in the running OS, you have to specify the parameter “/AllowFullOS”.

The log output also quickly shows whether you e.g. forgot to disable BitLocker beforehand. ;)

C:\WINDOWS\system32> MBR2GPT.EXE /validate /allowfullos
MBR2GPT: Attempting to validate disk 0
MBR2GPT: Retrieving layout of disk
MBR2GPT: Validating layout, disk sector size is: 512 bytes
MBR2GPT: Validation completed successfully

Convert the partition

Run the MBR2GPT conversion:

C:\WINDOWS\system32> MBR2GPT.EXE /convert /allowfullos

MBR2GPT will now attempt to convert the default book disk.
If conversion is successful the disk can only be booted in GPT mode.
These changes cannot be undone!

MBR2GPT: Attempting to convert disk 0
MBR2GPT: Retrieving layout of disk
MBR2GPT: Validating layout, disk sector size is: 512 bytes
MBR2GPT: Trying to shrink the OS partition
MBR2GPT: Creating the EFI system partition
MBR2GPT: Installing the new boot files
MBR2GPT: Performing the layout conversion
MBR2GPT: Migrating default boot entry
MBR2GPT: Adding recovery boot entry
MBR2GPT: Fixing drive letter mapping
MBR2GPT: Conversion completed successfully
Call WinReReapir to repair WinRE
MBR2GPT: Failed to update ReAgent.xml, please try to  manually disable and enable WinRE.
MBR2GPT: Before the new system can boot properly you need to switch the firmware to boot to UEFI mode!

Fix the BitLocker recovery agent

During the conversion, MBR2GPT generally tries to update the BitLocker recovery agents, but that didn’t work on my clients. After the reboot it is therefore necessary to rename the file ReAgent.xml and restart BitLocker manually.

Rename-Item -Path C:\Windows\System32\Recovery\ReAgent.xml -NewName ReAgent.bak
Resume-BitLocker -MountPoint "C:"