Secure Boot Violation, Invalid Signature Detected: How to Fix It and Enable Secure Boot
Top: a Secure Boot Violation at start-up, with the full message: Invalid signature detected. Check Secure Boot Policy in Setup.
A Secure Boot violation means the firmware refused to run a start-up file that isn’t signed by a certificate it trusts. Microsoft’s 2026 change of Secure Boot certificates added new ways to trigger it. If it appeared after a BIOS update or reset, don’t press Restore Factory Keys. On a PC already moved to the new certificate, the factory keys are the problem, and Microsoft’s recovery USB is the fix. Have your BitLocker recovery key to hand first.
Start from what happened just before:
- A BIOS update or BIOS resetUse the recovery USB. How
- The restart after a Windows updateReset Secure Boot, then update the BIOS. How
- Only with a USB stickRebuild the stick. How
- You need Windows todayTurn Secure Boot off for now. How
- msinfo32 says Off or UnsupportedTurn it back on. How
- You look after a fleetCheck the 2026 certificates. How
What “Secure Boot Violation. Invalid signature detected. Check Secure Boot Policy in Setup” means
Secure Boot is a UEFI firmware feature that stops boot-level malware from loading before Windows. At every start, the firmware checks each start-up file’s digital signature against its list of trusted certificates. If a file isn’t signed by one of them, or its certificate has been revoked, the firmware stops and shows this message. The wording varies a little by maker.
Why now: Microsoft’s original Secure Boot certificates from 2011 expired on 24 June, 27 June and 19 October 2026. Windows Update has been adding the 2023 replacements in stages, and moving Windows to a boot manager signed with the new one. Most PCs take the change without trouble. In a few cases, Microsoft says, a PC won’t start afterwards.
How to fix a Secure Boot violation: start with what changed just before
Two of the fixes are opposites, so don’t skip this step.
| What happened just before | Why it’s blocked | What to do |
|---|---|---|
| A BIOS update or reset, or someone chose Restore Factory Keys | The factory key list lacks the 2023 certificate, but Windows now starts with a boot manager signed by it. | Use Microsoft’s recovery USB. Don’t reset the keys again. How |
| The restart after a Windows update | Some firmware overwrites the key list instead of adding to it, so the old boot manager loses its certificate. | Reset the Secure Boot settings in the BIOS. If Windows starts, install the latest BIOS before you turn Secure Boot back on. If it doesn’t, check whether a BIOS update came with that restart (first row), or ask the maker. |
| Starting from a USB stick, DVD or the network | The stick is signed by a certificate this PC doesn’t trust yet, or one your IT team has revoked. | Rebuild the stick, or update the BIOS. How |
| A Windows reinstall, Linux or a repair tool | Its start-up files aren’t signed by a certificate on the list, or don’t match the keys the PC shipped with. | Use a version signed for Secure Boot, or turn Secure Boot off for that job only. |
Need Windows today? Turn Secure Boot off to get in, then fix the cause. Microsoft warns against leaving it off to get round the certificate change, because that removes the protection against boot-level malware.
Secure Boot violation after a BIOS update or reset: use Microsoft’s recovery USB
This is the 2026 trap. Once Windows has moved to the boot manager signed with the 2023 certificate, a reset to factory defaults wipes that certificate, and the firmware refuses Windows. Restoring the factory keys again changes nothing. A reset is only safe once a BIOS update has added the 2023 certificate to the defaults.
Windows includes a small recovery tool for this. You need a second Windows PC with updates from July 2024 or later, and a USB stick you can wipe, such as a basic SanDisk Cruzer Blade.
SanDisk Cruzer Blade USB Type-A 2.0 Flash Drive, 32GB, Black and Red
- 32 GB storage capacity
- USB Type-A 2.0 interface
- Capless design for portability
- On the working PC, format the stick as FAT32.
- Open Command Prompt and type these two lines, replacing D: with your stick’s letter:
md D:\EFI\BOOTcopy C:\Windows\Boot\EFI\SecureBootRecovery.efi D:\EFI\BOOT\bootx64.efi - Plug the stick into the PC with the error and start it from the stick, using its boot menu key or the BIOS boot order.
- Let the tool run. It adds the Windows UEFI CA 2023 certificate back.
- Remove the stick and restart. Windows should start normally.
The tool puts back one certificate only. Once you’re in, run Windows Update and install the maker’s latest BIOS: many makers have released updates for this reset problem. Until then, don’t reset the Secure Boot keys again. If BitLocker asks for its key, here’s where to find it. More sticks: USB flash drives.
Secure Boot says invalid signature detected when you boot from USB
If Windows starts normally but a USB stick, DVD or network boot is refused, the problem is the stick. Two things cause it now:
- Old stick, updated PC. If your IT team has switched on Microsoft’s boot manager revocations, the PC refuses older Windows boot files, so sticks made before then stop working.
- New stick, older PC. A stick rebuilt with Microsoft’s Make2023BootableMedia script won’t start on a PC whose BIOS doesn’t trust the 2023 certificate yet. Microsoft’s own install media will switch to the 2023 boot files in a future release.
The fix: make the stick again on an up-to-date PC with Windows’ Create a recovery drive tool, formatted as FAT32. Or update the BIOS on the PC that refuses it.
How to disable or turn off Secure Boot to get Windows started
This is a way in, not a fix. Use it to rescue files or reach Windows Update, then turn Secure Boot back on. First, find your BitLocker recovery key: BitLocker expects Secure Boot to be on, so it may ask for the key.
- Open the BIOS: press the setup key as the PC starts, often F1, F2, F12 or Esc. Or in Windows, hold Shift as you select Restart, then Troubleshoot > Advanced options > UEFI Firmware Settings.
- Find Secure Boot, usually on the Security, Boot or Authentication tab, and set it to Disabled. On ASUS, set OS Type to Other OS.
- Save and exit.
How to enable or turn on Secure Boot again in Windows 11 or 10
- Go to Settings > System > Recovery and select Restart now next to Advanced startup. Then choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
- Set the boot mode to UEFI, not Legacy or CSM.
- Set Secure Boot to Enabled, then save and exit.
If no Secure Boot keys are loaded, enabling it means restoring the default keys. Install the latest BIOS first, in case the old defaults lack the 2023 certificate.
How to check if Secure Boot is enabled
Press Windows key + R, type msinfo32 and press Enter. Secure Boot State should say On. Windows Security > Device security > Secure Boot also shows whether the 2023 certificates are in. A green tick alone isn’t proof: look for “all required certificate updates have been applied”.
Secure Boot state unsupported
The firmware is probably in Legacy or CSM mode. Switch it to UEFI. If Windows sits on a disk with the older MBR layout, convert it first with Microsoft’s MBR2GPT tool, which keeps your files. Suspend BitLocker before you convert.
Secure Boot enabled but not active, or can only be enabled when the system is in User Mode
Both mean no Secure Boot keys are loaded: the firmware is in Setup Mode, not User Mode. Turn Secure Boot on, then restore the default keys, after updating the BIOS.
Enabling Secure Boot in the UEFI BIOS: Dell, HP, ASUS, MSI and Gigabyte
Each maker names things differently. Install the latest BIOS first.
| Brand | Open the BIOS | Where Secure Boot is |
|---|---|---|
| Dell | Tap F2 at the Dell logo | Boot Configuration: set the boot mode to UEFI only, enable Secure Boot, then Apply Changes. |
| HP | Press F10 repeatedly as it starts | On many models, Boot Options, which also has Clear All Secure Boot Keys and Load HP Factory Default Keys. |
| ASUS laptops | Hold F2, then press the power button | F7 for Advanced Mode, then Security > Secure Boot. On some models it’s on the Boot page. |
| ASUS, MSI and Gigabyte motherboards | Usually Delete as it starts | ASUS: Advanced Mode > Boot > Secure Boot, where OS Type set to Windows UEFI mode turns it on. MSI Click BIOS 5: on many boards, Settings > Advanced > Windows OS Configuration. Gigabyte: on many boards, turn CSM Support off first. |
HP’s order after a BIOS update: disable Secure Boot, clear all keys, restart, load the HP factory default keys, then enable Secure Boot. MSI’s BIOS updates for the new certificates say “Update Secure Boot Key” in their notes.
For IT: the Secure Boot certificate update and expiration on work laptops
PCs without the 2023 certificates keep starting and running. What they lose is new boot-level security fixes. Six points for the fleet:
- Back up BitLocker keys first. Microsoft advises it before any boot-chain, firmware or Secure Boot update, monthly ones included. Where the keys live.
- BIOS first, certificates second. Update each model’s BIOS before the certificate update reaches it. Dell, HP and Lenovo publish model lists.
- Check each PC.
UEFICA2023StatusunderHKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicingreads Updated when done. In the System log, event 1808 means the certificates are in, and 1801 means not yet. The Windows Security badge is off by default on managed PCs. In PowerShell as administrator, this returns True once the new Windows certificate is in:[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' - No factory key resets on updated PCs until that model’s BIOS ships the 2023 defaults. Tell desk-side support.
- Watch network boot. Once the disk has the 2023 boot manager, a PC that tries PXE first with 2011-signed PXE files asks for the BitLocker key at every start. Put the disk first in the boot order, or move PXE to 2023-signed boot files.
- Event 1803 is a dead end. The maker never supplied a signed key (KEK) for that model, so Windows can’t finish the update, and Microsoft says there’s no supported manual fix. Without the new KEK, the PC can’t take future updates to its Secure Boot lists, such as new revocations of unsafe boot files. Plan to replace those PCs, along with Windows 10 PCs outside Extended Security Updates, which don’t get the certificates. See the best laptop for work or browse business laptops.
Secure Boot violation: your questions
The firmware refusing to start a file whose signature doesn’t match a certificate the PC trusts. In 2026 it can also follow a BIOS reset on a PC that has moved to Microsoft’s 2023 certificate. Match the fix to what changed just before.
Every start-up file carries a digital signature. "Invalid signature detected" means the firmware couldn’t match it to a certificate on its allowed list, or found it on the revoked list.
To get Windows started, open the BIOS: F2 on a laptop, Delete on a desktop. Go to Secure Boot on the Boot or Security page, set OS Type to Other OS and press F10 to save. Then update the BIOS and set OS Type back to Windows UEFI mode.
It can appear after a BIOS update. Power off, unplug for 30 seconds and try again. If it stays, turn Secure Boot off in the BIOS (F10) and install the latest HP BIOS. Then clear the keys, load the HP factory default keys and turn Secure Boot back on.
To upgrade, the PC must be Secure Boot capable, which means the firmware is set to UEFI. Secure Boot doesn’t have to be on, but Microsoft suggests turning it on for better security.
Two did: Microsoft KEK CA 2011 on 24 June and Microsoft UEFI CA 2011 on 27 June 2026. Windows Production PCA 2011 followed on 19 October. PCs keep starting, but need the 2023 certificates for future boot-level security fixes.
Sources
- Microsoft, Secure Boot troubleshooting guide (KB5085046). The two boot failures, after a reset to defaults and after firmware overwrote the DB, the SecureBootRecovery.efi steps, the PXE and BitLocker case, and events 1801, 1808 and 1803.
- Microsoft, Secure Boot update FAQ (KB5068008). Why a PC stops booting after a reset to defaults, no Secure Boot changes until the maker updates the defaults, and only supported Windows versions get the certificates.
- Microsoft, Secure Boot certificate expiration and CA updates (KB5062710). The three certificates, their expiry dates and their 2023 replacements.
- Microsoft, when Secure Boot certificates expire (KB5079373). PCs keep working, and Secure Boot shouldn’t be disabled to get round expiry.
- Microsoft, Windows Production CA 2011 expiration (KB5132953). Future bootloader fixes need the 2023 certificate, install media moving to it, future Windows releases requiring it, and BitLocker key backup before boot-chain updates.
- Microsoft, Secure Boot updates for home and business PCs (KB5062711). A PC that won’t start after the update, how to disable Secure Boot, and the msinfo32 check.
- Microsoft, certificate status in the Windows Security app (KB5087130). The badges, the “all required certificate updates” text, and that it’s off by default on managed PCs.
- Microsoft, Secure Boot certificate guidance for IT. UEFICA2023Status and the deployment events.
- Microsoft, Windows Boot Manager revocations (KB5025885). Older boot media on PCs with the revocations, FAT32 sticks, Create a recovery drive, and the recovery app’s copy commands.
- Microsoft, updating bootable media to the 2023 boot manager (KB5053484). The Make2023BootableMedia script.
- Microsoft, Windows 11 and Secure Boot. The Settings route to UEFI Firmware Settings, Legacy or CSM to UEFI, and the Windows 11 upgrade requirement.
- Microsoft, MBR2GPT. Converting the system disk without losing data, with BitLocker suspended.
- Microsoft, BitLocker recovery screen. BitLocker expects Secure Boot to be on.
- ASUS, Secure Boot Violation at startup. A reinstall or another OS as a cause, F2 or Delete, and OS Type set to Other OS.
- ASUS, enable or disable Secure Boot on motherboards. Delete, Advanced Mode, Boot, Secure Boot, OS Type, and User and Setup mode.
- ASUS, enable or disable Secure Boot. F7 Advanced Mode on laptops, and the fix for Not Active.
- ASUS, Secure Boot certificate expiration. The PowerShell checks for the 2023 certificates.
- HP Support Community, invalid signature detected on a Pavilion All-in-One. After a BIOS update, F10, Boot Options, and the key-reset order.
- Dell, how to enable Secure Boot. F2 and Boot Configuration.
- MSI, Windows Secure Boot certificates update. The BIOS with “Update Secure Boot Key”.
