Has anyone got a Macrium Reflect X USB SSD rescue media device to boot when Secure Boot is enabled?

garlin said:

Is this SSD a standalone Windows build? Meaning it has its own local EFI volume which isn't shared?

Typically when you use the boot manager in the BCD, it uses the same boot manager to host a variety of different boot devices. But you can override that in the BIOS boot priority and boot directly from a specific device. This way, the shared boot manager on another drive's EFI volume is ignored.

I presuming your normal boot manager works fine for your primary disk, but if you're booting directly from the external SSD, then the EFI volume on that SSD hasn't been updated. So bcdboot needs to be run on that volume.

Click to expand...

I am trying to boot from a usb ssd. I change the boot order in the BIOS. I hope this answers your question. It boots perfectly when secure boot is disabled.

That's what I thought.

1. Disable Secure Boot.
2. Boot from the other SSD.
3. Confirm if you have June 2026 or later installed on this Windows. June 2026 will have the SVN 9.0 files present.

4A. If you have June 2026 installed locally, run the update script (no -BootMedia option). This will update this SSD's own EFI volume.

4B. If you haven't got June installed, you can try transplanting the newer boot files from the primary (other Windows) drive. Mount that drive so it has drive letter W:


5. Now you should be able to enable Secure Boot, and boot from this SSD.

@garlin The second method did not work.

I ran Check Windows State cmd and got this

Windows version: 25H2 (Build 26200.8875)

UEFISecureBootEnabled : 1
AvailableUpdates : 0x0000
UEFICA2023Status : Updated
WindowsUEFICA2023Capable : Windows UEFI CA 2023 cert is in DB, system is starting from 2023 signed boot manager

bootmgfw version : 10.0.28000.342 (WinBuild.160101.0800)
bootmgfw signature CA : Windows UEFI CA 2023
bootmgfw SVN : 9.0

bootmgr version : 10.0.28000.342 (WinBuild.160101.0800)
bootmgr signature CA : Microsoft Windows Production PCA 2011
bootmgr SVN : 9.0

memtest version : 10.0.26100.1 (WinBuild.160101.0800)
memtest signature CA : Microsoft Windows Production PCA 2011

is the second boot manager the one on the USB SSD?

I will download and run the Check_UEFI script now

@garlin

Check_UEFI returns

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF
Skipping an invalid Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable X509 certificate.
Skipping an invalid Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable X509 certificate.

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Skipping an invalid Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable X509 certificate.
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b is CURRENT.
NOT RECOMMENDED for dual-boot setups.
Skipping an invalid Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable X509 certificate.


STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.



NB My USB SSD has a small FAT32 partion for Macrium PE and a large NTFS partition for backup images.
The partition table is MBR

I also made a Macrium rescue on a 32GB flash drive and that won't boot with Secure Boot enabled.

I see all the problems encountered with Secure Boot. I don't know why people even bother. Especially home users.
It causes more problems than it's worth, in my opinion. But keep persisting.

Stigg said:

I see all the problems encountered with Secure Boot. I don't know why people even bother. Especially home users.
It causes more problems than it's worth, in my opinion. But keep persisting.

Click to expand...

Agreed, but I like a challenge!

The challenge is all yours

Froggie said:

The challenge is all yours

Click to expand...

What do you mean?

Not being a SECURE BOOT user, I would never go through the machinations being required by these certification changes and BOOT level changes that users in this Forum have been suffering through.

Since I've never come across a single user in these groups that has ever been affected in any way by not running SECURE BOOT (me included), I abandoned it early in its cycle and have never returned. I worry only that MicroSloth will not make it the only way to BOOT until I've made my way completely away from such BiOS requirements and into the world of Linux.

I guess I'm happy watching those of you who enjoy the challenge of something I never plan to use ... go for it!

Froggie said:

Since I've never come across a single user in these groups that has ever been affected in any way by not running SECURE BOOT (me included), I abandoned it early in its cycle and have never returned.

Click to expand...

Some online competitive multiplayer games require secure boot to be enabled and the list is growing.
It is to prevent players from using low-level cheats.

Froggie said:

I worry only that MicroSloth will not make it the only way to BOOT until I've made my way completely away from such BiOS requirements and into the world of Linux.

Click to expand...

Linux embraced Secure Boot way ahead of the pace of Windows adoption. It's more common in the Linux world for users to make their own Platform Key cert, and self-sign their boot files.

Are you required to use Secure Boot? No, but the average Linux user is more mindful about it than your average Windows user.

Switching to Linux doesn't make the issue go away.