How to fix this - Operating System Loader failed signature verification

Almighty1 · Oct 4, 2024

Yesterday, I rebooted my system as soon as it got to the lock screen on my Dell XPS 15 9570 notebook and the system kept booting Dell SupportAssist instead of Windows 11 which was showing "Operating System Loader failed signature verification" as seen below:

The only way I can boot into Windows 11 was turning Secure Boot Enable to off or turning Secure Boot Enable on with Secure Boot Mode in Audit Mode, the later basically boots with Secure Boot Mode disabled as far as Windows is concerned as both would result in msinfo32 showing this:

How would I fix this so I can boot with Secure Boot Enabled and Deployed Mode? As unlike other machines, I have not found a way to enroll a device for Secure Boot.

This is what the BIOS Settings looks like:

Any help would be greatly appreciated, thanks in advance!

FreeBooter · Oct 4, 2024

I think the boot files been tempered with disabling Secure Boot should resolve the problem and from booted Windows 11 open the Command Prompt with admin rights to execute Sfc /scannow command to repair the system files.

Almighty1 · Oct 4, 2024

FreeBooter said:
I think the boot files been tempered with disabling Secure Boot should resolve the problem and from booted Windows 11 open the Command Prompt with admin rights to execute Sfc /scannow command to repair the system files.

First of all, thanks for the quick response.

Yes, Disabling Secure Boot was how I successfully booted back into Windows 11 to write the OP. This is what it shows for sfc /scannow

Would it be wise to do Dism /Online /Cleanup-Image /RestoreHealth at this point?

TraderGary · Oct 4, 2024

Almighty1 said:
First of all, thanks for the quick response.

Yes, Disabling Secure Boot was how I successfully booted back into Windows 11 to write the OP. This is what it shows for sfc /scannow

Would it be wise to do Dism /Online /Cleanup-Image /RestoreHealth at this point?

I certainly would, and it definitely isn't going to hurt anything to do it.

antspants · Oct 4, 2024

I always run the cleanup script when in doubt, as it contains all of them..

Windows 10 / 11 post WU installation cleanup script

Hey, folks, Thanks to a lot of wonderful folks here, we've made mention in a previous Insider topic about cleanup steps that can be run after Windows Update performs a major version install. Though these have been mentioned before by many, many people, it was this post by @IanMosley that...

www.elevenforum.com

SIW2 · Oct 4, 2024

try running bcdboot and see if that helps. It only takes a few seconds

at admin cmd prompt type:

bcdboot %systemdrive%\windows

TraderGary · Oct 4, 2024

@Almighty1, a comment since we both have Dell XPS 15 computers. I recently upgraded to the XPS 16 you can see in My Computer below. I love it.

Almighty1 · Oct 4, 2024

@TraderGary - Good point and since you're a longtime Dell user, how does one actually enroll a device for Secure Boot as unlike other systems where it has a function to enroll such as seen in this video:

Ventoy and Secure Boot

Wasted quite some time trying to get a Ventoy stick booting when all it needed was to turn off secure boot. Ventoy instructions don't appear to cover this but I was wondering whether there might be a way to leave secure boot on and make an exception for Ventoy?

www.elevenforum.com

Dell does not have that option other than the BIOS setup screen for Expert Key Management as shown in post #1 which is probably the correct way to do it but not sure which option am I supposed to use.

@antspants - What I usually do after I get a update is manually:
sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth
Dism /online /cleanup-image /analyzecomponentstore
Dism /online /cleanup-image /startcomponentcleanup

I know the
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
isn't needed when the /RestoreHealth will cover both of those already but the first one would either finish in 1 second flat while the second one is only a few minutes.

I looked at the script and it does:
rundll32.exe pnpclean.dll,RunDLL_PnpClean /drivers/maxclean

which when I did a search to figure out what it does, it can have bad consequences as seen here:

Redirecting

I also noticed it does:
dism /online /Cleanup-Image /Startcomponentcleanup /resetbase

A few days ago when I had the Error 6824 from the above which is mentioned here:

KB5043166 Windows 11 Insider Beta build 22635.4291 (23H2) - Sept. 30

UPDATE 10/04: https://www.elevenforum.com/t/kb5044386-windows-11-insider-beta-build-22635-4300-23h2-oct-4.29168/ Windows Blogs: Hello Windows Insiders, today we are releasing Windows 11 Insider Preview Build 22635.4291 (KB5043166) to the Beta Channel. Changes in Beta Channel builds and updates...

www.elevenforum.com

I was reading about /resetbase and according to post #2 in this thread:

Dism /online /Cleanup-Image /StartComponentCleanup /ResetBase not working

Tried to cleanup my component store but the command isn't working. Any suggestions? https://www.elevenforum.com/t/analyze-and-clean-up-component-store-winsxs-folder-in-windows-11.7597/

www.elevenforum.com

/resetbase has been disabled and it does more harm than good but /resetbase is ignored regardless.

antspants · Oct 4, 2024

Almighty1 said:
@TraderGary - Good point and since you're a longtime Dell user, how does one actually enroll a device for Secure Boot as unlike other systems where it has a function to enroll such as seen in this video:

Ventoy and Secure Boot

Wasted quite some time trying to get a Ventoy stick booting when all it needed was to turn off secure boot. Ventoy instructions don't appear to cover this but I was wondering whether there might be a way to leave secure boot on and make an exception for Ventoy?

www.elevenforum.com

Dell does not have that option other than the BIOS setup screen for Expert Key Management as shown in post #1 which is probably the correct way to do it but not sure which option am I supposed to use.

@antspants - What I usually do after I get a update is manually:
sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth
Dism /online /cleanup-image /analyzecomponentstore
Dism /online /cleanup-image /startcomponentcleanup

I know the
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
isn't needed when the /RestoreHealth will cover both of those already but the first one would either finish in 1 second flat while the second one is only a few minutes.

I looked at the script and it does:
rundll32.exe pnpclean.dll,RunDLL_PnpClean /drivers/maxclean

which when I did a search to figure out what it does, it can have bad consequences as seen here:

Redirecting

I also noticed it does:
dism /online /Cleanup-Image /Startcomponentcleanup /resetbase

A few days ago when I had the Error 6824, I was reading about /resetbase and according to post #2 in this thread:

Dism /online /Cleanup-Image /StartComponentCleanup /ResetBase not working

Tried to cleanup my component store but the command isn't working. Any suggestions? https://www.elevenforum.com/t/analyze-and-clean-up-component-store-winsxs-folder-in-windows-11.7597/

www.elevenforum.com

/resetbase has been disabled and it does more harm than good but /resetbase is ignored regardless.

Perhaps you could comment on that thread and see what members think? It is open to change.

antspants · Oct 4, 2024

Plus, there are other scripts in that thread, there is one with a user interface. Finding them is another thing. Not sure why they aren’t indexed on the first page

Almighty1 · Oct 4, 2024

@antspants - Yeah, good idea... I'll just add a comment later and will have to read that page thoroughly first before commenting after fixing this.

antspants · Oct 4, 2024

Almighty1 said:
@antspants - Yeah, good idea... I'll just add a comment later and will have to read that page thoroughly first before commenting after fixing this.

Would be good because it’s actually a Sticky Thread so it is probably benificial to alert to changes when applicable

Almighty1 · Oct 4, 2024

antspants said:
Would be good because it’s actually a Sticky Thread so it is probably benificial to alert to changes when applicable

Since someone did question in comment #20 and you did too in another comment on that thread asking what those two things did, interesting everyone only wanted to know about those two things only. Comment #26 actually tells what /resetbase does in a "Warning" section.

FreeBooter · Oct 4, 2024

If you have not, try Startup Repair tool from Windows 11 recovery environment.

antspants · Oct 4, 2024

Almighty1 said:
Since someone did question in comment #20 on that thread asking what those two things did. Comment #26 actually tells what /resetbase does in a "Warning" section.

hmmm that info could possibly be better placed on the first post. Maybe John is a busy man.

TraderGary · Oct 4, 2024

Almighty1 said:
@TraderGary - Good point and since you're a longtime Dell user, how does one actually enroll a device for Secure Boot as unlike other systems where it has a function to enroll such as seen in this video:

Ventoy and Secure Boot

Wasted quite some time trying to get a Ventoy stick booting when all it needed was to turn off secure boot. Ventoy instructions don't appear to cover this but I was wondering whether there might be a way to leave secure boot on and make an exception for Ventoy?

www.elevenforum.com

Dell does not have that option other than the BIOS setup screen for Expert Key Management as shown in post #1 which is probably the correct way to do it but not sure which option am I supposed to use.

I've never used ventoy and this is the first I've ever heard of the term "enrolling a device for Secure Boot". My Dell XPS 16 9640 had Secure Boot turned ON by default since it was delivered with Windows 11 Pro.

Almighty1 · Oct 13, 2024

Sorry for the late response. There was a heatwave of 8 days that basically put my system into 99% CPU due to thermal throttling on this notebook so I couldn't even use the system because of that and never caught up with things until early this morning after both Windows11 Beta Insiders 23H2 Build(s) 22635.4300 and 22635.4367 came out so I first updated to 22635.4300 and then 22635.4367 to provide the results to the suggestions mentioned below.

FreeBooter said:
think the boot files been tempered with disabling Secure Boot should resolve the problem and from booted Windows 11 open the Command Prompt with admin rights to execute Sfc /scannow command to repair the system files.

With Windows 11 Beta Insiders 23H2 Build 22635.4367, I did each one manually in the order shown below:

Code:

sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth
Dism /online /cleanup-image /analyzecomponentstore
Dism /online /cleanup-image /startcomponentcleanup

Rebooted and enabled Secure Boot Mode and it did not fix the problem since I ended up with the first screen in the first post.

FreeBooter said:
If you have not, try Startup Repair tool from Windows 11 recovery environment.

That was what I tried after the above failed and this is the results:

It first showed this:

Basically Diagnosing your PC with a spinning circle on the bottom

then it showed this:

The contents of C:\Windows\System32\Logfiles\Srt\SrtTrail.txt is as follows:

Code:

Startup Repair diagnosis and repair log
---------------------------
Last successful boot time: ‎10/‎13/‎2024 12:08:39 PM (GMT)
Number of repair attempts: 1

Session details
---------------------------
System Disk = \Device\Harddisk0
Windows directory = C:\WINDOWS
AutoChk Run = 0
Number of root causes = 1

Test Performed: 
---------------------------
Name: Check for updates
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: System disk test
Result: Completed successfully. Error code =  0x0
Time taken = 16 ms

Test Performed: 
---------------------------
Name: Disk failure diagnosis
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: Disk metadata test
Result: Completed successfully. Error code =  0x0
Time taken = 125 ms

Test Performed: 
---------------------------
Name: Disk metadata test
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: Target OS test
Result: Completed successfully. Error code =  0x0
Time taken = 15 ms

Test Performed: 
---------------------------
Name: Volume content check
Result: Completed successfully. Error code =  0x0
Time taken = 32 ms

Test Performed: 
---------------------------
Name: Boot manager diagnosis
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: System boot log diagnosis
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: Event log diagnosis
Result: Completed successfully. Error code =  0x0
Time taken = 15 ms

Test Performed: 
---------------------------
Name: Internal state check
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Test Performed: 
---------------------------
Name: Check for installed LCU
Result: Completed successfully. Error code =  0x0
Time taken = 3282 ms

Test Performed: 
---------------------------
Name: Check for installed driver updates
Result: Completed successfully. Error code =  0x0
Time taken = 1109 ms

Test Performed: 
---------------------------
Name: Check for pending package install
Result: Completed successfully. Error code =  0x0
Time taken = 2406 ms

Test Performed: 
---------------------------
Name: Boot status test
Result: Completed successfully. Error code =  0x0
Time taken = 0 ms

Root cause found: 
---------------------------
Boot status indicates that the OS booted successfully.

---------------------------
---------------------------

Rebooted and enabled Secure Boot Mode and it did not fix the problem since I ended up with the first screen in the first post.

SIW2 said:
try running bcdboot and see if that helps. It only takes a few seconds

at admin cmd prompt type:

bcdboot %systemdrive%\windows

After the above failed, I did the above by booting into Windows with Secure Boot Mode off and did the following in a Elevated Command Prompt:

Code:

bcdboot %systemdrive%\windows
Boot files successfully created.

Rebooted and enabled Secure Boot Mode and it did not fix the problem since I ended up with the first screen in the first post.

I even tried deleting all keys and reset the keys to default by first toggling Custom Key Management and on and then off in the Expert Key Management section of the BIOS settings as seen in post #1 and the same problem remains. It seems Windows itself is missing the something the Secure Boot database needs.

Almighty1 · Oct 13, 2024

TraderGary said:
@Almighty1, a comment since we both have Dell XPS 15 computers. I recently upgraded to the XPS 16 you can see in My Computer below. I love it.

Am I correct you have Air Conditioning since that is probably the reason you do not have the heat problem experienced by others with the XPS 15 95xx series and probably the XPS 16 which is a known issue for pretty much everyone else including me as seen below:

For the XPS 15 95xx:

How to Fix Throttling on the Dell XPS 15 series

So, you’ve already maxed out your Dell XPS 15 with 32GB of DDR4 RAM and the best 1TB NVMe SSD for the money—now your Dell XPS 15 is as good as it gets, right?

www.ultrabookreview.com

So sometimes it helps to see what the actual temperatures are reported by the system which might explain why you are happy with the XPS 15 atleast. The XPS 16 hopefully fixed the thermal issue as I only read it no longer have vents on the bottom but never saw what the actual machine looks like.

TraderGary said:
I've never used ventoy and this is the first I've ever heard of the term "enrolling a device for Secure Boot". My Dell XPS 16 9640 had Secure Boot turned ON by default since it was delivered with Windows 11 Pro.

All the machines have Secure Boot turned on by default but there are keys in a database that can be added since remember, the machine has no way to know about what devices you want to boot in the future or the OSes which may need newer keys similar to certificates for the web sites.

It appears to be part of UEFI which is explained here:

The Meaning of all the UEFI Keys | James Bottomley's random Pages

blog.hansenpartnership.com

This thread claims that there is no way to even enroll VenToy anymore:

Ventoy enroll key manager not working in new Dell laptops that use SecureBoot

as the UEFI and Secure Boot seems to be a Microsoft specification. So it has nothing really to do with Ventoy but basically with Secure Boot turned on, it will not allow booting from anything that is not already in the database by default so the proper way to do it would be adding it to the database, not sure if the key is some kind of footprint that is a hardware ID for that storage device or if it's for the boot code regardless of the actual hardware storage device or not.

TraderGary · Oct 13, 2024

@Almighty1, I've only had this XPS 16 9640 since Aug 16, but so far, it's running very cool. I've done some C# programming with Visual Studio and a bit of work with Adobe Photoshop and Lightroom. I do market work with Interactive Brokers Trader Workstation every day. I'm often using it on my lap, and it is quite comfortable. It uses Vapor Chamber Cooling, and it seems like that's quite effective. Specs are in "My Computer" below.

Edit: Oh, and when I did the update to 24H2, without incident, it stayed cool the whole time.

Almighty1 · Oct 15, 2024

@TraderGary - Yes but how one feels something is still not the same as actual temps as in the actual degrees in Celsius. It's similar to someone saying their SSD is fast but without benchmarks or actual data, it means nothing as everyone's definiton of fast or temps is different. No different than someone thinking a Ford Pinto is fast but it's not fast like a Porsche.

Interactive Brokers won't really push the CPU unless you were doing like a few thousand symbols in real-time quotes that updates many times per seconds each but even that won't push the CPU compared to a internet browser as using this for example:

This is with 120 tabs already opened currently on the XPS 15 9570:

This is with the addition of ThinkorSwim Desktop with 1800+ symbols real-time updating - To see what symbols are included - see John Lane has shared 1 photo with you!

So the temps don't really change much.

Interactive Brokers Traders Workstation's GUI is also almost 25 years old and hasn't changed much and isn't that demanding compared to ThinkofSwim which has customizable scripts.

But here is what I found about the XPS 16 and this is a summary of what others have said so don't shoot the messenger:
XPS16's cooling is not the same as the XPS17(100W total TDP)
XPS16 has a 80W total TDP
It is a thermal downgrade from the XPS17 as it also lacks the second SSD slot which the XPS 15 9530 had.
The full-sized SD slot is also gone.
The XPS 16 also has Memory aka RAM soldered to the mainboard.
It should be quite a bit better than xps 15 because of using a vapor chamber and heat pipes.
Xps 17 uses all vapor chamber and xps 15 only heatpipes. Xps 16 is a mix of both so it's overall a downgrade because it's not a full vapor chamber.
The heat seems to be moved to the heatsinks by the heatpipes from the vapor chamber that acts like a heat spreader.
Also heatsinks seem to be thicker than on xps 15 at least, don't know xps 17.
Air intake --> the bottom part there is no fan opening... All air comes from the sides, seems to be a risky move, hope that thermals stay the same or at least noise goes down.

How to fix this - Operating System Loader failed signature verification

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Stock Market Wizard

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computer

Well-known member

My Computer

Stock Market Wizard

My Computer

Well-known member

My Computer

Similar threads