Secure boot violation after deleted the secure boot keys

Hello,

After deleted the Secure Boot keys and installed the default Secure Boot keys in the BIOS, I get a red “Secure Boot violation” window when I restart.

I have to select “Other OS” instead of “UEFI Windows” for Windows 11 to boot properly.

Do you have a solution to get Windows working again with UEFI enabled ?

(Asus PRIME H310M-A motherboard with the latest BIOS update from 2022. There is no newer version available)

Thank you in advance for your help.

Disable Secure Boot in the BIOS configuration until you get your cert's properly configured.

Follow the thread


to learn and update Secure Boot keys and to make Secure Boot work again.

"UEFI Windows" indicates you're using the factory keys (primarily the OEM's PK). You can append certs signed by the factory keys (CA 2011 since your last BIOS update was July 2021).

"Other OS" means custom keys (ie. Linux or other self-signed PK's).

You need to disable Secure Boot mode, and run a proper check script from Windows to determine what's going on. It could be your current boot manager is incorrect for the current cert setup.

"Other OS" is Asus' way of saying "Disable Secure Boot". My Asus M/B also behaves this way.

Asus handles the Secure Boot setting differently than other manufacturers.

Asus PRIME H310M-A motherboard:

[Windows UEFI mode]: Execute the Microsoft secure boot check. Only select this option when booting on Windows UEFI mode or other Microsoft secure boot compliant operating systems.

[Other OS]: Select this option to get the optimized functions when booting on Windows non-UEFI mode and Microsoft secure boot non-compliant operating systems.

*The Microsoft secure boot can only function properly on Windows UEFI mode.

Click to expand...

This picture shows Platform Key (PK) state = Loaded. Which I presume means the factory PK.

In order for any KEK to work, it must be signed by the same PK. Since there's no OEM support for KEK CA 2023 (firmware is 2021), you can't add a KEK CA 2023 except through the Key Management menu, via a .DER file.

I presume loaded (factory) PK means you can't do "Other OS" because you don't have access to the PK in order to sign any alternate KEK's. So that's a mutually exclusive combination?? If you cleared the PK, then you can replace all the certs with the Windows OEM Devices set. But the manual Key Management feature should be the first thing that's tried.

1. Reset to factory defaults.
2. Disable Secure Boot.
3. Check if the Key Management allows for manual enrollment. Then you can use my update script, which will copy the KEK CA 2023 .der file to the EFI partition. From there, you could add the KEK using the file.
4. The rest of the update process is easy once the KEK CA 2023 is enrolled.

Thank you all for your responses.

Indeed, I had to switch to “Other OS” mode for Windows 11 to boot properly. In this mode, Secure Boot is disabled (according to msinfo32)

So you're right.

Now, if I run these two commands from Windows and reboot twice, will that do the same thing as the script ?

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Click to expand...

After the second reboot, if I select “UEFI Windows” again in the BIOS, should Windows boot up correctly ?

No, you should first run one of the Secure Boot check scripts, to see your currrent settings. Refer to post #3.

0x5944 is the optimistic "I hope things go all right" mode. If you had to disable Secure Boot, then something's not right.

Thanks, I'll take a look at it this week.

Here's an update on this issue.

So, after switching back to “UEFI Windows” in the BIOS, the red error message still appears.

However, the Event Viewer said the certificates were pending installation and that I needed to switch back to “UEFI Windows” mode to apply them.

It’s baffling.

In the meantime, I switched back to “Other OS” mode, which boots Windows 11 just fine.

These certificates are a real pain if the motherboard manufacturer no longer offers a BIOS update...