Windows won't boot with Secure Boot enabled

Hey guys
I'm trying to enable Secure Boot but I can't go in to windows

Is there a way to find out what is the exact problem with that?


I have HackBGRT and a custom boot image
I noticed a signed version of that, so I deleted the regular version and installed new one
They say this in the description:

To boot securely, you must import the certificate into the motherboards database.

Click to expand...

I have no idea what to do ( links are broken and google search found nothing related )
I installed the Certificate file in the folder to Trusted Root Certification Authorities ( as file description suggested ) but it didn't work

The fact that you used a custom boot image rather than official clean iso may be the problem.There were specific warnings in the description of Hackbgrt. In its description it says "Make sure that Secure Boot is disabled, unless you know how to sign EFI applications."
It also says "If something breaks and you can't boot to Windows, you have the following options:

• Windows installation (or recovery) media can fix boot issues.
• You can copy [EFI System Partition]\EFI\HackBGRT\bootmgfw-original.efi into [EFI System Partition]\EFI\Microsoft\Boot\bootmgfw.efi by some other means such as Linux or Windows command prompt." If you do a web search for "How to sign EFI applications" there are several results. However, IMO you are opening yourself up a can of worms.

In a clean iso installation here are things I would advise you to try. I have a feeling they will not work in your case but you can give them a try.
1. Make sure CSM is disabled and TPM is enabled in bios.

2. Disconnect all external drives and try to boot..

3. Make sure you have the latest bios.

4. Drive must be partitioned as GPT.

5. Some people have found that removing the power and then removing the cmos battery for about 10 minutes to reset bios resolves the problem. Others have found that the dedicated graphics card has to be removed first, then remove the cmos battery for 10 minutes. Put battery back in and use your integrated graphics while booting. Once it is successful, you can then reinstall your graphics card.

See if the information and suggestions in these articles are of any help. (Note: the MS article states "I some cases, you may need to refresh or Remove everything to its original state before you can turn on Secure Boot."

glasskuter said:

In a clean iso installation here are things I would advise you to try. I have a feeling they will not work in your case but you can give them a try.
1. Make sure CSM is disabled and TPM is enabled in bios.

Click to expand...

When you do a clean UEFI installation of Windows 10/11
- It doesn't matter if CSM is on or not.
- It doesn't matter if Secure Boot is on or not.

aubergine said:

It doesn't matter if Secure Boot is on or not.

Click to expand...

That is true. In a clean install it only has to be secure boot COMPATIBLE to meet MS requirements. But per the MS document some systems will not boot if the OS was installed with secure boot OFF and then the user decides to turn it on. It also states Warning After disabling Secure Boot and installing other software and hardware, you may need to restore your PC to the factory state to re-activate Secure Boot.
My advice to him was general advice based on the most common method of OS installation and what I observed from reading complaints by others with the same problem. Normally can secure boot be turned off...absolutely. I did on mine without any issue. But depending on hardware, that is not always the case.

aubergine said:

It doesn't matter if CSM is on or not.

Click to expand...

Again, my advice was given based on the way bios should be set when installing Windows 11 and that is csm=off and uefi=on.

I tested again and confirmed that problem IS HackBGRT
I removed it and secure boot activated without any issue

I just wanted to know how to keep them both ( custom boot image + secure boot ) cuz they said something about it in the description:

To comply with Secure Boot, the EFI executables have been signed. You do not need to sign them yourself. To boot securely, you must import the certificate into the motherboards database. To do this, please refer to your motherboard manual.

Click to expand...

At your own risk, see answer here, especially the one from superuser.com

import certificate into uefi - Google Search

Elisyan said:

I tested again and confirmed that problem IS HackBGRT
I removed it and secure boot activated without any issue

I just wanted to know how to keep them both ( custom boot image + secure boot ) cuz they said something about it in the description:

Click to expand...

Ughhhh - a lot of effort just to customise logos.

Frankly, I would not use a tool that required secure boot to be off. It is there for a reason (clue is in word secure)!