A Secure Boot Violation means the PC firmware blocked something during startup because it did not match trusted Secure Boot signatures. This often appears after a BIOS update, a boot setting change, a new drive, or a different operating system bootloader.
This guide applies to UEFI-based Windows 10 and Windows 11 PCs.
Does This Affect You?
Use this when the PC shows Secure Boot Violation and refuses to boot normally. The fix is usually in BIOS/UEFI settings, not inside Windows, because Secure Boot runs before Windows starts.
Check and Reset Secure Boot
- Restart the PC and enter BIOS/UEFI setup. Common keys are Del, F2, F10, or Esc.
- Look for a Security, Boot, or Secure Boot menu.
- If Secure Boot is disabled and Windows expects it, enable it.
- If Secure Boot is already enabled, look for Restore Factory Keys, Install Default Secure Boot Keys, or Reset to Setup Mode, depending on the firmware wording.
- Save changes and restart.
Confirm UEFI Boot Mode
Secure Boot requires UEFI mode. A mismatch between UEFI/Secure Boot settings and an older Legacy/CSM boot configuration can trigger startup problems.
- Return to BIOS/UEFI setup.
- Open the Boot section and find Boot Mode, CSM, or Compatibility Support Module.
- If Windows was installed in UEFI mode, set Boot Mode to UEFI or disable CSM.
- Save and restart.
- If Windows no longer boots after this change, it may be installed in older Legacy/MBR mode. Return the setting to its previous value and use Startup Repair or migration guidance instead.
Run Startup Repair
- Open Windows Recovery Environment. It may appear automatically after failed starts, or you can boot from a Windows installation USB.
- Choose Troubleshoot > Advanced options > Startup Repair.
- Let Windows inspect the boot files and follow any prompts.
- Restart and test.
Secure Boot Edge Cases
Dual-Boot Systems
If Linux or another operating system is installed, its bootloader must support Secure Boot. Most modern mainstream Linux distributions do, but older or customized bootloaders may need distribution-specific steps.
New Drives Can Change Boot Order
A newly installed drive with its own boot files can move ahead of the Windows drive. Check BIOS boot order and put the main Windows boot entry first.
Search the Exact Error Text
Some Secure Boot violations include a file name or code. Search Microsoft support and the PC maker’s support page for the exact wording because known Secure Boot issues sometimes have specific fixes.
Sources
- Microsoft Support: Secure Boot is not configured correctly
- Microsoft Learn: Secure Boot overview
- Microsoft Support: Troubleshoot blue screen errors