Secure Boot Violation Error: How to Fix the Invalid Signature Message
Secure Boot Violation means your firmware checked a boot file and could not trust its signature. Unplug extra drives first and then reset the Secure Boot keys to defaults. Update the BIOS from your PC maker next, and switch Secure Boot off only as a last step.
By Neeraj Singh ~8 min Updated Nov 2026 Checked against Microsoft Learn, Dell, Lenovo and ASUS
Secure Boot Violation appears before Windows loads. Microsoft says the firmware checks the signature of every piece of boot software and starts the PC only when the signatures are valid. Remove USB drives and add-in cards first. Then open firmware setup and reset the Secure Boot keys to defaults. Install a BIOS update from your PC maker if the message stays. Repair the boot files from Windows installation media after that. Disable Secure Boot only for a short test and enable it again afterward.
What the Secure Boot Violation Message Means
Secure Boot Violation is a firmware message, not a Windows error code. Your PC shows it before Windows starts because a boot file failed the signature check.
Microsoft explains that the firmware checks the signature of boot software, including Option ROMs and EFI applications, before it hands control to the operating system. A valid signature lets the PC boot.
The same wording appears in HP Support Community threads, with the line Check Secure Boot Policy in Setup at the end. Other makers word the screen differently. Your text can vary a little.
Windows 11 and Windows 10 PCs show the message for the same reasons. The fixes below work on both.
Common Causes of a Secure Boot Violation
A boot file with no valid signature, like a changed bootloader or a damaged Windows boot file.
A USB drive or disc with boot files the firmware does not trust. Microsoft says Linux and older Windows versions can need Secure Boot off.
Secure Boot keys that are missing or changed. Microsoft says the PC must carry the right keys in its signature database for Windows to boot.
A graphics card or other add-in card with an unsigned Option ROM. Microsoft says added UEFI drivers must be signed.
A boot mode that does not fit Secure Boot, for example Legacy BIOS or CSM mode.
✓ How to fix it
Method 1
Remove Extra Drives and Add-In Cards
1Shut down the PC and unplug USB drives, memory cards and discs. Remove external disks and any boot media you made for a Linux or older Windows install.
2If you added a graphics card or another add-in card lately, remove it for one test. The Microsoft Learn Secure Boot overview says added UEFI drivers must be signed and listed in the Secure Boot database.
3Start the PC. If the message goes away, add your devices back one at a time to find the one that fails the check.
4Still blocked? Open firmware setup and confirm your main drive sits first in the boot order. An HP Support agent gives this check in a HP Support Community thread. Open setup with the steps in our enable Secure Boot guide.
Method 2
Reset the Secure Boot Keys to Factory Defaults
1Menu names differ by maker. Look for Key Management or Expert Key Management in the Security or Boot tab.
2If BitLocker is on, keep your recovery key close first. Dell tells you to disable BitLocker before it changes keys. Dell also warns that a key change can leave a PC unable to boot if you are not sure of the steps.
3On an ASUS notebook the ASUS Secure Boot support page lists Reset To Setup Mode and then Restore Factory Keys. On an ASUS desktop it lists Clear Secure Boot Keys and then Install Default Secure Boot Keys.
4On Dell, the Dell Secure Boot support article lists Expert Key Management with Reset All Keys. Switch Custom Mode on first and off again at the next startup.
5On Lenovo, the Lenovo Secure Boot configuration page lists Reset All Keys to Default, which sets the keys to factory defaults. In the HP thread an agent suggests Restore Defaults or Load Setup Defaults.
6Save the changes and exit. Check that Secure Boot reads Enabled and restart.
Method 3
Update the BIOS From Your PC Maker
1Open the support page of your PC or motherboard maker on another device. Enter your exact model number.
2Download the newest BIOS for that model. Follow the maker instructions to install it, because every maker uses its own update tool.
4Microsoft also says a device without the new certificates still starts and works. So a BIOS update fixes a certificate gap but does not replace the key reset in Method 2.
5After the update, open firmware setup again and check the Secure Boot settings. Some updates load default settings.
Method 4
Repair the Windows Boot Files From Recovery
1Create Windows installation media on another PC first. Method 5 shows how. Plug it into the broken PC and start from it.
2On the Install Windows screen select Next and then Repair your computer. Select Troubleshoot and then Startup Repair. The Microsoft Learn boot issues page lists these steps.
3If Startup Repair fails, press Shift+F10 on the setup screen to open Command Prompt. Microsoft lists that shortcut in its boot troubleshooting steps.
4BCDBoot copies a small set of boot files from the installed Windows image to the system partition. Use the drive letter that holds your Windows folder.
bcdboot C:\Windows
5On a UEFI PC the files go to the EFI system partition. Read the Microsoft Learn BCDBoot page before you add the /s or /f switches.
6Type exit and restart. Back up your files before you change any boot data.
Method 5
Create Fresh Windows Installation Media
1Use a blank USB flash drive with at least 8 GB of space. The Media Creation Tool wipes the drive.
2On a working PC open the Microsoft Support installation media page and select Download Now under Create Windows 11 Installation Media. Start MediaCreationTool.exe and follow the prompts.
3Start the broken PC from the new drive. Select Repair your computer before you select Install.
4Old or home made boot media can fail the signature check. A fresh drive from Microsoft removes that cause.
5Back up your files before you reinstall Windows. A reinstall is the last repair in this list.
Method 6
Check the Boot Mode and Disable Secure Boot as a Last Resort
1Open firmware setup. Set the boot mode to UEFI if the PC offers the choice. The Lenovo Secure Boot configuration page warns that enabling Secure Boot disables Legacy BIOS.
2Check CSM or Legacy support. Microsoft says CSM supports legacy BIOS systems and can need an MBR drive.
3Still blocked? Find the Secure Boot setting and set it to Disabled. The Microsoft Learn page on disabling Secure Boot gives this step. On an ASUS desktop the setting is OS Type, set to Other OS.
5Open setup again and set Secure Boot back to Enabled. If the PC will not allow it, Microsoft says to reset the BIOS to factory settings. If the PC will not boot after that, disable it again and contact your maker.
Secure Boot Violation means a boot file failed the firmware signature check. Remove extra drives, reset the Secure Boot keys and update the BIOS first. Repair the boot files from recovery next. Disable Secure Boot only for a test and enable it again afterward.
Frequently asked questions
What does Secure Boot Violation mean?
Secure Boot Violation means the firmware found a boot file with an invalid signature. Microsoft says the firmware checks the signature of boot software before the PC starts. The PC stops when a check fails.
How do I fix Secure Boot Violation on Windows 11?
Remove USB drives and add-in cards first. Then reset the Secure Boot keys to defaults in firmware setup and update your BIOS. Repair the boot files from installation media if the message stays.
How do I fix Secure Boot Violation on Windows 10?
The steps match Windows 11. Unplug extra drives, reset the keys, update the BIOS and use Startup Repair from installation media. Menus differ by maker.
Should I disable Secure Boot to fix it?
Disable it only as a last step and only for a test. Microsoft advises against it as a workaround. Set it back to Enabled once Windows starts.
Does the error mean my hard drive is bad?
No. The message points to a signature or key problem in the firmware check. Drive faults show different errors, like Inaccessible Boot Device.
Can a Linux or dual boot setup cause it?
Yes. Microsoft says Linux or older Windows versions can need Secure Boot off. A boot entry that fails the check triggers the message.
Will resetting the keys delete my files?
No. A key reset changes firmware settings and leaves your drive alone. If BitLocker is on, keep your recovery key close because Dell advises disabling BitLocker before key changes.
How do I open firmware setup?
The key depends on your maker. Our enable Secure Boot guide covers the Windows route and the startup keys. Check your maker support page for your model.
