Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Not exactly. A January 2023 report found that some MSI motherboard BIOS configurations displayed Secure Boot as enabled while setting the Image Execution Policy to “Always Execute.” That policy could allow boot software to run without a trusted signature, so the enabled label alone did not prove that Secure Boot was enforcing the expected checks. MSI said it chose the default for compatibility and planned BIOS files that would default to “Deny Execute.” The report does not establish the current status of every named board.
What the researcher reported
HotHardware reported on January 17, 2023, that security researcher Dawid Potocki found MSI BIOS settings where Secure Boot was enabled, the mode was Custom, and Image Execution Policy rules were set to “Always Execute.” Under that policy, startup software could be permitted to run regardless of whether its signature was trusted. The concern was the difference between the visible Secure Boot status and the policy actually governing execution—not proof that Secure Boot technology was universally broken. HotHardware’s report describes the finding.
Tom’s Hardware reported the same day that Potocki’s list covered more than 290 MSI motherboard models for both AMD and Intel processors. It cited firmware update 7C02v3C as setting Image Execution Policy to “Always Execute” by default and gave examples across both product lines. That figure is a count of models in contemporary reporting, not a count of exposed computers or a current inventory of affected boards. Tom’s Hardware’s coverage provides that context.
What “Always Execute” and “Deny Execute” mean
Image Execution Policy controls how firmware treats boot images under Secure Boot. In MSI’s reported configuration, “Always Execute” favored compatibility: it could permit execution even where the expected signature-based policy would otherwise reject a boot image. “Deny Execute” is the stricter choice when the policy identifies a violation. The practical trade-off is broad compatibility with boot components, including option ROMs, versus stronger enforcement against untrusted boot software.
#1 Best Overall
- ULTRA POWER - SUPPORTS THE LATEST RYZEN 9000 PROCESSORS IN HIGH PERFORMANCE - The MAG B850 TOMAHAWK MAX WIFI employs a 14 Duet Rail Power System (80A, SPS) VRM for the AMD B850 chipset (AM5, Ryzen 9000 / 8000 / 7000) with Core Boost architecture
- FROZR GUARD - Premium cooling features such as 7W/mK MOSFET thermal pads, extra choke thermal pads and an Extended Heatsink; Includes chipset heatsink, EZ M.2 Shield Frozr II, and a Combo-fan (for pump & system) header (3A)
- DDR5 MEMORY, PCIe 5.0 x16 SLOT - 4 x DDR5 DIMM SMT slots enable extreme memory overclocking speeds (1DPC 1R, 8400+ MT/s); 1 x PCIe 5.0 x16 SMT slot (128GB/s) with Steel Armor II supports cutting-edge graphics cards
- QUADRUPLE M.2 CONNECTORS - Storage options include 2 x M.2 Gen5 x4 128Gbps slots, 1 x M.2 Gen4 x4 64Gbps slot and 1 x M.2 Gen4 x2 32Gbps slot; Features EZ M.2 Shield Frozr II to prevent thermal throttling and EZ M.2 Clip II for EZ DIY experience
- CONNECTIVITY - Network hardware includes a full-speed Wi-Fi 7 module with Bluetooth 5.4 & 5Gbps LAN; Rear ports include USB 20G Type-C and 7.1 USB High Performance Audio with Audio Boost 5 (supports S/PDIF output)
| Policy | Compatibility emphasis | Security enforcement |
|---|---|---|
| Always Execute | Prioritizes compatibility with a wider range of components and option ROMs. | May permit startup software without a recognized trusted signature. |
| Deny Execute | May be less compatible with some boot components. | Rejects execution when Secure Boot policy identifies a violation. |
What MSI said it would do
In a statement dated January 19, 2023, MSI said it had implemented Secure Boot following Microsoft and AMI design guidance before Windows 11, and had preemptively set Secure Boot to Enabled with “Always Execute” as the default to offer compatibility and flexibility across components, including those with built-in option ROMs. MSI said users could manually select “Deny Execute” or another option, and that it would roll out new motherboard BIOS files with “Deny Execute” as the default while keeping Secure Boot configurable. MSI’s statement explains its rationale and announced plan.
That statement does not identify every board and BIOS version that later received the changed default. Without a current support record for a particular model, it is not possible to say from MSI’s portfolio-wide announcement alone whether that board was updated—or what its current default is.
Rank #2
- Supports AMD Ryzen 9000/8000/7000 Series Desktop Processors
- Lightning USB 40G: Featuring a built in USB 4 port offering lightning fast 40Gbps transmission speed
- Extended Heatsink Design: Extended PWM heatsink and enhanced circuit design ensures high-end processors to ran at full speed
- 5G Network Solution: Featuring 5G LAN to deliver network experience
- Audio Boost 5: Isolated audio with a high-quality audio processor for the most immersive gaming experience
How to check an MSI motherboard
- Find the exact motherboard model and BIOS version. Use the information shown in BIOS or Windows System Information, then open that model’s support page on MSI’s site. BIOS options and defaults can differ by model and firmware version.
- Open the firmware setup utility. Restart the computer and use the key shown by the system during startup to enter BIOS/UEFI setup; the precise key and screens vary by board.
- Inspect the Secure Boot settings. MSI’s statement locates Image Execution Policy under “Security Secure Boot” or “Settings Security Secure Boot,” with Secure Boot Mode set to Custom. Look for the policy value and determine whether it says “Always Execute” or “Deny Execute.” Menu labels may vary by BIOS version.
- Check the exact model’s current BIOS notes. If the installed policy is not the one you want, consult MSI’s support page for that board before changing settings or updating firmware. The 2023 announcement is not a model-by-model update record.
Changing the policy can affect whether some boot components work. If you rely on a particular boot device or hardware option ROM, consider that compatibility trade-off before selecting a stricter policy. Microsoft describes Secure Boot as a feature intended to allow “only trusted, digitally signed software to run during the boot process”; its Windows 11 and Secure Boot guidance also distinguishes Secure Boot capability from turning it on.
Secure Boot requirements are not the same as this policy setting
Microsoft’s Windows 11 guidance says a device upgraded from Windows 10 must support Secure Boot and have UEFI/BIOS enabled. Microsoft also says users may turn Secure Boot on for better security. These requirements and recommendations do not establish that every BIOS setting labeled “Secure Boot: Enabled” is applying the same Image Execution Policy. The policy value still matters when assessing the specific MSI configuration.
Rank #3
- Supports 12th/13th Gen Intel Core, Pentium Gold and Celeron processors for LGA 1700 socket
- Supports DDR4 Memory, Dual Channel DDR4 5333+MHz (OC)
- Enhanced Power Design: 12+1 Duet Rail Power System with P-PAK, 8-pin + 4-pin CPU power connectors, Core Boost, Memory Boost
- Premium Thermal Solution: Extended Heatsink, MOSFET thermal pads rated for 7W/mK, additional choke thermal pads and M.2 Shield Frozr are built for high performance system and non-stop gaming experience
- High Quality PCB: 6-layer PCB made by 2oz thickened copper and server grade level material
Do not confuse the 2026 certificate update with the 2023 finding
The Secure Boot certificate transition discussed in current documentation is a separate issue. Microsoft says original 2011 Secure Boot certificates begin expiring in June 2026 and describes updated 2023 certificates. MSI’s motherboard guidance, last updated March 25, 2026, describes Windows Update and BIOS update routes for that transition. It advises users to retain their BitLocker recovery key before flashing BIOS; TPM-WMI Event ID 1808 indicates updated keys were applied, while Event ID 1801 indicates certificates have not yet been applied or need an update. See Microsoft’s Secure Boot guidance and MSI’s certificate update guidance. This certificate rollover is not evidence that the 2023 Image Execution Policy setting was fixed on any particular board.
Quick Recap
Best Value
- ULTRA POWER - SUPPORTS THE LATEST RYZEN 9000 PROCESSORS IN HIGH PERFORMANCE - The MPG B850 EDGE TI WIFI employs a 14 Duet Rail Power System (80A, SPS) VRM for the AMD B850 chipset (AM5, Ryzen 9000 / 8000 / 7000) with Core Boost architecture
- FROZR GUARD - Premium cooling features such as 7W/mK MOSFET thermal pads, extra choke thermal pads and an Extended Heatsink; Includes chipset heatsink, EZ M.2 Shield Frozr II, a Combo-fan (for pump & system) header (3A)
- DDR5 MEMORY, PCIe 5.0 x16 SLOTS - 4 x DDR5 DIMM SMT slots enable extreme memory overclocking speeds (1DPC 1R, 8400+ MT/s); PCIe 5.0 x16 SMT slot (128GB/s) with Steel Armor II supports cutting-edge graphics cards
- QUADRUPLE M.2 CONNECTORS - Includes 2 x M.2 Gen5 x4 128Gbps slots, 1 x M.2 Gen4 x4 64Gbps slot and 1 x M.2 Gen4 x2 32Gbps slot with Shield Frozr to prevent thermal throttling; Features EZ M.2 Shield Frozr II with EZ M.2 Clip II for EZ DIY experience
- CONNECTIVITY - Network hardware includes a full-speed Wi-Fi 7 module with Bluetooth 5.4 & 5Gbps LAN; Rear ports include USB Front Type-C 20Gbps and 7.1 USB High Performance Audio with Audio Boost 5 (supports S/PDIF output)
Rank #4
- Supports AMD Ryzen 9000/8000/7000 Series Desktop Processors
- Premium Thermal Design: Heavy plated MOSFET heatsink with heat-pipe / high quality 7W/mK MOSFET thermal pads / extra choke thermal pads / onboard M.2 Shield Frozr
- EZ PCIe Release: A simple press of a button to effortlessly lock or unlock the PCIe slot
- Lightning Gen 5: The latest PCIe 5.0 solution with up to 128GB/s bandwidth for maximum transfer speed
- Dual LAN: Dual premium network solution for both Intranet and Internet
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
