Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
This message means your PC’s UEFI firmware rejected Windows Boot Manager under its current Secure Boot policy. It appears before Windows starts, and the message alone does not say why the boot manager was rejected or prove that Windows or the drive is damaged. Start by checking recent changes and the firmware’s boot-device list; use your PC maker’s model-specific instructions before changing Secure Boot settings.
What the error means
Secure Boot is a UEFI firmware feature that checks signatures in the boot chain before allowing software to run. The firmware uses an allowed-signature database (db) and a revoked-signature database (dbx); a revoked entry takes precedence if an image appears in both. When firmware displays this message, it has not accepted the selected Windows Boot Manager under the policy currently in effect. Microsoft explains how Secure Boot works.
The wording does not identify the underlying cause. A mismatch between firmware trust settings and boot software, a firmware configuration change, or another device-specific boot issue may be involved. Reports from users who saw the message after enabling Secure Boot or updating firmware show those circumstances can precede it, but do not establish one universal cause. The text alone does not confirm corrupted boot files, missing keys, certificate expiry, or a damaged Windows installation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What to check before changing firmware settings
Note what changed
Write down your PC’s make and model and when the problem began. Record whether it followed a BIOS/UEFI update, a Secure Boot setting change, a Windows reinstall, or a change to the boot device. That context can help the manufacturer identify the relevant recovery instructions.
#1 Best Overall
- AMD Socket AM4: Ready to support AMD Ryzen 5000 / Ryzen 4000 / Ryzen 3000 Series processors
- Enhanced Power Solution: Digital twin 10 plus3 phases VRM solution with premium chokes and capacitors for steady power delivery.
- Advanced Thermal Armor: Enlarged VRM heatsinks layered with 5 W/mk thermal pads for better heat dissipation. Pre-Installed I/O Armor for quicker PC DIY assembly.
- Boost Your Memory Performance: Compatible with DDR4 memory and supports 4 x DIMMs with AMD EXPO Memory Module Support.
- Comprehensive Connectivity: WIFI 6, PCIe 4.0, 2x M.2 Slots, 1GbE LAN, USB 3.2 Gen 2, USB 3.2 Gen 1 Type-C
Check whether the firmware detects the Windows drive
In the firmware’s boot-device list, check whether the Windows drive is detected and whether “Windows Boot Manager” appears. Menu names and access methods vary between manufacturers, so use the PC maker’s documentation for your exact model. If the drive or boot entry is absent, avoid assuming that Secure Boot is the only issue.
Use Secure Boot changes as a diagnostic, not a blanket fix
Microsoft says Secure Boot is generally managed in BIOS/UEFI. On supported PCs, Windows Advanced startup may offer a route to UEFI Firmware Settings; the exact path and available options depend on the device. See Microsoft’s instructions for enabling or disabling Secure Boot.
Rank #2
- AM4 socket: Ready for AMD Ryzen 3000 and 5000 series, plus 5000 and 4000 G-series desktop processors.Bluetooth v5.2
- Best gaming connectivity: PCIe 4.0-ready, dual M.2 slots, USB 3.2 Gen 2 Type-C, plus HDMI 2.1 and DisplayPort 1.2 output
- Smooth networking: On-board WiFi 6E (802.11ax) and Intel 2.5 Gb Ethernet with ASUS LANGuard
- Robust power solution: 12+2 teamed power stages with ProCool power connector, high-quality alloy chokes and durable capacitors
- Renowned software: Bundled 60 days AIDA64 Extreme subscription and intuitive UEFI BIOS dashboard
If temporarily disabling Secure Boot allows the PC to start, that is a clue that the firmware’s Secure Boot policy or boot chain needs attention—not proof of a particular fault. Microsoft warns that firmware changes can prevent a device from starting. Do not treat leaving Secure Boot disabled as a universal repair; follow the PC manufacturer’s guidance and re-enable protection where appropriate.
Why not reset or replace Secure Boot keys yourself?
Microsoft notes that some PCs may need their built-in Secure Boot keys loaded and suggests resetting BIOS settings to factory defaults if Secure Boot cannot be enabled. Those options can have model-specific consequences, and firmware menus differ. Do not clear, replace, or restore keys based on a generic recipe; first consult instructions for the exact PC model. If the error persists or you cannot restore the intended settings, contact the manufacturer or qualified support.
Rank #3
- AMD AM4 Socket and PCIe 4.0: The perfect pairing for 3rd Gen AMD Ryzen CPUs
- Ultrafast Connectivity: 1x PCIe 4.0 x16 SafeSlot, WiFi 6 (802.11ax), 1Gb LAN, dual M.2 slots (NVMe SSD)—one with PCIe 4.0 x4 connectivity, USB 3.2 Gen 2 Type-A , HDMI 2.1 (4K at 60HZ), D-Sub & DVI
- Comprehensive Cooling: VRM heatsink, PCH heatsink, hybrid fan headers and Fan Xpert 2 utility
- 5X Protection III: all-round protection with LANGuard, DRAM overcurrent protection, overvoltage protection, SafeSlot Core safeguards and stainless-steel back I/O
- Boosted Memory Performance: ASUS OptiMem proprietary trace layout allows memory kits to operate at higher frequencies with lower voltages to maximize system performance.
Does the June 2026 certificate transition explain this error?
Not by itself. Microsoft says Secure Boot certificates issued in 2011 begin expiring in June 2026. It also says devices that have not updated those certificates may continue to start and receive ordinary Windows updates, but may not receive future Secure Boot protections for early-boot components. This is important transition context, but the date does not diagnose an individual boot rejection. Read Microsoft’s Secure Boot certificate update guidance and check with your device maker for model-specific information.
Be cautious with model-specific recovery reports
One Microsoft Q&A user with a Lenovo IdeaPad Gaming 3-15IMH05 (Type 81Y4) reported success after booting SecureBootRecovery.efi from a FAT32 USB drive, following other unsuccessful attempts. That is one user’s account for one model, not official general guidance or evidence that the procedure is suitable for other PCs. A USB drive is only the reported media carrier; it is not a standalone fix. Do not copy the procedure to another device without instructions from its manufacturer.
Rank #4
- AMD Socket AM4: Ready to support AMD Ryzen 5000/4000/3000 Series Processors
- Enhanced Power Solution: Digital 3+3 VRM Design and premium chokes and capacitors for steady power delivery.
- Advanced Thermal Armor: Chipset heatsinks for better heat dissipation.
- Boost Your Memory: Compatible with DDR4 and supports 4 DIMMS with Extreme Memory Profile support.
- Comprehensive Connectivity: 1x Ultra Durable PCIe 4.0 x16 slot, 1x PCIe 4.0 M.2 slot, 1x PCIe 3.0 M.2 slot, 4x USB 3.2 Gen 1 ports for hassle-free setup.
When to get manufacturer support
Contact the PC manufacturer if Windows Boot Manager remains blocked, the Windows drive or boot entry is missing, or changing Secure Boot settings leaves the PC unable to start. Provide the model, the exact message, and the recent changes you recorded. Microsoft also recommends manufacturer help when enabling or disabling Secure Boot continues to fail.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- AMD Socket AM5: Supports AMD Ryzen 9000/Ryzen 8000/Ryzen 7000 Series Processors
- DDR5 Compatible: 4 SMD DIMMs with AMD EXPO and Intel XMP Memory Module Support
- Unparalleled Performance: 12 plus2 plus2 Phases Digital VRM Solution
- Advanced Thermal Design and M.2 Thermal Guard: To Ensure VRM Power Stability and M.2 SSD Performance
- Stable Connectivity: 1 x PCIe 5.0 plus 2 x PCIe 4.0 M.2, USB 3.2 Gen 2x2 Type-C
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
