How to fix secure boot violation invalid signature on windows desktop

The error “Secure Boot Violation – Invalid signature detected” usually means Secure Boot is rejecting the current boot files or certificates, often after an update. The supported recovery paths in this situation are:

1. Temporarily disable Secure Boot so the PC can start
   1. Turn the PC on and immediately press the BIOS/UEFI key repeatedly (commonly F1, F2, F12, or Esc) until the firmware/BIOS menu opens.
   2. In the BIOS/UEFI menus, locate Secure Boot (typically under Security, Boot, or Authentication).
   3. Set Secure Boot to Disabled.
   4. Save changes and exit; the PC should restart.
   If the issue is caused by new certificates or boot manager changes, this lets Windows start so further repair steps can be taken.
2. If the device still will not start after updates/cert changes When Secure Boot changes or revocations (for example, those associated with CVE‑2023‑24932 or new certificates) go wrong, use this recovery procedure:
   1. Turn off Secure Boot in UEFI as above.
   2. Reset Secure Boot keys to factory defaults in the UEFI menus (look for an option like “Reset to factory keys” or similar; avoid “Clear” and choose “Reset” if both exist).
   3. Try to boot Windows from the system disk.
      • If Windows starts, sign in.
      • Open an elevated Command Prompt and run these commands one by one to rebuild the EFI boot files:

                mountvol s: /s
                del s:\*.*/f /s /q
                bcdboot %systemroot% /s S:
        

      • After “Boot files successfully created.”, restart the device.
   4. If Windows still cannot start, use existing recovery media to reinstall Windows, then verify it boots.
   5. Re‑enable Secure Boot in UEFI once Windows is booting normally (see next section).
3. Re‑enable Secure Boot after recovery Once Windows is working again:
   1. Uninstall any hardware/OS that is not compatible with Secure Boot if present.
   2. Open the BIOS/UEFI menu (F1/F2/F12/Esc or via Shift + Restart → Troubleshoot → Advanced options → UEFI Firmware Settings).
   3. Set Secure Boot to Enabled. On some PCs, choose Custom and load the built‑in Secure Boot keys, or reset BIOS to factory defaults if enabling is blocked.
   4. Save and exit; let the PC reboot.
   5. If the PC fails to boot after enabling Secure Boot, disable it again and boot, then contact the device manufacturer for firmware‑specific guidance.
4. If the error is on specific affected devices (older tablets/AMI BIOS) Some devices (for example, Dell Venue tablets and other AMI BIOS‑based systems) can show Secure Boot violation errors after certain bootloader updates because their firmware cannot handle the larger bootloader signature. For those devices, the supported workaround is:
   1. Turn off Secure Boot temporarily.
   2. Enter the BitLocker recovery key at startup if prompted.
   3. Install the re‑released/fixed version of the update from Windows Update.
   4. Re‑enable Secure Boot in UEFI.

If Secure Boot cannot be enabled even after restoring default keys and rebuilding boot files, or if the BIOS does not expose the needed options, contact the PC manufacturer’s support for model‑specific steps to reset Secure Boot keys and firmware settings.

References:

• Windows devices for home users, businesses, and schools with Microsoft-managed updates
• Disabling Secure Boot
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• TPM lockout occurs unexpectedly in Windows 8.1 or Windows RT 8.1

Check if you've any non-digitally-verified driver installed, removing such kind of driver can help you resolve this issue.

Hi,

If it is a laptop or desktop, if possible, could you provide the laptop model or your desktop configuration?

Thanks