How do I fix the "Invalid Signature Detected" problem I get when enabling Secure Boot.

Question

How do I fix the "Invalid Signature Detected" problem I get when enabling Secure Boot.

aashir adnan 0

For context, Secure Boot was running fine at least a month ago.
I downloaded Valorant recently and it prompted me with "Secure Boot should be enabled".

I tried enabling it, restoring factory default keys, verifying OS mode is UEFI, partitions are in GPT, repairing with bcdboot and loading optimized defaults.

Nothing has fixed this problem.

I am on an ASUS TUF Dash F15.

0 comments

2 answers

Your answer

Answer 1

DaveM121 919.3K Independent Advisor

In BIOS, did you reset both the Secure Boot and TPM keys to factory keys and that did not resolve the problem?

If so, I checked the support page for your device on the Asus website, a new version of BIOS was released in November 2025, did you install that BIOS update?

https://www.asus.com/laptops/for-gaming/tuf-gaming/asus-tuf-dash-f15-2022/helpdesk_bios?model2Name=FX517ZM

.

Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

aashir adnan 0 Reputation points

2026-04-18T21:55:51.51+00:00

I have not reset the TPM keys, I'll try that. however my bios is up-to-date yes. TPM 2.0 is enabled if thats any further indication.
DaveM121 919.3K Reputation points Independent Advisor

2026-04-19T05:56:20.6633333+00:00

Sorry, I was offline, how are you proceeding with this, did you reset TPM keys now to factory keys, and did that resolve the error.
aashir adnan 0 Reputation points

2026-04-21T21:54:45.07+00:00

There is no option to reset the TPM keys in BIOS.
DaveM121 919.3K Reputation points Independent Advisor

2026-04-22T05:34:47.8466667+00:00

Sorry, I was offline.

Please provide a photo of the Security settings in BIOS showing the Secure Boot and TPM settings you have available in there.
aashir adnan 0 Reputation points

2026-04-24T21:52:26.0666667+00:00

Yup sure
Maria Isabel Diolata 0 Reputation points

2026-07-02T18:03:17.9433333+00:00

has this been resolved?

Answer 2

Use the Secure Boot recovery process to repair the Secure Boot state, then re‑enable it.

Turn off Secure Boot in UEFI
- Enter the ASUS UEFI/BIOS (for example by pressing F2/Del at power‑on).
- Locate Secure Boot and set it to Disabled.
Reset Secure Boot keys to factory defaults
- In the same Secure Boot section, use the option to Reset to factory defaults (or similar wording).
- If both Clear and Reset options exist, use Reset, not Clear. The goal is to restore the OEM default Secure Boot variables and keys.
- Save and exit, then let Windows boot normally.
Repair EFI boot files (if Windows does not boot correctly)
- If after resetting keys Windows fails to boot, start Windows from the system disk or from recovery media.
- In Windows, open an elevated Command Prompt and run these commands one by one:
```
     mountvol S: /s
     del S:\*.* /f /s /q
     bcdboot %systemroot% /s S:
```
- Confirm that bcdboot reports Boot files successfully created, then restart.
Use Microsoft Secure Boot Recovery if “Invalid signature detected” persists
- If enabling Secure Boot still produces “Secure Boot violation – invalid signature detected”, use the Secure Boot Recovery tool as described in the Q&A solution:
  - On the Windows system drive, go to C:\Windows\Boot\EFI and locate SecureBootRecovery.efi.
  - Prepare a USB stick formatted as FAT32.
  - On the USB, create folders EFI then inside it BOOT (both folder names in uppercase).
  - Copy SecureBootRecovery.efi into EFI\BOOT on the USB and rename it to bootx64.efi.
  - Boot the PC from this USB. A message similar to “Microsoft Secure Boot Recovery Version 1.0 … System will reboot in 10 seconds” should appear.
  - Allow the system to reboot back into Windows.
Re‑enable Secure Boot
- Boot into UEFI/BIOS again.
- Ensure boot mode is UEFI (not Legacy/CSM) and that the Secure Boot keys are present/loaded.
- Set Secure Boot to Enabled (or Windows UEFI mode on ASUS systems).
- Save changes and exit.
- If the PC fails to boot after enabling Secure Boot, disable it again and repeat the recovery steps, or contact the device manufacturer for further assistance.

This sequence (reset keys → repair EFI boot files if needed → run SecureBootRecovery.efi from USB → re‑enable Secure Boot) is the documented way to clear an “invalid signature detected” state and restore a working Secure Boot configuration.

References: