secure boot , firemware not supported

Question

secure boot was enabled via recent windows update, certain hardware and/or software limitations were preventing the secure boot certificates etc. How do I fix???

Answer 1

That message does not mean Windows Update enabled Secure Boot. It means Secure Boot is already enabled, but Windows could not automatically install the newer 2023 Secure Boot certificates because of a hardware or UEFI firmware limitation.

Microsoft explains that Windows initiates the certificate update, but the UEFI firmware must accept and store the new keys. When the firmware does not support the required process, Windows cannot fix it by itself. An OEM BIOS update is normally required. https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

Can you type msinfo32.exe in the search on the taskbar and hit enter, then share a screenshot of the pop up please.

Answer 2

When Secure Boot is turned on by a recent Windows update and the firmware or hardware does not fully support the updated Secure Boot certificates, issues can appear (boot failures, firmware errors, or certificate update failures). Use these steps to diagnose and fix the problem.

1. Check for firmware (BIOS/UEFI) updates from the device/OEM
   • Many Secure Boot certificate issues are caused by outdated firmware that cannot properly apply the new Secure Boot DB/DBX/KEK updates.
   • Install the latest firmware/BIOS from the PC or motherboard manufacturer, then restart and let Windows apply Secure Boot updates again.
2. Review Secure Boot certificate status (IT-managed or advanced users)
   For organizations or advanced users managing multiple devices:
   • Identify devices still using older (2011) Secure Boot certificates and validate Secure Boot and certificate update status using inventory methods such as event logs and registry signals.
   • Update firmware first, then pilot the certificate update on a small set of devices before broad deployment.
   • Deploy Secure Boot certificate updates using supported methods such as Microsoft Intune, registry keys, Windows CSP/Configuration, or Group Policy.
3. Check for firmware errors (Event ID 1795)
   • If the firmware returns an error when Windows tries to update Secure Boot variables (DB, DBX, KEK), Windows logs Event ID 1795 in the System log (source: TPM-WMI).
   • When Event 1795 appears, the guidance is to contact the device manufacturer to see if a firmware update is available to resolve the issue. Windows will retry the update on subsequent restarts, but incompatible firmware may continue to fail until updated.
4. If the PC will not start after Secure Boot changes
   If the device fails to boot after Secure Boot was enabled or after certificate updates:
   • Temporarily disable Secure Boot in the firmware so the device can start:
     1. Open the BIOS/UEFI menu by pressing a key such as F1, F2, F12, or Esc during startup, or from Windows by holding Shift while selecting Restart, then going to Troubleshoot > Advanced Options > UEFI Firmware Settings.
     2. Locate Secure Boot (usually under Security, Boot, or Authentication) and set it to Disabled.
     3. Save changes and exit so the device restarts.
   • After the device is stable and firmware is updated, Secure Boot can be re-enabled (see next step).
5. Re-enable Secure Boot after fixing firmware/certificates
   Once incompatible hardware/software is removed and firmware is updated:
   1. Uninstall or remove any graphics cards, hardware, or operating systems that are not compatible with Secure Boot.
   2. Open the BIOS/UEFI menu (same methods as above).
   3. Find Secure Boot and set it to Enabled. On some PCs, select Custom and load the built-in Secure Boot keys. If enabling is blocked, reset BIOS to factory defaults and try again.
   4. Save changes and exit so the PC reboots.
   5. If the PC cannot boot with Secure Boot enabled, disable Secure Boot again and consider a full refresh or “Remove everything” reset of Windows, or contact the device manufacturer.
6. If certificate updates still fail or firmware is not compatible
   • For persistent Event ID 1795 or other firmware errors, the recommended action is to work with the device manufacturer for updated firmware that supports the new Secure Boot certificate updates.
   • For Windows Server or managed environments, check the Secure Boot registry keys and event IDs (1808, 1801, 1800, 1803, 1795) to identify and troubleshoot certificate update issues, focusing on firmware compatibility.

If the device is a home/consumer PC and firmware updates are not available or Secure Boot cannot be enabled without breaking boot, the practical resolution may be to leave Secure Boot disabled and consult the device manufacturer for long‑term support options.

---

References:

• Disabling Secure Boot
• Update Secure Boot Certificates for Windows Devices
• Secure Boot certificate updates guidance for IT professionals and organizations
• Troubleshooting Windows Server Secure Boot certificate update issues
• Windows devices for home users, businesses, and schools with Microsoft-managed updates
• Secure Boot DB and DBX variable update events