BIOS. Windows Boot Manager

Question

BIOS. Windows Boot Manager

Amber W 0

Hello!

I was trying to fix COD new requirements to play l with the anti cheat because i kept getting an error “Failed Attestation Status”. However i followed instructions that told me to clear the keys in the BIOS (i’m sorry im stressed and don’t remember name specifics) Once the keys were clear pressed f10 and could no longer get into my laptop because Windows boot manager. I did a hard restart to get me back into the BIOS and turned off secure boot startup so now i can get back onto my laptop. But if i turn secure boot startup back on im suck in the continuous loop windows boot manager and i can only access my laptop if i have secure boot disabled.

Please help!

0 comments

2 answers

Your answer

Answer 1

Ivan B 121.4K Independent Advisor

Hi,

So, when you reset the Secure Boot keys, you lost the Windows boot manager upon re-enabling it, correct?

If the Q&A Assist procedure doesn't work, you would need to restore the default keys and try loading them during startup.

Could you let me know your laptop model?

Thanks.

Amber W 0 Reputation points

2026-08-28T15:56:59.2066667+00:00

it’s a lenovo legion
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T15:58:01.14+00:00

Hi ,

Search for msinfo32.exe in the search bar, take a screenshot, and post it here so we can see the correct laptop model or desktop configuration.

Thanks
Amber W 0 Reputation points

2026-08-28T16:01:32.8666667+00:00
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T16:06:54.56+00:00

Hi,

Are you on the latest BIOS version?

If you can access the BIOS, please check—after clearing the keys and restoring defaults—whether CSM is disabled.

Is there an option to view the keys in the BIOS under the Secure Boot section?

Thanks.
Amber W 0 Reputation points

2026-08-28T16:19:04.48+00:00

i should be on the latest BIOS.

and unsure how to see CSM

and im not seeing an option to view the keys
Amber W 0 Reputation points

2026-08-28T16:25:19.82+00:00

the two errors i get when enabling secure boot are ‘windows boot manager’ and ‘EFI PXE’ which neither are working.
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T16:42:16.95+00:00

Hi,

Could you take a photo of the BIOS screen in the Secure Boot section and post it here?

Thanks.
Amber W 0 Reputation points

2026-08-28T16:55:06.8433333+00:00

Hi sorry hope these help
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T16:58:19.67+00:00

Hi,

Set it to "reset to setup mode," then save the configuration. Access the BIOS again, enable Secure Boot, and save. Access the BIOS once more, go to the Boot tab, and check if "Windows Boot Manager" or "UEFI: SSD" appears; set it as the first boot option and try booting Windows.

Thanks.
Amber W 0 Reputation points

2026-08-28T17:03:05.99+00:00

yes! windows boot manager was first i rebooted windows and this has taken me through to windows instead of going to the error!
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T17:07:24.2366667+00:00

Hi,

Did you boot up Windows after that procedure and are now getting an error during the COD test?

Thanks.
Amber W 0 Reputation points

2026-08-28T17:31:28.3466667+00:00

i just started up COD and I’m still getting BIOS firmware update required and now also secure boot not enabled
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T17:35:20.0166667+00:00

Hi,

Did you enable Secure Boot in the BIOS, yet it still shows as disabled in COD or Windows?

If you check msinfo32.exe, is the Secure Boot state listed as enabled?

Thanks.
Amber W 0 Reputation points

2026-08-28T17:37:00.21+00:00

i did enable it, but it says disabled in both cod and msinfo32.
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T17:51:24.7566667+00:00

Hi,

It would be a good idea to check Windows Update to see if there are any pending or optional updates.

Run the command following:

Open a PowerShell console and ensure PowerShell is running as administrator before executing the following commands:

Force the registry key: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name 'AvailableUpdates' -Value 0x40

Run the scheduled task: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Restart your computer twice after running these commands to verify that it boots up with the updated database.

To verify if the Secure Boot database update was successful, open a PowerShell console and ensure PowerShell is running as administrator before executing the following command: [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)` matches `'Windows UEFI CA 2023'

Check if the result is true;

After that, access the BIOS, go to the Secure Boot tab, take a photo, and post it here.

Thanks.
Amber W 0 Reputation points

2026-08-28T18:21:18.05+00:00

i’m currently on my settings checking for updates, but it’s constantly checking for updates
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T18:25:08.1733333+00:00

Hi,

While that is being checked, please run the commands I sent and let me know the actual results.

Thanks.
Amber W 0 Reputation points

2026-08-28T18:46:33.53+00:00

this is what im getting once all the commands have been done
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T18:50:51.23+00:00

Hi,

Sorry, the correct command is [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

Check if this returns True.

Thanks.
Amber W 0 Reputation points

2026-08-28T18:56:10.94+00:00
Ivan B 121.4K Reputation points Independent Advisor

2026-08-28T19:15:55.1866667+00:00

Hi,

I understand that the secure partition isn't loading. Please check for pending updates and install any available Windows updates.

Then, open Windows PowerShell and run the following commands in sequence:

mountvol S: /S

$sig = Get-AuthenticodeSignature 'S:\EFI\Microsoft\Boot\bootmgfw.efi'

$sig.Status

$sig.SignerCertificate | Format-List Subject, Issuer, NotBefore, NotAfter

(Get-Item 'S:\EFI\Microsoft\Boot\bootmgfw.efi').VersionInfo.ProductVersion

mountvol S: /D

Take a screenshot of the results and post it here.

Thanks.
Amber W 0 Reputation points

2026-08-28T22:51:07.5933333+00:00

This is the only windows update I have and it stuck on this screen

Answer 2

Resetting Secure Boot keys to firmware defaults can remove the certificates required to trust the installed Windows boot manager. That matches the symptom where Windows starts only when Secure Boot is disabled.

Use this recovery path:

Leave Secure Boot disabled for now so Windows can start.
Update the device firmware/BIOS to the latest version available from the laptop manufacturer.
Avoid resetting Secure Boot to firmware defaults again unless the OEM firmware includes updated Secure Boot defaults that trust the 2023 certificates.
If the device still fails whenever Secure Boot is enabled, use the Secure Boot recovery utility:
1. On a second Windows PC that has the July 2024 or newer Windows update installed, copy SecureBootRecovery.efi from C:\Windows\Boot\EFI\.
2. Put that file on a FAT32-formatted USB drive in \EFI\BOOT\.
3. Rename the file to bootx64.efi.
4. Boot the affected laptop from that USB drive.
5. Let the recovery utility run. It adds the Windows UEFI CA 2023 certificate back to the Secure Boot database.
6. Restart and test booting Windows again with Secure Boot enabled.

If Windows can boot normally now, re-enable Secure Boot from BIOS/UEFI:

Open the BIOS/UEFI menu.
- Common keys during startup are F1, F2, F12, or Esc.
- Or from Windows: hold Shift while selecting Restart > Troubleshoot > Advanced Options > UEFI Firmware Settings.
Find Secure Boot under the Security, Boot, or Authentication tab.
Set it to Enabled.
Save changes and exit.
If the PC fails to boot again after enabling Secure Boot, disable it again and run the recovery utility steps above.

If the BIOS has an option to Install Default Secure Boot Keys rather than clearing them, that is the correct direction after keys were deleted. On some devices, using Reset/Clear removes trust and causes this exact boot block.

References: