Secure boot fail

Question

I cant play games because of Secure boot is turned off. When I enable it my laptop gives me Secure boot fail and wont boot.

My device is Acer Nitro 16 laptop and Acer is solution to this is find Bitlocker key and put in Bios. I can't find my Bitlocker key because I bought this laptop from retailer in Mongolia 2 years ago and this device is registered in someone from that retailer.

Answer 1

Did you check if your drive is encrypted with Bitlocker, you may or may not need the Bitlocker Recovery Key.

Right click your Start Button and open Disk Management.

Expand the bottom pane so all drives are visible in there.

Please provide a screenshot of that window.

Answer 2

A likely cause is that the firmware no longer trusts the installed Windows boot manager when Secure Boot is turned on. Since the laptop boots only when Secure Boot is disabled, use this recovery path first.

1. Leave Secure Boot disabled for now so Windows can start.
2. On another Windows PC that has the July 2024 or newer Windows update installed, copy SecureBootRecovery.efi from C:\Windows\Boot\EFI\.
3. Format a USB drive as FAT32.
4. On the USB drive, create \EFI\BOOT\.
5. Copy SecureBootRecovery.efi into that folder and rename it to bootx64.efi.
6. Boot the Acer laptop from that USB drive and let the recovery utility run. It adds the Windows UEFI CA 2023 certificate to the Secure Boot DB.
7. After the system restarts, try enabling Secure Boot again in BIOS/UEFI.

If the problem started after Secure Boot settings were reset to firmware defaults, this recovery method is specifically documented for that case.

If the laptop still fails to boot with Secure Boot enabled:

1. Enter firmware setup and attempt to reset Secure Boot settings.
2. If the device then boots, install the latest firmware update from Acer before re-enabling Secure Boot.
3. If firmware reset does not restore normal boot, OEM-specific guidance is required.

To verify Secure Boot state in Windows after recovery:

1. Open System Information by running msinfo32.
2. Check Secure Boot State. It should show On.

For BitLocker-related checks in Windows:

1. Open an elevated Command Prompt.
2. Run:

Manage-bde.exe -protectors -get %systemdrive%

3. In the TPM section, verify that PCR Validation Profile includes 7.

Important: resetting Secure Boot settings or BIOS defaults can change trust databases and may trigger boot failure again. Avoid resetting Secure Boot to firmware defaults unless the OEM firmware includes updated Secure Boot defaults that trust the 2023 certificates.

---

• Secure Boot troubleshooting guide
• Secure Boot troubleshooting guide
• Enforcing BitLocker policies by using Intune: known issues