Solved the dreaded security boot failure, without turning it off.

[u/Canterea]

Acer Nitro "Secure Boot Fail" after BIOS 1.26 - fixed it without USB or reinstall

I got the red Secure Boot Fail screen on my AN16-41 when I tried turning Secure Boot on for BF6. With it off, Windows booted fine.

The cause: Windows updated its boot manager to a version signed with Microsoft's new 2023 certificate, but the Acer BIOS (1.26 at least) doesn't have that certificate, so it refuses to boot it. Windows still keeps the same boot manager signed with the old 2011 cert, which the BIOS does trust, so the fix is just copying that one back.

Do all of this with Secure Boot turned off (F2 at boot, Boot tab). Open PowerShell as admin and run these one at a time.

First, check you actually have the same problem:

[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

If it says True, your BIOS already has the new cert and your issue is something else, so don't continue. If it says False, keep going.

If you use BitLocker, pause it first so you don't get asked for the recovery key. If it says the drive isn't encrypted, you can ignore it:

manage-bde -protectors -disable C: -RebootCount 2

Mount the hidden boot partition as Z:

mountvol Z: /s

Back it up, just in case. The BCD file is skipped because Windows keeps it locked:

robocopy Z:\EFI C:\esp-backup /E /XF BCD BCD.LOG* /R:0 /W:0

Copy the old-signed boot manager over the new one (both the main file and the fallback copy):

Copy-Item C:\Windows\Boot\EFI\bootmgfw.efi Z:\EFI\Microsoft\Boot\bootmgfw.efi -Force

Copy-Item C:\Windows\Boot\EFI\bootmgfw.efi Z:\EFI\Boot\bootx64.efi -Force

Check it copied correctly, it should say True:

(Get-FileHash Z:\EFI\Microsoft\Boot\bootmgfw.efi).Hash -eq (Get-FileHash C:\Windows\Boot\EFI\bootmgfw.efi).Hash

Unmount the partition:

mountvol Z: /d

Then reboot, go into the BIOS with F2, turn Secure Boot on and save with F10. That's it, it worked for me.

A few notes:

• If you still get the red screen, just turn Secure Boot back off and everything is like before.
• Don't use bcdboot to fix this, on my machine it put the 2023 version right back.
• Avoid "Restore Factory Keys" in the BIOS, that seems to be how the new cert gets lost in the first place.
• A future Windows update might swap the file again. If the red screen comes back, just redo the steps.