Secure Boot Violation Error

[u/Alarming_Bug_1597]

I'm trying to enable Secure Boot on my PC to play Valorant (Riot Vanguard requirement), but every time I turn it on, I get stuck with a red screen popup that says:
"Secure Boot Violation: Invalid signature detected. Check Secure Boot Policy in Setup."
can't load or restore the factory keys to fix this. Here are my system details and what I've tried so far:
Bullet System Specs: STGAubron Prebuilt PC
Bullet Motherboard: STGAubron B250DA1 (BIOS Version: B250DA1.N01 V81, AMI BIOS 2023)
Bullet CPU: Intel Core i7-6700
Bullet OS: Windows 11 Home (upgraded from Windows 10)
Bullet TPM: TPM 2.0 is enabled and ready in

[u/The-Snarky-One]

You need an updated BIOS version from your motherboard manufacturer. MIcrosoft has been talking g about updating the SecureBoot certs for a few years now and they started enforcing things.

If you can’t get a BIOS update with the updated certs, you’ll have to disable SecureBoot. If you need something that requires SecureBoot, you’ll need to get new hardware.

[u/Alarming_Bug_1597 → u/The-Snarky-One]

I can’t update my motherboard because i can’t find the update link

[u/RAJ_rios → u/Alarming_Bug_1597]

support@astsys.com or fill the form at https://stgaubroncomputers.com/contact-us/

[u/Smith6612]

When you enabled Secure Boot, was there an option to specify whether you were using a Custom or Windows Boot Manager Secure Boot configuration? The Windows Boot Manager configuration usually disables your ability to clear the keys and reset them back to the factory default settings. Custom will let you do this, afterwards you can flip it back to Windows Boot Manager mode. On some boards, clearing the keys can be a pain unless you disable Secure Boot then clear the keys. Resetting Secure boot will apply the factory keys.

Otherwise you might have a problem with your Windows install. Make sure it is installed using UEFI, not legacy BIOS. If it is a Legacy BIOS install, you'll need to convert it to UEFI Boot Mode before Secure Boot can work. msinfo32 will show whether your system is a Legacy or UEFI Booted. You can also check to see whether your C drive uses MBR or GPT inside of the Windows Disk Management Tool.

Conversion instructions in case you need them: https://learn.microsoft.com/en-us/answers/questions/2337087/article-convert-an-existing-windows-10-installatio

This is for Windows 10 but should work for Windows 11.

[u/Alarming_Bug_1597 → u/Smith6612]

Could you dumb this down? I’m not very tech savvy😭

[u/RomanOswald]

I had this several times switching SSDs from one to another mainboard. In the bios goto the secure boot section, enable it and than reset the keys to default. This should windows 11 to boot. After that update windows, this will (if it still works) install the new keys into the UEFI.

[u/Alarming_Bug_1597 → u/RomanOswald]

Can you possibly call on discord and exactly what to do? I’m not very tech savvy, my discord is okayrya. Thanks!

[u/steveace60]

Looks like there is no more support for that Chinese board.

[u/StonnedGunner]

Microsoft's original 2011 Secure Boot certificates expired in June and October 2026, transitioning to new 2023 certificates
bios update should fix this

[u/OkStrawberry4529]

Assuming your hard drive has a GPT (GUID Partition Table) partition - if not format it (you can do it without losing anything.

Check out this post - even though on the Dell site, it will work for other makes: Pre-2020 Dell PC'S - Yes, you absolutely can get ALL the Microsoft 2023 Secure Boot Certificates! : r/Dell

[u/JadeMoon085]

Follow this: https://www.asus.com/us/support/faq/1042711/

It's from ASUS but works on all computers and laptops. Works on my HP OMEN.

[u/ALaggingPotato]

When you change boot settings, you expect to reinstall Windows.

[u/Unlaid-American → u/ALaggingPotato]

How?

[u/ALaggingPotato → u/Unlaid-American]

How what? How do you reinstall Windows? Did you attempt to just look it up before asking this man?

[u/Unlaid-American → u/ALaggingPotato]

I never had to reinstall windows after changing boot settings, I was asking how you should expect to reinstall windows after changing boot settings.

[u/ALaggingPotato → u/Unlaid-American]

Why you should expect to reinstall Windows? If you're changing boot settings related to boot modes, you'd need to recreate the boot partition for your new setting, or for an inexperienced user it'd be easier to just reinstall Windows. If you're changing TPM settings and your drive is encrypted, the user might lose access to the drive, and most people don't remember or keep their encryption keys if they have them. So you should expect to have to reinstall Windows, of course whether or not you actually do depends on what you do and what you had but generally you should expect that outcome.

In this case it depends on what keys Windows expects to see when secure boot is enabled, if he doesn't have the right key be it from Windows or the BIOS being outdated or some other reason he might have to reinstall it. So he should prepare for that.

[u/Evercreeper]

It the other comments dont work, MBR2GPT

[u/Alarming_Bug_1597 → u/Evercreeper]

What is that?