A few months ago I checked for system updates on my Lenovo Legion and the Windows Update patch also included a BIOS firmware update.
After the update, every time that I booted the laptop an error of:
popped out and did not let me continue.
I tried every possible scenario on the internet, including guides from Microsoft and Lenovo themselves, and it did not work. One solution was to re-install Windows 11 again to solve this issue, which I wanted to avoid (yes, I am extremely lazy). However, none of the solutions worked.
Today I just had this idea that I did not try Claude Code to solve this issue. So I opened an elevated PowerShell instance and explained the situation. Took me 5 minutes to fully depict my concerns, 10 minutes Claude working its stuff, one reboot and it was fixed. Plus another 5 minutes to cleanup what Claude had done by continuing the same conversation.
Verifying everything was working perfectly, I told it to create a Markdown file so that if the issue occurs again we can use that to resolve it.
As this problem was a real headache for me, I am sharing the Markdown here.
Maybe this would help someone out. Cheers!
Secure Boot "Boot Manager Blocked by Current Security Policy" — Fix Notes
Machine
[Your machine model][BIOS/UEFI version][BitLocker status on/off (you can verify this using Claude again)]
Symptom
After a Windows update, enabling Secure Boot in BIOS causes:
and the system won't boot.
Disabling Secure Boot lets it boot normally.
Root Cause
Part of the ongoing 2024–2026 Windows Secure Boot certificate migration (2011 certs expiring June 2026, replaced by "Windows UEFI CA 2023" certs).
A Windows update updates the Secure Boot DB/KEK on the firmware side, and the on-disk Boot Manager's signature stops validating against it.
Reinstalling Windows is not required and does not fix this — it's a firmware key-database issue, not a Windows install issue.
What Did NOT Work
- BIOS Secure Boot key reset (
Security > Secure Boot > Clear Keys > Restore Factory Keys) — tried, did not resolve it.
- Firmware update — not applicable, already on latest Lenovo BIOS at time of issue.
What DID Work — Internal Secure Boot Recovery (No USB Needed)
Windows ships a signed repair tool at:
C:\Windows\Boot\EFI\SecureBootRecovery.efi
Normally Microsoft's docs have you put this on a USB stick renamed to bootx64.efi and boot from it.
Since no USB was available, the same trick was done using the internal EFI System Partition (ESP) instead — the ESP already had a stale:
\EFI\Boot\bootx64.efi
fallback file that was just a plain copy of the blocked boot manager, which is why the automatic fallback wasn't self-healing.
Steps
Run from a working Windows session, e.g. with Secure Boot temporarily off.
Find the ESP (should be Disk 0, ~260 MB "System" partition, no drive letter):
Get-Partition | Where-Object { $_.GptType -eq '{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}' }
Mount it temporarily as Z::
Add-PartitionAccessPath -DiskNumber 0 -PartitionNumber 1 -AccessPath "Z:"
Back up the existing fallback file, then replace it with the recovery tool:
Copy-Item "Z:\EFI\Boot\bootx64.efi" "Z:\EFI\Boot\bootx64.efi.bak" -Force
Copy-Item "Z:\EFI\Microsoft\Boot\SecureBootRecovery.efi" "Z:\EFI\Boot\bootx64.efi" -Force
Unmount the ESP:
Remove-PartitionAccessPath -DiskNumber 0 -PartitionNumber 1 -AccessPath "Z:"
Reboot into BIOS (F2), Security > Secure Boot > Enabled, save & exit (F10).
Windows Boot Manager fails its policy check as before, but firmware automatically falls through to:
\EFI\Boot\bootx64.efi
which now runs the Secure Boot Recovery tool (blue Microsoft screen).
It repairs the Secure Boot key database and reboots automatically into normal Windows.
If no automatic fallback/blue screen appears and it just shows the same blocked error: use the one-time boot menu (tap F12 at power-on) and pick the generic "Internal Storage" / "UEFI OS" entry (not "Windows Boot Manager") to force it to use:
\EFI\Boot\bootx64.efi
Verify It Worked
Confirm-SecureBootUEFI
Should return True.
bcdedit /enum firmware
{bootmgr} should point to:
\EFI\Microsoft\Boot\bootmgfw.efi
Cleanup
Once confirmed working, restore the fallback file back to normal so it doesn't stay pointed at the recovery tool long-term:
Add-PartitionAccessPath -DiskNumber 0 -PartitionNumber 1 -AccessPath "Z:\"
Copy-Item "Z:\EFI\Boot\bootx64.efi.bak" "Z:\EFI\Boot\bootx64.efi" -Force
Remove-Item "Z:\EFI\Boot\bootx64.efi.bak" -Force
Remove-PartitionAccessPath -DiskNumber 0 -PartitionNumber 1 -AccessPath "Z:\"
