Secure Boot Policy Violation: 3 Fixes That Work

Not another boot error

I know that black screen with the Secure Boot Policy Violation message is maddening. You're just trying to start your PC, and instead you get a locked screen. Let's fix it.

The Quick Fix: Disable Secure Boot in BIOS

Most of the time, this error happens because Secure Boot can't verify a driver or a bootloader. Maybe you installed a new graphics card, a Linux dual boot, or an aftermarket SSD. The quickest way past it is to turn Secure Boot off.

1. Restart your PC and press the key for BIOS/UEFI setup. Common keys: F2, Del, F12, Esc. Watch the screen closely when it first starts.
2. Find the Boot or Security tab. Look for Secure Boot – it's usually under Boot > Secure Boot or Security > Secure Boot.
3. Set Secure Boot to Disabled.
4. If you see OS Type or Boot Mode, change it to Other OS or Legacy.
5. Save and exit. Your PC should boot normally.

Don't forget: After you boot, check if Windows is using Secure Boot. Press Win + R, type msinfo32, and look for Secure Boot State. It should say Off.

Why This Works (and When It Doesn't)

Secure Boot checks every piece of code that runs before Windows loads. If something changed – like a BIOS update, a new SSD, or a driver that isn't signed correctly – the check fails. Disabling Secure Boot removes that check. That's why it's the first thing I try.

But sometimes simply disabling Secure Boot doesn't fix it. The error might come from a problem in the UEFI firmware itself. In that case, you need to reset the Secure Boot keys.

Reset Secure Boot Keys (If Disabling Isn't Enough)

1. Go back into BIOS/UEFI.
2. Find Secure Boot settings again.
3. Look for an option like Reset to Setup Mode or Restore Factory Keys. It's often under Key Management.
4. Select it and confirm.
5. Save and exit. The computer will reboot and rebuild the trusted database.

This clears out any corrupted or mismatched keys. It's like a factory reset for your Secure Boot. I've seen this fix errors after a motherboard replacement or a failed Windows update.

Less Common Variations – What Else Could It Be?

The error can show up in different forms:

• Secure Boot Policy Violation – Invalid Signature Detected. This means a driver or file has a bad signature. Often happens after you install a game with anti-cheat (like Valorant) or a virtual machine tool (VMware, VirtualBox). The fix is the same: disable Secure Boot.
• Secure Boot Policy Violation – Image of application is not allowed to execute. This is common on Lenovo ThinkPads and Dell XPS models. It can happen after a BIOS update. Resetting keys usually fixes it. If not, roll back the BIOS to the previous version.
• Secure Boot Policy Violation – Boot Configuration Data missing. This is a different beast. It means your boot data is gone or corrupted. You'll need a Windows installation USB to repair it. Boot from the USB, choose Repair your computer, then Troubleshoot > Advanced options > Command Prompt. Run these commands:

  bootrec /fixmbr
  bootrec /fixboot
  bootrec /scanos
  bootrec /rebuildbcd

I've also seen this error on HP laptops after a BIOS update. The fix there is to disable Secure Boot, then go to the Device Security tab and disable Virtualization Technology. Reboot, then re-enable it. Yes, it's weird, but it works.

Prevention – Don't Let It Happen Again

Most Secure Boot errors come from hardware changes or bad updates. Here's how to avoid them:

• Always update your BIOS from the manufacturer's website. Don't use beta versions or sketchy tools. I use the motherboard's own update utility (like ASUS EZ Flash or MSI M-Flash) from inside the BIOS, not from Windows.
• When you install a new SSD or GPU, check if Secure Boot stays enabled. Some hardware needs a firmware update to work with Secure Boot. For example, Samsung 980 Pro SSDs had issues with Secure Boot on older Z390 motherboards. A firmware update fixed it.
• If you dual-boot Linux, use a distro that supports Secure Boot. Ubuntu and Fedora support it out of the box. Others like Arch Linux need manual signing. If you see the error after installing Linux, just disable Secure Boot.
• Keep Windows updated. Some Secure Boot errors are caused by missing UEFI drivers. Windows Update sometimes includes firmware updates for your system. Let it run.

The last thing: if you ever see this error after a clean Windows install, it's usually because your USB installer was made with an old tool. Use the Windows Media Creation Tool from Microsoft. Do not use Rufus or third-party tools unless you know what you're doing.

That's it. One of these three fixes will get you back up. If not, the problem is likely a dead motherboard or a corrupted UEFI chip – in that case, you're looking at a hardware replacement. But for 95% of people, disabling Secure Boot or resetting the keys does the job.