I'm trying to play Call of Duty on a Windows 11 PC, but its anti-cheat requires Secure Boot. Secure Boot is currently disabled, and the computer works normally. However, when I enable it in the BIOS, the system shows a red "Secure Boot Violation. Invalid signature detected. Check secure boot policy in setup" message and returns to the BIOS.
My hardware is an AMD Ryzen 5 5600G, RTX 3060 12GB, 16GB of RAM, a 1TB SSD, and a BIOSTAR A520MH 3.0 motherboard. What should I check or change so Secure Boot works without reinstalling Windows?
4 Answers
The Windows boot configuration may need repair. With Secure Boot enabled, start from a Windows installation or recovery USB and use Startup Repair. If that doesn’t work, rebuild the boot files from the recovery command prompt. Make sure the repair targets the EFI system partition and that the BIOS is booting Windows Boot Manager, not the SSD by a generic drive name.
Updating the BIOSTAR motherboard firmware is worth doing before attempting more drastic fixes. Check the release notes for Secure Boot, UEFI, or key-database changes, then load the BIOS defaults and configure UEFI-only boot again afterward. Reinstalling Windows should be the last resort; it may be necessary only if the current installation is legacy/MBR or has a damaged EFI boot setup.
First boot into Windows with Secure Boot disabled and check that System Information reports BIOS Mode as UEFI. Also verify that the Windows drive uses GPT rather than MBR. In the BIOS, disable CSM or Legacy Boot, install the default Secure Boot keys, enable Secure Boot, and set Windows Boot Manager as the first boot option. If the installation is already UEFI/GPT and it still fails, update the motherboard BIOS because firmware updates sometimes fix Secure Boot compatibility issues.
This requirement is frustrating, but don’t immediately wipe the system. Confirm the disk layout and boot mode first, because enabling Secure Boot on a legacy installation commonly produces exactly this kind of failure. Back up important files before changing firmware settings or repairing the bootloader.
I tried those settings. Windows boots with the keys removed, but it still reports Secure Boot as disabled. Installing the default keys makes the system fail to start, while disabling Secure Boot or resetting the keys lets Windows load again.