I'm trying to install Valorant on a Windows PC, so I enabled TPM and am now attempting to turn on Secure Boot. My system is already set to UEFI mode, but the ASUS BIOS gives me a "Security Violation" message whenever I change the OS Type from "Other OS" to "Windows UEFI Mode." Disabling CSM hasn't fixed it, and clearing the Secure Boot keys was the only way I could get the computer to boot afterward, though Secure Boot still wouldn't enable. I've also updated the BIOS without success. The motherboard is an ASUS Prime Z370-P. What should I check or change?
2 Answers
First make sure Windows is installed in UEFI mode on a GPT-formatted system drive. In Windows, press Win+R, run msinfo32, and check that BIOS Mode says UEFI. You can also check Disk Management or DiskPart to confirm the boot drive uses GPT. If it’s still using Legacy/MBR boot files, Secure Boot will reject the configuration until Windows is converted or reinstalled in UEFI mode. After confirming that, disable CSM, set the OS Type to Windows UEFI Mode, and reboot into the BIOS again.
Don’t leave the Secure Boot key database empty. In the ASUS BIOS, use the Secure Boot Key Management option to install or restore the factory default keys, then set the OS Type to Windows UEFI Mode. The security violation usually means the firmware can’t validate the bootloader or there are no trusted keys installed. Also check that Windows Boot Manager is the first boot option, rather than the physical drive name. If BitLocker is enabled, suspend it before making these firmware changes and keep your recovery key available.
Clearing the keys can make the system boot, but it won’t make Secure Boot active. The default Microsoft/ASUS keys need to be restored first.
I had already tried disabling CSM, but I’ll verify the disk partition style and BIOS Mode before changing anything else.