I'm trying to enable Secure Boot on an ASUS ROG STRIX Z370-F GAMING motherboard so I can play games that require it. With OS Type set to Other OS, Windows starts normally, but msinfo32 reports that Secure Boot is disabled. When I switch to Windows UEFI Mode, the system stops at a red Secure Boot Violation screen.
The BIOS is updated, CSM is disabled, and fTPM 2.0 is enabled. I restored the factory/default Platform Key settings and updated the available Secure Boot keys. Windows is installed on Disk 1, which appears to contain a 100 MB EFI partition, while Disk 0 is a separate 2 TB hard drive. The motherboard does not show an Enroll EFI Image option.
I also tried running mbr2gpt /validate /disk:1 /allowFullOS, but it failed with a disk-layout or 512-byte-sector-size error. Could the EFI boot files be corrupted or installed on the wrong partition? Is there a way to rebuild the UEFI bootloader from Command Prompt, or is reinstalling Windows the only realistic solution?
3 Answers
First confirm that the Windows drive is actually GPT, not MBR. Secure Boot requires a UEFI boot setup with a GPT system disk, and the presence of a small EFI-looking partition alone does not prove that the whole installation is configured correctly. In Disk Management or DiskPart, check the partition style and verify which disk contains the active Windows boot files. If the disk is MBR, mbr2gpt may be failing because the existing partition layout does not leave enough room for the conversion or has an incompatible sector configuration.
If the Windows disk is already GPT, the boot files can usually be rebuilt without reinstalling. Boot into Windows recovery or installation media, open Command Prompt, use diskpart to identify the Windows volume and the EFI partition, assign the EFI partition a temporary drive letter, then run bcdboot with the Windows directory and the UEFI option, for example: bcdboot C:Windows /s S: /f UEFI. Make sure C: is really the Windows partition in recovery mode, since drive letters can change there. Afterward, select the Windows Boot Manager entry in firmware and test Secure Boot again.
A Secure Boot Violation can also mean the firmware is rejecting the currently installed bootloader rather than simply failing to find it. Load the default Secure Boot keys, make sure Windows Boot Manager is the first boot option, and check that no old boot entry is pointing to the secondary hard drive. If rebuilding the boot files does not help, temporarily disconnecting the other drive during repair can prevent the bootloader from being recreated on the wrong disk. Reinstalling should be a last resort after confirming the disk style, EFI partition, and boot entry.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures