I'm trying to enable Secure Boot on an ASUS ROG STRIX Z370-F GAMING motherboard for games that require it. With OS Type set to Other OS, Windows starts normally, but msinfo32 reports that Secure Boot is disabled. When I switch to Windows UEFI Mode, the system stops at a red Secure Boot Violation screen.
The BIOS is updated, CSM is disabled, and fTPM 2.0 is enabled. I restored the factory/default Platform Key settings and also tried updating the Secure Boot keys. Windows is installed on an SSD listed as Disk 1, which contains a 100 MB EFI partition, while a 2 TB HDD is connected as Disk 0. The firmware does not provide an Enroll EFI Image option.
I also ran mbr2gpt /validate /disk:1 /allowFullOS, but it failed with a disk-layout or 512-byte sector-size error. Could the EFI bootloader be damaged or pointing to the wrong partition? Is there a way to rebuild the Windows boot files from Command Prompt, or would I need to reinstall Windows completely?
4 Answers
The first thing to verify is whether the Windows drive is actually using GPT rather than MBR. Secure Boot requires a UEFI/GPT installation, and changing the firmware to Windows UEFI Mode can trigger a violation if the current boot setup is legacy-based or otherwise not signed correctly. Check Disk Management or use diskpart to confirm the partition style before changing anything else. The motherboard model is also important here, since the exact ASUS Secure Boot and key-management options vary by firmware version.
If the disk is already GPT and the EFI partition is valid, the Windows boot files can usually be rebuilt without reinstalling. Boot into Windows recovery, open Command Prompt, identify the Windows and EFI drive letters with diskpart, and recreate the boot files with bcdboot, for example: bcdboot C:Windows /s S: /f UEFI, replacing C: and S: with the correct Windows and EFI volumes. Afterward, make sure the firmware is booting the Windows Boot Manager entry on that SSD.
A Secure Boot violation can also mean the firmware is rejecting the existing bootloader or a third-party boot component, not necessarily that Windows itself is damaged. Disconnecting the secondary HDD temporarily can help ensure the system is using the SSD’s EFI partition. Then restore the default Secure Boot keys, select Windows UEFI Mode, and check that the Windows Boot Manager entry for the SSD is first in the boot order. Be careful with key-enrollment settings, since manually replacing keys can make the firmware reject otherwise valid boot files.
A clean reinstall is not automatically the only solution, but the current installation does need to be fully UEFI-compatible. If mbr2gpt continues failing, check the exact disk number, partition layout, available space, and whether the reported sector-size error is coming from the correct drive. Back up important files before modifying partitions or boot entries. Games with modern anti-cheat systems may require Secure Boot, so leaving the firmware in Other OS mode may not meet the requirement even though Windows continues to boot.
The motherboard is an ASUS ROG STRIX Z370-F GAMING. The SSD appears to have a 100 MB EFI partition, but I’m still checking whether the disk itself is GPT.