After resetting the CMOS on my PC, I had to re-enable Secure Boot. The system boots into Windows normally when Secure Boot is disabled, but whenever I enable it, save the changes, and exit, the computer immediately returns to the UEFI setup screen. BitLocker is disabled. The motherboard is an ASRock A520M-HDV, and I'm trying to figure out what setting or boot configuration is preventing Secure Boot from working.
2 Answers
This is often caused by Windows being installed in Legacy/CSM mode instead of pure UEFI mode. Secure Boot generally requires UEFI booting and a GPT-partitioned system drive. Check whether the firmware is set to UEFI-only with CSM disabled, and make sure the Windows Boot Manager entry is selected as the first boot option. If the drive uses MBR, it may need to be converted to GPT before Secure Boot will work.
In the UEFI settings, try restoring or installing the factory Secure Boot keys, then set the Secure Boot mode to Standard rather than Custom. Also verify that the boot option says “Windows Boot Manager” instead of just the name of the SSD. If no Windows Boot Manager entry appears with Secure Boot enabled, the installation may not be configured for UEFI/GPT booting.
Since BitLocker is disabled, it probably isn’t a recovery-key issue. I’d check the partition style and boot mode first, then restore the default Secure Boot keys if the drive is already GPT.
Windows still starts normally with CSM enabled or disabled, but enabling Secure Boot is the only thing that forces me back into the BIOS.