Windows · Windows Server · high · Security, BitLocker & identity

"Secure Boot isn't configured correctly" or Secure Boot Violation

The firmware is refusing to run a boot component whose signature it does not accept, or Windows is reporting that Secure Boot is off when it expects it on.

What you see

A firmware message at power-on — "Invalid signature detected. Check Secure Boot Policy in Setup" — or a desktop watermark reading "Secure Boot isn't configured correctly".

What is actually wrong

Secure Boot enabled with a boot loader the firmware does not trust — most often after installing Linux, cloning a disk, or a legacy-to-UEFI conversion that left an MBR loader in place. The desktop watermark is instead a test-signing or policy state, not a boot failure.

Codes and articles

Secure Boot Violation0xc0000428Secure Boot isn't configured correctly0x1FInvalid signature detected

Fixes (2)

Get the machine booting, then restore Secure Boot properly

Firmware settings and WinRE45 minutesmedium riskreversible

It will not boot at all. Two stages: get in, then put the protection back.

In the firmware settings, disable Secure Boot temporarily to establish whether that is genuinely the blocker. If it now boots, the diagnosis is confirmed.
Establish which mode the disk is actually set up for.
PowerShell
```
$env:firmware_typeGet-Disk | Format-Table Number,FriendlyName,PartitionStyle
```
Secure Boot requires UEFI and a GPT disk. A machine cloned from an MBR/legacy install will never satisfy it, and no firmware setting fixes that — the disk layout has to be converted.
If the disk is MBR and the machine is capable of UEFI, convert it in place.
Command Prompt
```
mbr2gpt /validate /disk:0 /allowFullOSmbr2gpt /convert /disk:0 /allowFullOS
```
Switch the firmware to UEFI mode, disable CSM, then re-enable Secure Boot.
If a dual-boot Linux install is involved, ensure it is using a signed shim rather than disabling Secure Boot permanently — every current major distribution supports this.

Confirm it workedThe machine boots with Secure Boot on.

PowerShell

Confirm-SecureBootUEFI

If you need to undo itmbr2gpt does not remove data, but take an image first. Secure Boot can be disabled again from the firmware.

Clear the desktop watermark state

Elevated PowerShell20 minutesmedium riskreversible

Windows boots normally but the desktop carries the message.

Check the actual Secure Boot state before assuming.

PowerShell

Confirm-SecureBootUEFIGet-CimInstance Win32_ComputerSystem | Format-List Model,Manufacturer

If it returns False, the fix is in the firmware — enable Secure Boot there. The machine has to be in UEFI mode with a GPT disk for the option to exist.
If it returns True, the watermark is a test-signing or custom policy state.
Command Prompt
```
bcdedit /enum {current} | findstr /i "testsigning nointegritychecks flightsigning"
```
Turn test signing off if it was left on by a driver install.
Command Prompt
```
bcdedit /set testsigning offbcdedit /set nointegritychecks off
```
Test signing allows unsigned kernel drivers to load. It is normally enabled deliberately during development and left on by accident — and while it is on, the kernel will accept a driver nobody has vetted.
Restart.

Confirm it workedThe watermark is gone and Confirm-SecureBootUEFI returns True.

Command Prompt

Confirm-SecureBootUEFIbcdedit /enum {current} | findstr /i testsigning

If you need to undo itbcdedit /set testsigning on re-enables it if a development driver genuinely requires it.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.