Unexpected I/O Error has occurred, winload.efi 0xc00000e9

Question

Unexpected I/O Error has occurred, winload.efi 0xc00000e9

Tristan B 0

Hello,

I've recently been encountering an issue with my Win11 install and I'm out of options for personal troubleshooting; before I detail the problem I would like to state upfront that I have seen several people with similar issues and in following their proposed fixes I have already:

Completely formatted my SSDs and even changed which once I (re)installed Windows on

Cleared my TPM keys in my UEFI settings

Flashed my BIOS and cleared my CMOS

With that out of the way, the specific problem is that whenever I try to boot into my Windows 11 install while Secure Boot is enabled, I run into the error screen and my only recourse is to reboot completely and disable my TPM on the hardware level from my UEFI settings. Once that has been done, Windows boots and even operates completely fine, with zero issues whatsoever. My problems are largely that if I encounter something I do require Secure Boot for (Battlefield 6, for instance, requires it as do a slowly increasing number of other games) my setup is completely unable to allow for this. I have seen a lot of suggestions about reinstalling the TPM firmware through Windows' onboard device manager, but this is also impossible as the only way I can boot into Windows (and therefore access the device manager) is to have it disabled, which means it does not show up as a recognizeable device. Similarly, I am locked out of Safe Mode as far as I can tell for similar reasons. If anyone else has encountered this issue I would love to hear any sort of help that can be offered. Thank you very much for reading!

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

1 answer

Answer 1

Francisco Montilla 30,715 Independent Advisor

Hi Tristan,

You are hitting a Secure Boot state that cannot validate or read the Windows boot files when TPM is present. The fix is to reset the platform Secure Boot keys to factory defaults and then rebuild the EFI boot files while TPM and Secure Boot are both enabled.

Power the PC off. Enter UEFI setup and set Boot or CSM to UEFI only. Make sure Secure Boot is enabled and the mode is Standard or Factory, not Custom. Use the option that resets Secure Boot to factory defaults. Enable TPM 2.0 in firmware as Intel PTT or AMD fTPM. Save changes, keep Secure Boot on, and boot from a Windows 11 USB installer.

At the first Windows Setup screen press Shift+F10 to open Command Prompt. Run:

diskpart
list vol

Note the small FAT32 partition marked System, usually 100-260 MB. Select it by volume number and assign it a letter like S: with:

assign letter=S

Type exit to leave diskpart. Now recreate the signed UEFI boot files with:

bcdboot C:\Windows /s S: /f UEFI

Wait for the success message, close the window, remove the USB, and let the machine boot from Windows Boot Manager. If your Windows drive is not C: in this environment, substitute the correct letter you see for your Windows volume before running bcdboot.

Once back in Windows, open Settings > Windows Update and install everything offered so the Secure Boot DBX is current. Confirm the result in System Information. BIOS Mode should read UEFI and Secure Boot State should read On.

If you still see the same error, return to UEFI and verify that SATA or NVMe controller modes have not been left on a legacy or RAID-only setting. With a clean Windows 11 install, AHCI for SATA and pure NVMe for M.2 are typically the most compatible when Secure Boot and TPM are on.

Tristan B 0 Reputation points

2025-11-20T04:10:54.54+00:00

I'm trying to follow these but having little success. I was able to locate the Boot/CSM as directed, and under these dropdowns are Auto/Enabled/Disabled for Launch CSM, UEFI and Legacy OPROM/Legacy OPROM only/UEFI only for Boot device control, and then for the other three it's Ignore/Legacy only/UEFI driver first. The configuration shown leads to the same issue without me being able to get to my bootable USB

I was able to verify as well that AHCI is enabled as directed which can be seen below.

My advanced/trusted computing settings are below and on their defaults, I had set the pending operation to "TPM clear" once in an attempt to reset it as directed during prior troubleshooting.

I noticed that at some point I lost the ability to select my other drives as bootables though; this is a new development and I'm unsure of how to bring them back using my UI. I'm using an ASUS ROG Strix B450F with an AMD Ryzen 7 2700 if that helps any, and my boot settings are below, there should be two additional SSDs and a portable HD present.
Tristan B 0 Reputation points

2025-11-20T04:19:13.22+00:00

Commenting again instead of an edit just in case; re-enabling UEFI and Legacy OPROM is what restored my other boot options, but my portable drive doesn't seem to be working as installation media either as the board is not recognizing the ISO. Should I try booting the ISO from one of my SSDs after formatting it instead, and if so what format should it be to make the ISO bootable?
Francisco Montilla 30,715 Reputation points Independent Advisor

2025-11-20T09:43:34.9366667+00:00
You are almost there.

Your screenshots show CSM is enabled and Storage, Network, and PCI-E are set to Legacy only. With those values the board will not expose a UEFI boot path, Secure Boot cannot validate Microsoft boot files, and the USB will not appear as a UEFI device. Boot a proper UEFI Windows 11 USB while CSM is fully disabled, then rebuild the EFI boot files.

Create the USB on any working PC using the Microsoft Media Creation Tool. Let it write directly to a plain USB stick 8 GB or larger. Do not copy the ISO by hand and do not use a portable hard drive. A UEFI entry will only appear when the USB is prepared this way.

Rufus in GPT for UEFI mode also works if you prefer open source, but use its default Windows 11 preset and keep the file system it selects.

Back on the motherboard, power down, leave only the Windows system SSD connected plus the USB to keep things simple, and enter UEFI.

In Boot > CSM set Launch CSM to Disabled. That forces UEFI only for every device class. In Boot > Secure Boot set OS Type to Windows UEFI mode, then in Key Management use Install default Secure Boot keys or Restore factory keys. In Advanced > AMD fTPM set Security Device Support to Enabled so TPM 2.0 is on.

Save and go to the one time boot menu, then choose the entry that starts with UEFI: followed by your USB name. If you do not see UEFI: the USB was not created correctly and needs to be rebuilt with the Media Creation Tool.

When Setup first screen appears press Shift+F10 to open Command Prompt, then run these in order:

diskpart list vol

Identify the small FAT32 System partition (100-260 MB) and select it by number, for example select vol 2:

assign letter=S exit bcdboot C:\Windows /s S: /f UEFI

If the Windows volume is not C: in this environment, substitute the letter you see for it before running bcdboot.

Close the window, remove the USB, and let it boot from Windows Boot Manager. In Windows open System Information and confirm BIOS Mode UEFI and Secure Boot State ON.

To your last question: Do not try to boot the ISO from an internal SSD by formatting it. An ISO is not bootable just by copying it to a drive. Use a correctly prepared UEFI USB as above.
Tristan B 0 Reputation points

2025-11-21T01:28:55.0066667+00:00

Alright, I got a proper USB installation disk sorted out, and was able to confirm that it works by booting to it while the machine was still in a useable state with TPM/Secure Boot disabled. From there I'm having more trouble, mostly that I cannot seem to get back to factory settings on the keys which I'm starting to suspect has been the main issue all along. No matter how many times I clear them and install the new ones it says modified as in the screenshot below.

I'm not sure if I'm missing another option somewhere so I have included screenshots of my other UI elements that correspond to TPM stuff.

I have confirmed all the settings you've specified otherwise; CSM is disabled, Secure Boot is in Windows UEFI Mode, and Security Device Support is enabled and in 2.0. Is it possible it's to do with the PCR settings listed under the Advanced/Trusted Computing section? My other options for 2.0 UEFI spec and Physical Presence Spec are TCG_1_2/TCG_2 and 1.3/1.3 respectively, with the current settings as TCG_2 and 1.3. I'm not sure how else I can get the keys to a factory state when even clearing them and installing the defaults is considered modified. Is it possible I need to revert to an earlier BIOS version and flash that maybe? Thank you for all the suggestions, it really does feel like it's right over the next hill which is part of what's made this whole situation so frustrating.
Francisco Montilla 30,715 Reputation points Independent Advisor

2025-11-22T01:19:22.5433333+00:00
Your Secure Boot screens look normal for this board. The word Modified on the Key Management page just means the key store is not empty and you have made a change in this session. After you press F10 to Save Changes and Reset, the actual key sets shown as Default for PK, KEK, DB, DBX are exactly what Secure Boot needs. Leave TPM on TCG_2 and Physical Presence 1.3. Do not change PCR options.

Let's do the fix that matters now. Boot the Windows 11 USB in pure UEFI with Secure Boot on, then rebuild the EFI boot files.

Power off. In UEFI keep CSM Disabled, Secure Boot set to Windows UEFI mode, and Security Device Support Enabled. In Key Management choose Clear Secure Boot keys, then Install default Secure Boot keys, then press F10 to Save and let it reboot back into UEFI. With your USB plugged in, open the one time boot menu and pick the entry that starts with UEFI: followed by your USB name.

When Windows Setup appears, press Shift+F10. Run the following exactly.

diskpart list vol

Find the small FAT32 volume marked System. Select it, assign a letter, then exit diskpart. Example shown with Volume 2:

select vol 2 assign letter=S exit

Recreate the signed UEFI boot files:

bcdboot C:\Windows /s S: /f UEFI

If Windows is not on C: in this environment, substitute the correct letter you see in list vol. Close the window, remove the USB, and let it boot from Windows Boot Manager.

Back in Windows open System Information and confirm BIOS Mode UEFI and Secure Boot State On. If it still fails, tell me exactly what bcdboot printed. Do not roll BIOS back or change PCR settings yet, those are not the cause.
Tristan B 0 Reputation points

2025-11-22T03:27:54.9433333+00:00

Hello again Francisco and thank you for the responses, I have followed the directions precisely in that order and I am still running into the same issues. It gives me the exact same error when I try and boot to my installation USB with Secure Boot on and the default keys installed. I am set to Windows UEFI Mode and CSM is disabled, I am not sure what else I can do on my BIOS. Do you think this is something I could bypass if I were to get a discrete TPM chip or would the same problems persist? I am also exploring the possibility that it's an ASUS problem, as looking into it further it appears there's been an issue with the vendor keys running into expiration dates. I am incredibly grateful for your support and if you have any insight into either of these avenues I would appreciate it because the issue seems to be something I cannot currently detect even with your very patient assistance thus far.
Francisco Montilla 30,715 Reputation points Independent Advisor

2025-11-23T03:38:21.2266667+00:00
You do not need a discrete TPM. That would not change Secure Boot validation, and your installer failing to start with Secure Boot on proves the problem sits in firmware key state, not the TPM silicon.

Do one clean reset of the platform keys and firmware state, but do it in two saves and reboots.

Power off, unplug every internal drive except the Windows SSD, leave only the keyboard, display, and your known good Windows 11 USB.

Power on and enter UEFI. Load Optimized Defaults, then change only four things:

Disable CSM

Set OS Type to Windows UEFI mode

Enable Security Device Support so fTPM 2.0 is on

Leave SATA in AHCI

Press F10 to Save Changes and Reset back into UEFI. Now go to Secure Boot > Key Management, choose Clear Secure Boot keys, press F10 to Save and let the board reboot straight back into UEFI, return to Key Management and choose Install default Secure Boot keys, then press F10 to Save and Reset once more.

Open the one time boot menu and pick the entry that starts with UEFI: followed by your USB name. If you do not see a UEFI: entry here, the stick is not being presented as a UEFI device and must be rebuilt with the Media Creation Tool on a different 8 GB or larger USB.

If Setup appears, press Shift+F10, and repeat the diskpart process in my previous reply.

If the UEFI: USB entry is present yet selecting it still throws the same winload.efi 0xc00000e9 error, tell me exactly what bcdboot printed during the step above. That message will decide the next move.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.