Windows UEFI not working after enabling Secure Boot after BIOS update

This pattern usually means Secure Boot is blocking the current boot files or Secure Boot configuration, so the device falls through to other boot paths such as IPv4/PXE. Since Windows starts normally with Secure Boot off, use this recovery path:

1. Keep Secure Boot disabled for now so Windows can start.
2. Enter the UEFI/BIOS menu and reset Secure Boot keys to factory defaults if that option exists. Use Reset, not Clear, when both are present.
3. Start Windows, open Command Prompt as Administrator, and rebuild the EFI boot files:

      Mountvol s: /s
      del s:\*.* /f /s /q
      bcdboot %systemroot% /s S:
   

   Expected result: Boot files successfully created. Warning: the del s:\*.* /f /s /q command deletes files from the EFI system partition before recreating the Windows boot files. Run the commands exactly as shown and only from an elevated command prompt.
4. Restart and test again with Secure Boot enabled.
5. If the device still fails only when Secure Boot is enabled, reset BIOS/UEFI settings to defaults, then confirm the system is using UEFI mode rather than legacy/CSM mode before enabling Secure Boot. Switching firmware modes can introduce complications, so avoid changing boot mode unless required by the firmware configuration.
6. If Secure Boot was reset to defaults after recent Secure Boot mitigations or firmware changes, use the Microsoft recovery app from updated media:
   • On a device with the required update installed, create a FAT32 USB.
   • Run these commands in an elevated command window, assuming the USB is D::

          md D:\EFI\BOOT
          copy C:\windows\boot\efi\securebootrecovery.efi D:\efi\boot\bootx64.efi
     

   • Boot the affected device from that USB, then re-enable Secure Boot and test Windows startup again.
7. If recovery still fails, reinstall Windows from recovery media, then re-enable Secure Boot.

About the missing UEFI option: Secure Boot settings are controlled in firmware, and software cannot change them. On many PCs, the setting is under Security, Boot, or Authentication in BIOS/UEFI rather than in the one-time boot menu. A separate “UEFI” entry may also not appear if the firmware already uses UEFI mode.

To get back into firmware from Windows:

• Hold Shift while selecting Restart.
• Go to Troubleshoot > Advanced Options > UEFI Firmware Settings.

If the PC still cannot boot with Secure Boot enabled after rebuilding boot files and resetting Secure Boot keys, contact the device manufacturer.

References:

• Disabling Secure Boot
• Windows 11 and Secure Boot
• Secure the Windows boot process
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Switch Legacy BIOS boot and CSM to UEFI and GPT