FIX FOR A SECURITY BOOT

If Secure Boot is preventing Windows from starting, the supported first step is to disable Secure Boot in BIOS/UEFI so the laptop can boot again.

Warning: Changing BIOS/UEFI settings can prevent the PC from starting correctly if the wrong setting is changed.

1. Open the BIOS/UEFI menu:
   • Restart the laptop and press the startup key shown by the manufacturer, commonly F1, F2, F12, or Esc.
   • Or from Windows, hold Shift while selecting Restart, then go to Troubleshoot > Advanced Options > UEFI Firmware Settings.
2. Find Secure Boot.
   • It is usually under Security, Boot, or Authentication.
3. Set Secure Boot to Disabled.
4. Save changes and exit.
5. Let the laptop restart and check whether Windows loads.

If Windows starts only when Secure Boot is disabled, try these next steps:

1. In BIOS/UEFI, reset Secure Boot settings or BIOS settings to defaults.
2. Restart and test again.
3. If enabling Secure Boot still blocks Windows, the device may need one of these recoveries:
   • Reset Secure Boot keys to factory defaults if the firmware supports it.
   • If the device still will not boot, recovery may require the Secure Boot recovery utility or OEM-specific guidance.

If the laptop cannot boot after Secure Boot changes:

1. Turn Secure Boot off again.
2. Try to boot Windows.
3. If Windows still does not start, use recovery media and reinstall Windows if needed.

If BIOS/UEFI does not show a clear Secure Boot option, or disabling/re-enabling it does not help, contact the device manufacturer for the exact steps for that laptop model.

References:

• Windows devices for home users, businesses, and schools with Microsoft-managed updates
• Disabling Secure Boot
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Secure Boot troubleshooting guide