Operating system loader failed signature verification: how to fix it

Applies to: Windows 11 and Windows 10 on UEFI PCs with Secure Boot on. The wording is common on Dell laptops; other brands show similar messages such as “Secure Boot violation” or “signature not found in Secure Boot database”.

What the error means

With Secure Boot on, the firmware checks the signature of the first program it starts (for Windows, bootmgfw.efi on the EFI partition) against the keys stored in the firmware. If the signature isn’t in the allowed list, or is in the revoked list, the PC stops with this message instead of starting Windows. Common reasons:

• A USB stick, external drive or second disk with an unsigned or outdated boot loader is first in the boot order.
• The Windows boot files on the EFI partition are damaged, or were copied by a disk clone or migration tool.
• The Secure Boot keys in the firmware were cleared or changed, for example after a BIOS update, a CMOS reset or someone choosing Delete all keys.
• A Linux boot loader or other third-party tool that the firmware doesn’t trust is installed.
• Rarely, malware that changed the boot files. That’s exactly what Secure Boot is meant to stop.

Your files are normally fine; the PC just refuses to start the loader. Don’t leave Secure Boot off permanently as the “fix”.

Fix 1: Remove drives and check the boot order

1. Shut down and unplug every USB drive, SD card, docking station and external disk.
2. Turn the PC on. If Windows starts, the external device was the cause.
3. If not, open the firmware setup (usually F2, Del, F10 or Esc right after power-on; on Dell it’s F2, and F12 opens the one-time boot menu).
4. In the boot settings, make sure Windows Boot Manager on your internal drive is first. Save and exit.

Fix 2: Restore the default Secure Boot keys

If the key database was cleared or changed, putting back the factory keys usually fixes it. In the firmware setup, open the Secure Boot page and look for an option such as Restore Factory Keys, Reset to Setup Mode followed by Install default keys, or on Dell Expert Key Management > Restore Settings > Factory Settings. Names vary by brand and BIOS version, so check your PC maker’s manual if you don’t see them.

You can also choose Load Defaults / Load Optimized Defaults for the whole BIOS. Afterwards, make sure the disk mode (AHCI or RAID/Intel RST) matches what it was before, or Windows may not find the drive.

BitLocker: changing Secure Boot settings can trigger a BitLocker recovery prompt on the next start. Have your key ready; see how to find your BitLocker recovery key.

Fix 3: Repair the Windows boot files

If the keys are fine, the boot loader itself is probably damaged. Because the PC refuses to start the loader on its own disk, the built-in recovery menu usually won’t open either, so boot from a Windows installation USB instead (Microsoft’s media is signed and passes Secure Boot). Pick your language, select Repair your computer, then:

1. Try Troubleshoot > Advanced options > Startup Repair first.
2. If that fails, open Troubleshoot > Advanced options > Command Prompt.
3. Run diskpart, then list vol. Note the letter of the Windows volume (it may not be C: here) and the number of the small FAT32 volume (100 to 300 MB, the EFI partition).
4. Run select vol N (the FAT32 volume’s number), assign letter=S, then exit.
5. Run bcdboot C:\Windows /s S: /f UEFI, replacing C: with your Windows volume letter. You should see “Boot files successfully created”.
6. Close the window, select Continue and let Windows start.

This copies fresh, signed boot files from your Windows folder to the EFI partition. If the PC then shows a different error, see your PC couldn’t start properly or error 0xc0000428 for driver signature problems.

Fix 4: Update the BIOS and Secure Boot certificates

Once Windows starts again, get the PC up to date so it doesn’t come back:

• Install the latest BIOS/UEFI update from your PC maker’s support site (Dell SupportAssist, HP Support Assistant, Lenovo Vantage). Keep a laptop on the charger while it updates.
• Run Settings > Windows Update and install everything. Microsoft is rolling out new Secure Boot certificates through Windows Update because the 2011 ones expire in 2026; the Windows boot loader certificate (Windows Production PCA 2011) expires in October 2026. Microsoft says PCs without the new certificates keep booting, but stop getting new boot-security fixes.
• Check that Secure Boot is on: press Windows + R, run msinfo32, and look for Secure Boot State: On.

If you had to turn Secure Boot off to get in, turn it back on after these steps.

Dual boot with Linux

Most major Linux distributions boot with Secure Boot through a Microsoft-signed “shim”. If the error appeared after installing or updating Linux, update the distribution’s shim and GRUB packages. Some PCs also have a separate setting to trust third-party (Microsoft UEFI CA) boot loaders, for example Allow Microsoft 3rd Party UEFI CA on some Lenovo models; turn it on if Linux is the loader being rejected. Windows itself doesn’t need that option.

If nothing works

1. Temporarily turn Secure Boot off in the firmware, start Windows, and copy your important files to an external drive.
2. Then reinstall Windows from fresh installation media with Secure Boot back on.
3. If even a clean install is rejected, the firmware’s key storage may be faulty; contact the PC maker’s support.

Related guides

• Error code 0xc0000428: Windows cannot verify the digital signature
• Your PC couldn’t start properly: how to fix it
• Dell BitLocker recovery key: where to find it
• New CPU installed, fTPM NV corrupted: what to choose

Official sources: for more detail, see these pages:

• Microsoft Support: Windows Secure Boot certificate expiration and CA updates
• Microsoft Learn: BCDBoot command-line options

Frequently asked questions

Can I just turn off Secure Boot?

It gets you into Windows, but it removes protection against boot-level malware, and Windows 11 expects it on. Use it only as a temporary step while you repair the boot files or update the BIOS.

Will I lose my files?

No. Restoring keys, Startup Repair and bcdboot don’t touch your personal files. Only a reinstall would, so back up first.

Why does it say Dell SupportAssist is starting?

When Windows can’t start, many Dell laptops fall back to the SupportAssist OS Recovery tool. Fix the boot problem and Windows starts normally again.

Is my PC infected?

Usually not, but if the error appeared out of nowhere, run a full scan with Microsoft Defender once Windows starts, and an offline scan if you’re worried.