ASUS mobo wont boot unless secure boot is off suddenly


Recommended Posts

So I have an ASUS ROG Strix Z890-E motherboard with a 285K, it's worked perfectly until last night... I went to reinstall windows

Did a secure erase of the SSD which I've done before to blank them out, except this time I could not get the windows 11 installer USB drive to boot from.. it would just go right back to the UEFI BIOS screen... tried that multiple times no luck, tried other boot drives no luck, they all worked in the past, they are all UEFI boot devices too.. ok can't do anything

messed with it for an hour last night nothing, cleared bios settings, nothing, reflashed the bios nothing... the BIOS is the latest version ASUS has available also.

This morning disabled secure boot and bingo it works..

Turn secure boot back on and nope nothing... cleared the keys loaded defaults nothing... turn off works again

This makes no sense secure boot was working fine until I erased the SSD to do a reinstall..

 

anyone have any ideas? I'm stumped, the secure boot keys shouldn't be expired it's the latest BIOS update that was just pushed last month and apparently they added new keys months ago to it.

Posted (edited)

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

One thing I did to fix a system that wouldn't boot with secure boot enabled is go to C:\Windows\Boot\EFI

and an copy SecureBootRecovery.efi to a flash drive into the folder EFI / Boot

Then boot off the flash drive. After it repairs try turning it back on.

Posted (edited)
On 20/05/2026 at 05:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

But OP said they flashed the most recent bios and it is up to date. Do we need to wait for ASUS to publish another new version?

 

NVM i misunderstood what you were trying to say.

On 20/05/2026 at 08:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

Posted (edited)

On another forum, I used a PS script to update my Secure Boot keys.  I've seen people use this when their bios is too old and the maker is not going to update their bios.

Here is the link to the thread on ElevenForum -- Please read carefully (the entire thread is over 70pgs and growing) as I am not responsible for any damage or you ending up with a non-bootable device should things go wrong.  I'm just sharing information that may help someone out:

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

Posted (edited)
On 20/05/2026 at 22:07, neufuse said:

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

Edited by Ixion
Added what response to expect
  • Like 1
Posted (edited)
On 20/05/2026 at 23:20, goretsky said:

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

no it's the actual windows ISO downloaded as an ISO from the download site, not through the media creation tool. I also did try making a USB flash stick with the tool and same result.

On 21/05/2026 at 07:19, Ixion said:

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

done that already, it returns true, that was back before this started when I checked to make sure the latest bios did have the new keys already

Posted (edited)
On 21/05/2026 at 10:33, Ixion said:

If you used a tool like Rufus did you tick the use 2023 UEFI certificate signed bootloader box on the Windows customizations? It's off by default.

As I've said, this is the Microsoft ISO image for windows, the direct download of it... I also tried the medica creation tool same result.. booting directly from a ISO image using  a media emulator with my JetKVM.

Posted (edited)
On 23/05/2026 at 01:24, binaryzero said:

Sounds like pebkac

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Edited by neufuse
On 24/05/2026 at 22:21, neufuse said:

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Not checking the date is correct is the pebkac... ;)

  • Facepalm 3
Posted (edited)
On 24/05/2026 at 09:25, binaryzero said:

Not checking the date is correct is the pebkac... ;)

apparently you didn't understand what is going on..

the DATE WAS CORRECT, secure boot would not work on one day... the next day it just worked... I swapped the date back to the previous day and secure boot wouldn't work again... that's not PEBKAC that's verification of an issue

Edited by neufuse
  • Like 2

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Google is opening the world's first AI museum in Los Angeles by Ivan Jenic Image via: Google Ever since AI image generators went mainstream, the debate over whether AI-generated art is real art hasn't let up. Those who don’t consider AI to be art say that if a machine does the creating and anyone can prompt it, there’s no skill involved, and therefore no art is produced. The counter-argument is equally persistent, as defenders of AI-generated artworks often claim that AI is just a tool, and that every major technological breakthrough, like the camera or the computer, was met with the same skepticism before eventually being accepted as a legitimate creative medium. Google’s position in this debate is clear. Which is no surprise, as the company is investing billions in AI infrastructure. And now, in efforts to encourage people to use its AI even more, Google is opening Dataland on June 20, which it's calling the world's first AI arts museum. Located inside The Grand LA, a Frank Gehry-designed building in Los Angeles, the museum spans 25,000 square feet. The museum is built around a collaboration with media artist Refik Anadol, who has worked with Google since 2016. The inaugural exhibition is called Machine Dreams: Rainforest, and is powered by an AI model trained on “an extensive dataset of the natural world.” It generates 1.2 billion pixels of visuals in real time and reacts to visitors dynamically. The space also generates soundscapes, real-time emotion sensing, and algorithmically produced scents. Image via: Refik Anadol Studio / Google Google says that the museum is powered by its Gemini models, which run on Google Cloud. So, everything is generated inside one of Google’s AI data centers and is streamed to the museum. Alongside the museum opening, Google Arts & Culture is funding an AI Artist Residency, giving four artists $25,000 grants each, along with mentorship from Refik Anadol Studio and access to Google's machine learning tools. Their work will be shown at Dataland and on the Google Arts & Culture website later this year. Google’s AI museum will undoubtedly initiate a fired-up debate on social media, and we can’t wait to see the first reactions. Via: Smithsonian Magazine
    • Calling GTA 6 overhyped crap doesn’t make you edgy, it just makes you sound like someone who hasn’t enjoyed anything since the PS2 era.
    • I’m not arguing whether Rockstar likes money. Obviously, they do, they’re a business. I’m saying this isn’t new. They’ve always launched console first. This is just how Rockstar operates.
    • I'm not sure how old the school is, but they've been doing this since GTA 3. Back in those days we'd be lucky for game companies to release on the PC at all. And with the current state of Sony (or Microsoft) their gaming wing won't be getting a penny from me.
    • We now know when and how the Universe may truly end by Sayan Sen Image by Marek Pavlík via Pexels| Not representative A study by physicist Henry Tye of Cornell University suggests that the universe may not expand forever. Instead, it could eventually stop expanding, begin contracting and end in a "Big Crunch" roughly 20 billion years from now. The research, published in the Journal of Cosmology and Astroparticle Physics, was conducted by Tye, Horace White Professor of Physics Emeritus at Cornell University. Using recent observations from major dark-energy surveys, Tye and his collaborators developed a cosmological model that predicts the universe could have a total lifespan of about 33 billion years. Since the universe is currently estimated to be 13.8 billion years old, the model places it near the midpoint of its existence. According to Cornell University's summary of the research, the study centers on the cosmological constant, a term introduced by Albert Einstein in his theory of general relativity. In modern cosmology, the cosmological constant is commonly used to describe the simplest form of dark energy, the unknown phenomenon believed to be driving the accelerating expansion of the universe. "For the last 20 years, people believed that the cosmological constant is positive, and the universe will expand forever," Tye said in a Cornell University news release. "The new data seem to indicate that the cosmological constant is negative, and that the universe will end in a big crunch." The study draws on data from the Dark Energy Survey (DES) and the Dark Energy Spectroscopic Instrument (DESI), two major projects designed to investigate the nature of dark energy. According to Tye, recent observations suggest that dark energy may not behave exactly like a simple cosmological constant. To account for those observations, Tye and his collaborators proposed a model involving an extremely light hypothetical particle that evolves over time. In their calculations, this produces a negative cosmological constant and leads to a future collapse of the universe. The model predicts that cosmic expansion would continue for approximately another 11 billion years before reaching a maximum size, after which the universe would begin contracting and eventually collapse. Scientists have long debated how the universe might end. As explained in an article published in The Conversation by Stephen DiKerby of Michigan State University, several possibilities have been proposed. If dark energy remains constant and positive, the universe could continue expanding indefinitely, gradually becoming colder, darker and more diffuse in a scenario often called the "heat death" of the universe. Other theoretical possibilities include a Big Rip, in which cosmic expansion accelerates so dramatically that galaxies, stars and even atoms are torn apart, or a Big Crunch, in which expansion reverses and the universe collapses back into an extremely dense state. DiKerby notes that the Big Crunch idea itself is not new. What distinguishes Tye's work is that it attempts to use current observational data to estimate when such a collapse might occur and how it could unfold. Much of the universe's long-term evolution remains uncertain. According to current astrophysical understanding, stars will continue to form and die for billions of years. The Sun, for example, is about halfway through its expected lifespan. Galaxies are also expected to continue merging; the Milky Way and Andromeda galaxies are projected to collide several billion years from now. At the same time, the nature of dark energy remains one of the biggest unanswered questions in cosmology. While observations indicate that the universe's expansion is accelerating, scientists still do not know what is causing that acceleration. Future observations may therefore alter current predictions about the cosmos's ultimate fate. Tye emphasized that additional evidence will be needed before firm conclusions can be drawn. DESI continues to collect data, while upcoming observations from missions and observatories including Euclid, SPHEREx and the Vera C. Rubin Observatory are expected to provide more precise measurements of dark energy. "People have said before that if the cosmological constant is negative, then the universe will collapse eventually. That's not new," Tye said. "However, here the model tells you when the universe collapses and how it collapses." For now, the study presents one possible future for the cosmos rather than a settled prediction. Whether the universe ultimately ends in a Big Crunch, expands forever, or follows another path entirely remains an open question that future observations will help answer. Source: Cornell University, The Conversation This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
  • Recent Achievements

    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
    • One Month Later
      eurospharma62 earned a badge
      One Month Later
    • Week One Done
      With What earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      570
    2. 2
      +Edouard
      175
    3. 3
      PsYcHoKiLLa
      73
    4. 4
      Michael Scrip
      68
    5. 5
      neufuse
      64
  • Tell a friend

    Love Neowin? Tell a friend!