ASUS mobo wont boot unless secure boot is off suddenly

[neufuse Veteran]

So I have an ASUS ROG Strix Z890-E motherboard with a 285K, it's worked perfectly until last night... I went to reinstall windows

Did a secure erase of the SSD which I've done before to blank them out, except this time I could not get the windows 11 installer USB drive to boot from.. it would just go right back to the UEFI BIOS screen... tried that multiple times no luck, tried other boot drives no luck, they all worked in the past, they are all UEFI boot devices too.. ok can't do anything

messed with it for an hour last night nothing, cleared bios settings, nothing, reflashed the bios nothing... the BIOS is the latest version ASUS has available also.

This morning disabled secure boot and bingo it works..

Turn secure boot back on and nope nothing... cleared the keys loaded defaults nothing... turn off works again

This makes no sense secure boot was working fine until I erased the SSD to do a reinstall..

 

anyone have any ideas? I'm stumped, the secure boot keys shouldn't be expired it's the latest BIOS update that was just pushed last month and apparently they added new keys months ago to it.

[neufuse Veteran]

To add i also removed all the SSD's to make sure that somehow wasn't causing something, same result wont boot with secure boot enabled... even though it did fine for the past year...

[Ixion]

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

[+Warwagon MVC]

One thing I did to fix a system that wouldn't boot with secure boot enabled is go to C:\Windows\Boot\EFI

and an copy SecureBootRecovery.efi to a flash drive into the folder EFI / Boot

Then boot off the flash drive. After it repairs try turning it back on.

[Circaflex]

On 20/05/2026 at 05:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

But OP said they flashed the most recent bios and it is up to date. Do we need to wait for ASUS to publish another new version?

 

NVM i misunderstood what you were trying to say.

[neufuse Veteran]

On 20/05/2026 at 08:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

[Taliseian]

On another forum, I used a PS script to update my Secure Boot keys.  I've seen people use this when their bios is too old and the maker is not going to update their bios.

Here is the link to the thread on ElevenForum -- Please read carefully (the entire thread is over 70pgs and growing) as I am not responsible for any damage or you ending up with a non-bootable device should things go wrong.  I'm just sharing information that may help someone out:

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

[goretsky Supervisor]

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

[Ixion]

On 20/05/2026 at 22:07, neufuse said:

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

Edited May 21 by Ixion
Added what response to expect

[neufuse Veteran]

On 20/05/2026 at 23:20, goretsky said:

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

no it's the actual windows ISO downloaded as an ISO from the download site, not through the media creation tool. I also did try making a USB flash stick with the tool and same result.

On 21/05/2026 at 07:19, Ixion said:

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

done that already, it returns true, that was back before this started when I checked to make sure the latest bios did have the new keys already

[Ixion]

If you used a tool like Rufus did you tick the use 2023 UEFI certificate signed bootloader box on the Windows customizations? It's off by default.

[neufuse Veteran]

On 21/05/2026 at 10:33, Ixion said:

If you used a tool like Rufus did you tick the use 2023 UEFI certificate signed bootloader box on the Windows customizations? It's off by default.

As I've said, this is the Microsoft ISO image for windows, the direct download of it... I also tried the medica creation tool same result.. booting directly from a ISO image using  a media emulator with my JetKVM.

[neufuse Veteran]

And now it's working fine with secure boot... what the heck

[Taliseian]

There has been a few MS updates that have included SB keys and a way to check your status in the Windows Security App under Device Security

The green check shows you're ok

[Circaflex]

Computer gremlins man

[neufuse Veteran]

wonder if this is a calendar issue, if i switch the system clock back to the prior days it's back again.... move forward no issue

 

[binaryzero]

Sounds like pebkac

[neufuse Veteran]

On 23/05/2026 at 01:24, binaryzero said:

Sounds like pebkac

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Edited May 24 by neufuse

[binaryzero]

On 24/05/2026 at 22:21, neufuse said:

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Not checking the date is correct is the pebkac...

[neufuse Veteran]

On 24/05/2026 at 09:25, binaryzero said:

Not checking the date is correct is the pebkac...

apparently you didn't understand what is going on..

the DATE WAS CORRECT, secure boot would not work on one day... the next day it just worked... I swapped the date back to the previous day and secure boot wouldn't work again... that's not PEBKAC that's verification of an issue

Edited May 24 by neufuse

[neufuse Veteran]

issue was reported to ASUS.. moving on