ASUS mobo wont boot unless secure boot is off suddenly


Recommended Posts

So I have an ASUS ROG Strix Z890-E motherboard with a 285K, it's worked perfectly until last night... I went to reinstall windows

Did a secure erase of the SSD which I've done before to blank them out, except this time I could not get the windows 11 installer USB drive to boot from.. it would just go right back to the UEFI BIOS screen... tried that multiple times no luck, tried other boot drives no luck, they all worked in the past, they are all UEFI boot devices too.. ok can't do anything

messed with it for an hour last night nothing, cleared bios settings, nothing, reflashed the bios nothing... the BIOS is the latest version ASUS has available also.

This morning disabled secure boot and bingo it works..

Turn secure boot back on and nope nothing... cleared the keys loaded defaults nothing... turn off works again

This makes no sense secure boot was working fine until I erased the SSD to do a reinstall..

 

anyone have any ideas? I'm stumped, the secure boot keys shouldn't be expired it's the latest BIOS update that was just pushed last month and apparently they added new keys months ago to it.

Posted (edited)

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

One thing I did to fix a system that wouldn't boot with secure boot enabled is go to C:\Windows\Boot\EFI

and an copy SecureBootRecovery.efi to a flash drive into the folder EFI / Boot

Then boot off the flash drive. After it repairs try turning it back on.

Posted (edited)
On 20/05/2026 at 05:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

But OP said they flashed the most recent bios and it is up to date. Do we need to wait for ASUS to publish another new version?

 

NVM i misunderstood what you were trying to say.

On 20/05/2026 at 08:05, Ixion said:

This sounds very much like the new secure boot certificates Microsoft has been busy rolling out which install in the certificate database on your UEFI.

The installer probably has the UEFI 2023 secure boot certificates. You'll need to update the BIOS on your motherboard to recognise the new certificates. Failing that it could be your machine already updated to the 2023 certs and no longer accepts the 2011 ones on the older versions of install media. If that's the case you'll just need updated install media.

 

Having re-read your original post the second scenario seems way more likely, so you'll just need new install media such as a 25H2 Iso.

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

Posted (edited)

On another forum, I used a PS script to update my Secure Boot keys.  I've seen people use this when their bios is too old and the maker is not going to update their bios.

Here is the link to the thread on ElevenForum -- Please read carefully (the entire thread is over 70pgs and growing) as I am not responsible for any damage or you ending up with a non-bootable device should things go wrong.  I'm just sharing information that may help someone out:

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

Posted (edited)
On 20/05/2026 at 22:07, neufuse said:

it wont even boot like this with the newest win 11 iso images just goes right to the bios screen when told to boot from it

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

Edited by Ixion
Added what response to expect
  • Like 1
Posted (edited)
On 20/05/2026 at 23:20, goretsky said:

Hello,

Did you create your Windows 11 installation media using the Windows Media Creation Tool, Rufus or some other tool?  If you did not use the Windows Media Creation tool, try using it instead to (re)create your media and see if using it makes any difference.

Regards,

Aryeh Goretsky


 

no it's the actual windows ISO downloaded as an ISO from the download site, not through the media creation tool. I also did try making a USB flash stick with the tool and same result.

On 21/05/2026 at 07:19, Ixion said:

I've seen similar things on some of our work machines, where I've ended up in a catch-22 of the BIOS supports the new keys, Windows will only boot with secure boot turned off. None of the scripts work to update the certificates database because without secure boot enabled they can't access the certs.

There are ways of fixing it from a UEFI prompt but they look horrendous. On those machines I ended up booting from an old windows install using the 2011 certificates, doing the secure boot updates then putting the new image back on but I appreciate this isn't an option for the average home user!

You can check the current status by doing the following:

Step 1: Open PowerShell as administrator

Right-click the Start button and choose Windows PowerShell (Admin) or Terminal (Admin).

Step 2: Run this command exactly as shown

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If it returns true then you have the 2023 cert installed in the UEFI, if it returns false you still have the 2011 version.

done that already, it returns true, that was back before this started when I checked to make sure the latest bios did have the new keys already

Posted (edited)
On 21/05/2026 at 10:33, Ixion said:

If you used a tool like Rufus did you tick the use 2023 UEFI certificate signed bootloader box on the Windows customizations? It's off by default.

As I've said, this is the Microsoft ISO image for windows, the direct download of it... I also tried the medica creation tool same result.. booting directly from a ISO image using  a media emulator with my JetKVM.

Posted (edited)
On 23/05/2026 at 01:24, binaryzero said:

Sounds like pebkac

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Edited by neufuse
On 24/05/2026 at 22:21, neufuse said:

BS, why would this only happen when I set it to a specific date.

This issue was only noticed when I went to reinstall the OS, wiping the SSD to do a reinstall shouldn't make secure boot not work, using the latest ISO's isn't a user issue, they have the the latest keys, so that's still not a a user issue, the BIOS was update still not a user issue... the only thing that changed was the date...

This sounds like a calendar bug you know since keys are date based too.....

Not checking the date is correct is the pebkac... ;)

  • Facepalm 3
Posted (edited)
On 24/05/2026 at 09:25, binaryzero said:

Not checking the date is correct is the pebkac... ;)

apparently you didn't understand what is going on..

the DATE WAS CORRECT, secure boot would not work on one day... the next day it just worked... I swapped the date back to the previous day and secure boot wouldn't work again... that's not PEBKAC that's verification of an issue

Edited by neufuse
  • Like 2

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • As I've been usually saying lately - we all can thank "AI" for this.
    • Friday Windows 11 preview builds are here. Insiders in the Experimental (formerly Dev) and Beta Channel can download builds 26300.8697 and 26220.8690. My Windows11 device on the Preview Channel just got 26220.8728. My guess is this build is a nightly update from 26220.8690.
    • Traffic has a surprisingly unexpected impact on your surroundings by Sayan Sen Image by Radik 2707 via Pexels A collaborative study by researchers from several Israeli institutions found that everyday pollution from traffic and industrial activity measurably changed the atmospheric electric field over the Tel Aviv metropolitan area, providing new evidence of how human activity can influence the lower atmosphere. The research was led by Dr. Roy Yaniv of the Hebrew University of Jerusalem and the Gertner Institute at Sheba Medical Center, Dr. Assaf Hochman of the Fredy & Nadine Herrmann Institute of Earth Sciences at the Hebrew University, and Prof. Yoav Yair of Reichman University. The study also involved Itay Froomer, a student from Hadera High School and the Israeli Museum of Medicine and Science (Technoda), who carried out the work as part of the Ministry of Education's 5-unit physics research track. The researchers focused on the atmospheric electric field under fair-weather conditions. Even in the absence of storms, a weak electric field naturally exists between Earth's surface and the atmosphere. One of the main ways scientists measure this field is through the Potential Gradient (PG), which is the inverse of the vertical component of the electric field. PG is a key part of the global electric circuit, a planet-wide system of electrical currents maintained by thunderstorms and electrified clouds around the world. Scientists have long known that the atmospheric electric field can be influenced by factors ranging from large-scale atmospheric processes to local weather conditions such as dust, fog and clouds. Human-made pollution is also known to play a role, but understanding exactly how urban emissions affect the electric field close to the ground has remained an area of ongoing research. To investigate this relationship, the team analyzed measurements from a newly installed electric field mill, an instrument used to continuously monitor the strength of the atmospheric electric field. The instrument was installed at the Center for Technological Education (Roter House) in Holon and became operational in August 2024. It was funded by Israel's Ministry of Education and the Holon municipality. The electric field mill forms part of a broader monitoring network that includes nearby meteorological stations and air-quality monitoring sites. This allowed researchers to compare electric field measurements with detailed weather data and pollution records to better understand what was driving changes in the Potential Gradient. The study focused on two major urban pollutants: fine particulate matter (PM2.5) and nitrogen oxides (NOx), both commonly produced by vehicle traffic and industrial activity. PM2.5 refers to microscopic airborne particles small enough to remain suspended in the atmosphere for extended periods, while NOx is a group of gases released during fuel combustion. Researchers examined daily, weekly and seasonal patterns in the atmospheric electric field and compared them with changes in pollutant concentrations. Their analysis revealed a clear relationship between NOx levels and changes in the Potential Gradient, particularly during morning and evening rush hours when traffic emissions were at their highest. “What we observe is a direct physical link between emission peaks and electrical variability,” explained Dr. Roy Yaniv. “NOx reduces atmospheric conductivity very quickly, so the electric field responds almost instantaneously during traffic rush hours.” Atmospheric conductivity describes how easily electrical charges move through the air. According to the researchers, nitrogen oxides rapidly alter this conductivity, causing a near-immediate response in the electric field. PM2.5, however, was associated with a delayed response. The researchers attributed this difference to the particles' longer atmospheric residence time, meaning they remain in the atmosphere for longer periods, as well as their different microphysical interactions with surrounding air and atmospheric components. The study also identified a pronounced "weekend effect." In Israel, traffic volumes and some industrial activity decline significantly on Fridays and Saturdays. During these periods, concentrations of both NOx and PM2.5 dropped, and corresponding changes were observed in the atmospheric electric field. “The weekend signal demonstrates just how sensitive the electric field is to changes in human activity,” the researchers noted. “When emissions decline, the electrical environment adjusts at once, providing a high-resolution indicator of urban atmospheric conditions.” The findings showed that pollution levels can influence not only the chemical composition of the atmosphere but also its electrical properties. Researchers said the results strengthened the case for using atmospheric electricity as an additional tool for environmental monitoring, particularly in densely populated urban areas where anthropogenic, or human-caused, influences are most pronounced. The study also pointed to potential public health applications. By combining air-quality measurements with observations of atmospheric electricity, researchers said they could gain a more complete picture of how urban atmospheric conditions change over time. “Integrating air-quality data with electric-field measurements gives us a clearer picture of how the lower atmosphere evolves moment by moment,” the researchers added. “It’s a framework that can support both scientific insight and practical environmental decision-making.” Beyond the scientific findings, the project highlighted a collaboration between universities, public institutions and secondary education. Researchers said the work demonstrated how students could take part in real-world environmental research while contributing to studies of air quality, atmospheric processes and their potential effects on society. Source: Hebrew University, ScienceDirect This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing
    • We aren't even at the all-star game and Microsoft is talking about an update that will most likely be released during the World Series if not after. A lot can happen in the world between now and the 2026 World Series, including the 2026 FIFA Cup. Tell me about it again after the FIFA Cup is concluded. That should allow plenty of time to prepare for it.
    • Great, tell me when I have a "Bad Pool Caller" elsewhere not in Windoze.
  • Recent Achievements

    • Week One Done
      AMV earned a badge
      Week One Done
    • One Month Later
      AMV earned a badge
      One Month Later
    • Collaborator
      ryansurfer98 went up a rank
      Collaborator
    • One Month Later
      Eurosoft10 earned a badge
      One Month Later
    • Week One Done
      Eurosoft10 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      539
    2. 2
      +Edouard
      186
    3. 3
      PsYcHoKiLLa
      79
    4. 4
      Michael Scrip
      77
    5. 5
      Steven P.
      71
  • Tell a friend

    Love Neowin? Tell a friend!