I restored the default settings to Secure Boot. Big mistake

[dorf]

I tried to get the latest secureboot certificate for my old Dell 7010 Optiplex machine.  
I restored the default settings to Secure Boot. Big mistake.
 Now when secure boot is on. The machine doesn't boot and complains about no booting devises. 

The computer's secure boot can't find where to boot and the information apparently has to be entered manually.
 Secureboot's settings are now years old and it can't find a new configuration. 
What could be done here?
There are plenty of files to choose from in the secureboot menu, but I don't know what to put there for each of the four

Windows 11 upgraded from 10..... originally who knows what (used machine)

without secureboot it booting normally

 

[binaryzero]

Leave Secure Boot off, the Optiplex 7010 isn't getting a firmware update to support the changes...

[+Warwagon MVC]

See if this article I wrote the other day works for you.

[Ixion]

Appreciating this guide is for HP Laptops but here's how to update the UEFI certificate database manually whether the OEM supports it or not:

https://h30434.www3.hp.com/t5/Business-Notebooks/Enabling-new-UEFI-2023-CA-certificates-in-pre-2018-HP/td-p/9628370

[dorf]

On 21/06/2026 at 15:49, Warwagon said:

See if this article I wrote the other day works for you.

This might work, but the boot menu F12 only shows hdd and dvd+/- and Niks

In the bios all usb are enabled.

the usb stick is in place and in the boot menu it does not show up in the bios boot order.

[+Warwagon MVC]

On 22/06/2026 at 14:25, dorf said:

This might work, but the boot menu F12 only shows hdd and dvd+/- and Niks

In the bios all usb are enabled.

the usb stick is in place and in the boot menu it does not show up in the bios boot order.

In the boot options in the UEFI is set to legacy or CMS? It needs to be set to UEFI if it's not already.

[+Edouard Subscriber²]

The laptop in the bedroom is an Acer with i7-10510U CPU. Acer's website states they will not be upgrading it so I had little choice other than disable secure boot.

I know next to nothing on these matters so hopefully it will be fine.

[Taliseian]

There is a long thread (128pgs and counting) that I've been following over at ElevenForums that has a method for updating Secure Boot even if there is no BIOS upgrade.

I've used this method and had zero issues.

NOTE:  I do not take any responsibility if this or any other Secure Boot method bricks your system -- YMMV!  Read carefully before using!

[Kolakid60]

I just dealt with a similar problem on my dell T5810.  I learned when you reset your secure boot settings, it resets the 4 TPM encryption keys. Which in-turn causes secure boot to fail.

When TPM (is not cleared by a user in bios) and secure boot keys (are not reset by user) then the system uses the TPM encryption keys to create a digital signature for your boot hard drive.

Once created, this is what allows you to boot up in secure boot mode.  So now, your only recourse is to boot up with secure boot off, and backup your existing data.

Following that, you must reload windows to recreate a new secure boot key signature.  

 

My Error Message - Operating System Loader Signature not found in secure boot database ('db')

Reason - This message happens when you alter your motherboards secure boot keys or clearing out your TPM firmware in bios. 

Solution - When you alter the secure boot keys or update your TPM firmware, you must re-install the windows operating system in order to get secure boot and TPM working again.  

Note1: You can turn off secure boot mode, and boot into your system in order to backup your data.

Note2: Before clearing out TPM keys, backup your BitLocker recovery keys. Because clearing out the TPM may lock you out of BitLocker-encrypted drives. 
If you don't know your BitLocker recovery keys, you can also access them by signing into your Microsoft account to get them.

Explanation

Secure Boot and a Trusted Platform Module (TPM) work together to create an impenetrable hardware-based security chain. 
While Secure Boot acts as the gatekeeper by verifying code signatures, the TPM acts as a tamper-resistant vault that records and seals your system's boot state.

How They Work Together
1. The Verification Process (Secure Boot): When you turn on your computer, the UEFI firmware checks the digital signature of every piece of software in the boot chain (bootloader, kernel, and core drivers) against a stored database of trusted keys. If software is unsigned or tampered with, Secure Boot blocks it.

2. The Measurement Process (TPM): Alongside this, the system performs "Measured Boot". As each stage of the boot process executes, it generates a unique cryptographic hash. These hashes are sent to the TPM, which stores them securely in internal registers.

3. Sealing Data: The TPM uses these "measurements" to lock/unlock encryption keys (like those used for BitLocker). If someone alters your system files or bypasses Secure Boot, the hash measurements change, and the TPM will refuse to release the decryption keys.

4. The Role of UEFI
To use these features together, your motherboard's BIOS must be operating in UEFI mode rather than Legacy/CSM. UEFI provides the environment where Secure Boot keys are validated and the measurements are first logged.

 

[erpster3]

On 21/06/2026 at 03:23, binaryzero said:

Leave Secure Boot off, the Optiplex 7010 isn't getting a firmware update to support the changes...

yes AND no

the "original" or plain/normal Optiplex 7010 won't be getting any more new firmware updates BUT the Optiplex SFF/SFF Plus {small form factor}, Micro/Micro Plus & Tower/Tower Plus 7010 editions DO get new updates such as this new one

On 22/06/2026 at 03:15, Ixion said:

Appreciating this guide is for HP Laptops but here's how to update the UEFI certificate database manually whether the OEM supports it or not:

https://h30434.www3.hp.com/t5/Business-Notebooks/Enabling-new-UEFI-2023-CA-certificates-in-pre-2018-HP/td-p/9628370

 

and here are similar guides from the Dell web site for Dell systems:

https://www.dell.com/support/kbdoc/en-us/000390990/secure-boot-transition-faq

https://www.dell.com/support/kbdoc/en-us/000347876/microsoft-2011-secure-boot-certificate-expiration