Skip to main content

Secure Boot Invalid Signature

Error message: ``

Jake received this error message on his msi-laptop-1 machine and eventually figured out a resolution.

Disable Secure Boot​

  1. Shutdown the computer.
  2. Power on the computer.
  3. While booting, repeatedly press the del key to get into the BIOS menu.
  4. Navigate to Security > Secure Boot and attempt to disable it.

Secure Boot Controls Disabled (greyed-out)​

If the Secure Boot controls are disabled or greyed out, as they were for Jake, you should be able to enable the controls by booting into an installation media temporarily:

  1. Prepare a USB Windows Installation Media.
  2. Boot into the USB Windows Installation Media.
  3. Choose "Repair my machine".
  4. Close the menu and reboot.
  5. Follow the steps to Disable Secure Boot, which should now be available.

Fix EFI Configuration​

Instructions adapted from this article.

  1. After disabling Secure Boot, you should be able to boot into Windows.
  2. Prepare a USB drive by formatting it to FAT32 and ensuring the device is empty.
  3. Create a folder structure on the USB drive matching E:\EFI\BOOT\.
  4. Navigate to C:\Windows\Boot\EFI\ and locate the SecureBootRecovery.efi file.
  5. Copy the SecureBootRecovery.efi file into the USB E:\EFI\BOOT\ directory and rename the file to bootx64.efi.
  6. Reboot the computer and repeatedly press F11 to access the boot menu
  7. Choose the USB device we just formatted.
  8. Wait for the computer to reboot automatically.
  9. Verify you can boot into Windows.
  10. Boot into BIOS again to re-enable Secure Boot.
  11. Verify you can still boot into Windows.