After a power outage, a laptop or PC suddenly shows Security Boot Fail and will not start Windows. The drive is healthy and the files are intact, yet the system does not boot. One cause that is especially relevant right now is tied to Windows moving to the new 2023 Secure Boot certificates: the firmware may have returned to its factory keys and stopped trusting the boot manager. Here is a real case on an Acer Aspire ES1-732: how to establish the cause and get Windows back without reinstalling it.

Checked: 03.11.2026 · Affects: PCs and laptops with UEFI and Secure Boot enabled, above all with old firmware · Case: Acer Aspire ES1-732 · Result: Windows restored without a reinstall

What it looks like

  • A padlock and the message Security Boot Fail appear during startup.

  • This may be followed by Default Boot Device Missing or Boot Failed.

  • The drive is listed in the boot menu as Windows Boot Manager, but selecting it changes nothing.

  • On other manufacturers' devices, a similar error may read Secure Boot Violation or Invalid signature detected.

Security Boot Fail screen with a padlock on an Acer laptopThe first screen after power-on: a padlock and Security Boot FailDefault Boot Device Missing or Boot Failed messageAfter you confirm, the firmware reports that it cannot boot from the driveBoot menu listing Windows Boot Manager on a WD Blue SA510 SSDThe drive is in the boot menu, but choosing Windows Boot Manager leads back to the error

A damaged boot manager, manually changed keys or a failing drive can look exactly the same. So we check first and change files only afterwards.

Why this happens

The 2011 Microsoft certificates behind Secure Boot were valid until 24 and 27 June and 19 October 2026. As a replacement, Windows adds Windows UEFI CA 2023 to the firmware's trusted signature database (db) and installs a new boot manager signed with it.

Older firmware is the weak spot. The certificate is written to the current db, while the factory copy, dbDefault, is usually updated only with a BIOS update. If the keys return to factory state, the certificate is gone from the firmware. The firmware then rejects the new boot manager even though the file itself is intact.

In our case the problem appeared after a power outage, so that is the likely trigger. We have no direct proof that the outage itself reset the keys: all that is confirmed is that the certificate was missing at the time of the failure.

What the diagnosis showed

Acer Aspire ES 17 sticker, model ES1-732Our case: an Acer Aspire ES1-732. The factory 1 TB HDD had earlier been replaced with a WD Blue SA510 SSD
CheckResultConclusion
SMART and the start of an SSD surface testNo errorsNo signs of a failing drive
chkdsk on the Windows and EFI partitionsNo errorsFile systems are intact
Secure Boot state in WinPEEnabled, and the USB drive bootedThe mechanism works; the problem is this specific boot manager
Size of bootmgfw.efi on the EFI partition3,086,680 bytes, the same as bootmgfw_EX.efi; the regular version is 1,682,440 bytesThe new type of boot manager is installed
Contents of dbCA 2023 missing, PCA 2011 presentThe firmware does not trust the new boot manager
Contents of dbDefaultCA 2023 missingAnother key reset will remove the certificate again

What to do: a step-by-step plan

Step 1. Protect your data

If the drive is encrypted with BitLocker, find the recovery key first. Changing the boot manager or Secure Boot settings may trigger a prompt for it. If the data matters, take a disk image first.

Step 2. Boot from external media

You need a USB drive with a WinPE environment, such as a Windows installation USB (press Shift+F10 for a command prompt). On Acer devices, F2 usually opens the BIOS and F12 the boot menu.

On our laptop we could not enter the BIOS with the usual keys, but with an external USB keyboard the system booted from the USB drive. If a recent Windows image gives the same error, it may be signed with the new certificate. In that case, use older media.

Step 3. Check the drive and the boot manager

Mount the EFI partition. In the volume list, find the FAT32 partition of about 100–300 MB and use its number in place of N:

diskpart
list vol
select vol N
assign letter=S
exit

Check the Windows partition letter in the volume list: in WinPE it may not be C:. Then run a check that changes nothing:

chkdsk C:
chkdsk S:
dir S:\EFI\Microsoft\Boot\bootmgfw.efi
dir C:\Windows\Boot\EFI\bootmgfw.efi
dir C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi

Compare the sizes. The exact numbers depend on the Windows build; what matters is which file the EFI copy matches. If it matches bootmgfw_EX.efi, move on. If it matches neither or chkdsk finds errors, the cause may be different, and you should not follow this plan mechanically.

Step 4. Temporarily restore the regular boot manager

First, save a copy of the EFI partition to the USB drive. In this example the USB drive is D:, so check its letter in the volume list:

xcopy S:\ D:\ESP_backup\ /E /H /I

Then replace both copies of the boot manager:

copy /y C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
copy /y C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Boot\bootx64.efi
wpeutil reboot

The bcdboot command did not help in our case: it reinstalled the EX version. This method works only until the PCA 2011 signature is revoked through dbx. After that revocation, the device no longer starts boot managers signed with this certificate.

Step 5. Check the certificates in Windows

Open PowerShell as administrator:

$d=[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes)
'db CA2023: ' + ($d -match 'Windows UEFI CA 2023')
$f=[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbDefault).Bytes)
'default CA2023: ' + ($f -match 'Windows UEFI CA 2023')

If db CA2023 is False, the cause is confirmed.

Step 6. Restore the certificate and the new boot manager

Microsoft documents a full deployment using the value 0x5944:

reg add HKLM\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

When the value changes to 0x4100 (on our laptop it was 0x4104), restart the device and run the same task again. Then restart once more and check the result:

Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object WindowsUEFICA2023Capable,UEFICA2023Status,UEFICA2023Error

A value of WindowsUEFICA2023Capable = 2 means the certificate is in db and the system starts through the new boot manager. On this laptop we used the narrower value 0x4044 and got the same result.

Event 1803 and the InProgress status may remain on older devices because they have no manufacturer-signed KEK. This does not affect booting, but some future Secure Boot updates may not install.

Step 7. A fallback: SecureBootRecovery.efi

Microsoft provides a separate utility that writes Windows UEFI CA 2023 back to the firmware. According to the ASUS guide, you copy C:\Windows\Boot\EFI\SecureBootRecovery.efi to a FAT32 USB drive as \EFI\BOOT\bootx64.efi and boot from it. We did not test this method on this laptop. Save the file to a USB drive in advance.

What not to do

  • Do not reinstall Windows or replace the SSD until you have checked the boot manager and certificates.

  • Do not leave Secure Boot disabled as a permanent fix: the device will not receive the new certificates that way.

  • Do not change the EFI partition without a backup and your BitLocker key.

  • Do not reset the BIOS to factory settings without checking dbDefault.

  • Do not rely only on a system image: it restores the same boot manager, and the firmware still will not have the certificate.

How to prepare in advance

Run the commands from step 5 on older laptops and PCs and assess the risk using this table:

dbdbDefaultWhat it means
TrueTrueThe certificate is also in the factory keys, so a reset should not cause this problem
TrueFalseEverything works now, but a key reset can stop the device from booting. Prepare a recovery plan
FalseAnyThe certificate is not in the current database yet. Update Windows and check the status

For devices at risk, it is worth doing the following:

  • check the manufacturer's site for a BIOS with the new certificates, although none is planned for some older models;

  • check the BIOS battery and the date after unplugging the device, and use a UPS for important PCs;

  • keep a bootable USB drive, SecureBootRecovery.efi and BitLocker keys separately from the device;

  • keep a system image somewhere other than the same SSD.

Commands and the rollout status may change, so check them against the Microsoft documentation before you start: the links are collected under "Sources".

Need help?

We will find out why the system does not boot, protect your data, get it working again without a reinstall and assess the risk for the rest of your PCs. We work remotely with clients across Ukraine and abroad, and can come on site when needed. Get in touch or see our 24/7 technical support service.

Sources