Hi

Normally Secure Boot is not a vital part of the boot process, however.....

This error means your firmware’s Secure Boot allowed-signature database (db) does not contain the certificate needed to trust your Windows boot loader. On many Dell PCs the direct fix is to enable Microsoft UEFI CA in BIOS; on other brands, restore the factory/default Secure Boot keys.dell+2

First: try the likely BIOS fix

1. Power off, then enter BIOS/UEFI setup:

   • Dell: press F2 during startup.

   • HP: Esc or F10.

   • Lenovo: F1 or F2.

   • ASUS: F2 or Del.

2. Look under Secure Boot, Boot Configuration, Security, or Advanced.

3. Find Enable Microsoft UEFI CA (Dell wording) and set it to On/Enabled. Dell identifies a missing/disabled Microsoft UEFI Certificate Authority as the cause of this exact class of boot failure.dell+1

4. Save changes and reboot.

If you cannot find that setting, look for Restore Factory Keys, Reset to Setup Mode/Default Keys, or Install Default Secure Boot keys. This repopulates db with the vendor/Microsoft certificates that Windows needs; Microsoft’s guidance specifies that the Windows loader must be allowed by an entry in db.learn.microsoft+1

Then check the boot entry

Still in BIOS:

• Set boot mode to UEFI, not Legacy/CSM.

• Ensure Windows Boot Manager is first in the UEFI boot order.

• Do not point the boot entry at \EFI\BOOT\BOOTX64.EFI if a proper Windows Boot Manager entry exists; the Windows loader is normally at \EFI\Microsoft\Boot\bootmgfw.efi.

• Disable Fast Boot temporarily if the firmware offers it, since it can skip device initialization and complicate boot troubleshooting.

If it still fails

• Update the BIOS/UEFI firmware from your PC manufacturer while Secure Boot is temporarily disabled; outdated firmware can have incomplete or outdated Secure Boot certificate support.

• Once Windows boots, run Windows Update and install all firmware/UEFI updates, then re-enable Secure Boot.

• If this is a Linux installation rather than Windows, the Linux bootloader must be signed through Microsoft’s shim, or you must enroll your distribution’s signing key in the firmware’s Secure Boot database. The error is expected if the installed GRUB/shim binary is unsigned or absent from db.learn.microsoft+1

• Avoid deleting Secure Boot keys or choosing “Clear/Delete all Secure Boot variables” unless you know how to restore them; that can leave the system unable to trust any boot loader until factory keys are restored.

Important distinction

This is not usually “Windows is missing.” The loader is present, but Secure Boot cannot verify its signature because the trusted certificate is missing from db. Enabling Microsoft UEFI CA or restoring default Secure Boot keys addresses that directly.dell+1

Please advise us of any progress or problems.

What model system?  What version of the OS?  Was the OS installed in secure boot mode?

If the system is older, running in legacy mode, you can't simply enable secure boot -- the OS will need to be reinstalled.

@ejn63​ windows 11, dell xps 8900, idk how os was installed, bought it with OS, bios version newest

@username0101​ 

Chances are the OS was installed in legacy/CSM mode.  Open the disc manager -- if you see the drive containing Windows installed in master boot record (MBR) mode, that is the case.  Though there is a utility to convert the system to GPT (required for UEFI/secure boot), you're honestly better off simply making Windows 11 boot media (use the Microsoft Media Creation tool) and then setting the system to UEFI mode in setup and completely reinstalling the operating system in GPT mode.

@ejn63​ disc have GPT mode :( and UEFI on

@ejn63​ 

Information indicates that Windows 11 is not supported by this Dell model.

@username0101​ 

That is correct -- you would need to install it in unsupported mode.  The CPU generation in that model is too old for official support of Windows 11.

There are ways to install Windows 11 with UEFI support, assuming it isn't that way now.  However, if your reason for needing secure boot support is that the system have the full Windows 11 support as well, you need a newer system.

Since you have no idea how the OS was installed, if you want to solve the immediate problem, a clean install of Windows is the best path forward.