STATUS_SECUREBOOT_POLICY_NOT_SIGNED: meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The Secure Boot policy is unsigned or is signed by a signer that this device does not trust.

Previous	Next
STATUS_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND	STATUS_SECUREBOOT_FILE_REPLACED

STATUS_SECUREBOOT_POLICY_NOT_SIGNED

STATUS_SECUREBOOT_POLICY_NOT_SIGNED (NTSTATUS 0xC0430005) This NTSTATUS value reports that the policy is unsigned or signed by an untrusted signer.

What to check

Verify the policy file and signing chain from the original source.
Inspect PK, KEK, and DB only to understand the existing trust configuration.
Do not erase trust databases to bypass a signature check.

Read-only checks

Get-SecureBootUEFI -Name PK | Format-List

Get-SecureBootUEFI -Name KEK | Format-List

Get-SecureBootUEFI -Name DB | Format-List

Separate a missing signature from an untrusted signer by checking the original policy package and the device’s trust state. The fix is a correctly signed authorized policy, not removal of existing Secure Boot keys.

Microsoft: Confirm-SecureBootUEFI

Microsoft: Get-SecureBootPolicy

Microsoft: Viewing Code Integrity events

Looking for a different code? Search another status or error code.