STATUS_SECUREBOOT_POLICY_ROLLBACK_DETECTED: meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the policy anti-rollback version is older than the device accepts.

Previous	Next
STATUS_SECUREBOOT_PLATFORM_ID_MISMATCH	STATUS_SECUREBOOT_POLICY_UPGRADE_MISMATCH

STATUS_SECUREBOOT_POLICY_ROLLBACK_DETECTED

STATUS_SECUREBOOT_POLICY_ROLLBACK_DETECTED (NTSTATUS 0xC043000C) This NTSTATUS value reports that the policy anti-rollback version is older than the one accepted by the device.

What to check

Stop the downgrade attempt.
Check package selection, cache, and deployment versioning.
Use the newest authorized policy for this device.

Read-only checks

Get-SecureBootPolicy | Format-List

The device is deliberately refusing a downgrade. Determine the anti-rollback version of the active policy and deploy an authorized package with an equal or newer accepted version.

The accepted anti-rollback version is persistent device state. A retry with the same older policy cannot succeed; deployment logic should select an authorized policy whose version satisfies the device requirement.

Microsoft: Confirm-SecureBootUEFI

Microsoft: Get-SecureBootPolicy

Microsoft: Viewing Code Integrity events

Looking for a different code? Search another status or error code.