Windows error 4424 (ERROR_SECUREBOOT_POLICY_NOT

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_SECUREBOOT_POLICY_NOT_SIGNED the Secure Boot policy is either not signed or is signed by a non-trusted signer.

Previous	Next
ERROR_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND	ERROR_SECUREBOOT_NOT_ENABLED

ERROR_SECUREBOOT_POLICY_NOT_SIGNED

ERROR_SECUREBOOT_POLICY_NOT_SIGNED (LRESULT 0x00001148) This Win32 error means the Secure Boot policy is unsigned or its signer is not trusted by the device.

What to check for ERROR_SECUREBOOT_POLICY_NOT_SIGNED

Verify the policy package and certificate chain from the original deployment source.
Check that the intended signing certificate is enrolled in the appropriate Secure Boot trust path for this device.
Do not remove existing PK, KEK, DB, or DBX entries merely to make an untrusted policy load.

Read-only checks

Get-SecureBootUEFI -Name PK | Format-List

Get-SecureBootUEFI -Name KEK | Format-List

Get-SecureBootUEFI -Name DB | Format-List

Secure Boot policy and UEFI-variable changes can affect whether a device boots. For ERROR_SECUREBOOT_POLICY_NOT_SIGNED, capture the current state first and use only the approved signed policy or OEM workflow for changes.

Microsoft: Get-SecureBootUEFI

Microsoft: Set-SecureBootUEFI

Microsoft: Secure Boot

Looking for a different code? Search another status or error code.