What does Windows error code 4426 (ERROR_SECUREBOOT_FILE_REPLACED) mean?

 
Previous Next
ERROR_SECUREBOOT_NOT_ENABLED ERROR_SECUREBOOT_POLICY_NOT_AUTHORIZED

ERROR_SECUREBOOT_FILE_REPLACED

ERROR_SECUREBOOT_FILE_REPLACED (LRESULT 0x0000114A) This Win32 error means a file or driver protected by Secure Boot was replaced by a different file or driver.

What to check

  • Identify the affected boot component or driver from the earliest Code Integrity event, not from the final error alone.
  • Restore the component only from a supported Windows, OEM, or software-vendor package that matches the device and Windows version.
  • Check whether a security product, driver update, or offline servicing action replaced a protected file.

Read-only checks

Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 50

The important evidence is the first Code Integrity event naming the changed component. Restore that component from a matching signed package and then determine which update or servicing action replaced it.

Microsoft: Viewing Code Integrity events

Microsoft: Code Integrity event log messages

Microsoft: Secure Boot

Looking for a different code? Search another status or error code.