What does NTSTATUS 0xC0430001 (STATUS_SECUREBOOT_ROLLBACK_DETECTED) mean?

STATUS_SECUREBOOT_ROLLBACK_DETECTED

Secure Boot rejected older protected state

STATUS_SECUREBOOT_ROLLBACK_DETECTED is an integrity result from the Secure Boot path. The platform detected that protected data would move backward to an older generation or value when rollback protection requires the newer state to remain authoritative. It is not merely a report that Secure Boot is disabled or unsupported.

Evidence to preserve

• Record the firmware version, Secure Boot state, recent firmware or servicing changes, and the operation that attempted to update or restore protected data.
• Compare the protected variable or update generation with a known-good machine or the vendor's expected deployment state.
• Correlate the first failure with firmware, boot, Code Integrity, or servicing events rather than later boot symptoms.

Recovery boundary

Use the supported firmware or Windows servicing path to bring protected state forward. Disabling Secure Boot or forcing older protected data can defeat the control that generated this status and should not be treated as a generic workaround.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values