What does NTSTATUS 0xC0430005 (STATUS_SECUREBOOT_POLICY_NOT_SIGNED) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

STATUS_SECUREBOOT_POLICY_NOT_SIGNED the Secure Boot policy is either not signed or is signed by a non-trusted signer.

Previous	Next
STATUS_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND	STATUS_SECUREBOOT_FILE_REPLACED

STATUS_SECUREBOOT_POLICY_NOT_SIGNED

STATUS_SECUREBOOT_POLICY_NOT_SIGNED (NTSTATUS 0xC0430005) This NTSTATUS value reports that the policy is unsigned or signed by an untrusted signer.

What to check for STATUS_SECUREBOOT_POLICY_NOT_SIGNED

Verify the policy file and signing chain from the original source.
Inspect PK, KEK, and DB only to understand the existing trust configuration.
Do not erase trust databases to bypass a signature check.

Read-only checks

Get-SecureBootUEFI -Name PK | Format-List

Get-SecureBootUEFI -Name KEK | Format-List

Get-SecureBootUEFI -Name DB | Format-List

Secure Boot policy and UEFI-variable changes can affect whether a device boots. Capture the current state first and use only the approved signed policy or OEM workflow for changes.

Microsoft: Confirm-SecureBootUEFI

Microsoft: Get-SecureBootPolicy

Microsoft: Viewing Code Integrity events

Looking for a different code? Search another status or error code.