What does NTSTATUS 0xC0430007 (STATUS_SECUREBOOT_FILE_REPLACED) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

STATUS_SECUREBOOT_FILE_REPLACED secure Boot requires that certain files and drivers are not replaced by other files or drivers.

Previous	Next
STATUS_SECUREBOOT_POLICY_NOT_SIGNED	STATUS_SECUREBOOT_POLICY_NOT_AUTHORIZED

STATUS_SECUREBOOT_FILE_REPLACED

STATUS_SECUREBOOT_FILE_REPLACED (NTSTATUS 0xC0430007) This NTSTATUS value reports that a Secure Boot-protected file or driver was replaced.

What to check for STATUS_SECUREBOOT_FILE_REPLACED

Use Code Integrity events to identify the file and its signer.
Restore the component from a supported package that matches the Windows build and device.
Review driver deployment and offline servicing changes made before the failure.

Read-only checks for STATUS_SECUREBOOT_FILE_REPLACED

Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 50

Secure Boot policy and UEFI-variable changes can affect whether a device boots. For STATUS_SECUREBOOT_FILE_REPLACED, capture the current state first and use only the approved signed policy or OEM workflow for changes.

Microsoft: Confirm-SecureBootUEFI

Microsoft: Get-SecureBootPolicy

Microsoft: Viewing Code Integrity events

Looking for a different code? Search another status or error code.