What does Windows error code 4421 (ERROR_SECUREBOOT_POLICY_VIOLATION) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_SECUREBOOT_POLICY_VIOLATION the value is protected by Secure Boot policy and cannot be modified or deleted.

Previous	Next
ERROR_SECUREBOOT_ROLLBACK_DETECTED	ERROR_SECUREBOOT_INVALID_POLICY

ERROR_SECUREBOOT_POLICY_VIOLATION

ERROR_SECUREBOOT_POLICY_VIOLATION (LRESULT 0x00001145) This Win32 error means an attempt was made to change or delete data protected by Secure Boot policy.

What to check for ERROR_SECUREBOOT_POLICY_VIOLATION

Do not modify the protected value through the registry, a file replacement, or an unapproved firmware-variable update.
Determine which policy is active and whether the intended change is authorized by that policy.
Use the supported signed policy deployment workflow; first collect the policy version and UEFI variable state.

Read-only checks

Get-SecureBootPolicy | Format-List

Get-SecureBootUEFI -Name PK | Format-List

Secure Boot policy and UEFI-variable changes can affect whether a device boots. For ERROR_SECUREBOOT_POLICY_VIOLATION, capture the current state first and use only the approved signed policy or OEM workflow for changes.

Microsoft: Get-SecureBootPolicy

Microsoft: Get-SecureBootUEFI

Microsoft: Set-SecureBootUEFI

Looking for a different code? Search another status or error code.