What does Windows error code 4426 (ERROR_SECUREBOOT_FILE_REPLACED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_SECUREBOOT_FILE_REPLACED secure Boot requires that certain files and drivers are not replaced by other files or drivers.

Previous	Next
ERROR_SECUREBOOT_NOT_ENABLED	ERROR_SECUREBOOT_POLICY_NOT_AUTHORIZED

ERROR_SECUREBOOT_FILE_REPLACED

ERROR_SECUREBOOT_FILE_REPLACED (LRESULT 0x0000114A) This Win32 error means a file or driver protected by Secure Boot was replaced by a different file or driver.

What to check for ERROR_SECUREBOOT_FILE_REPLACED

Identify the affected boot component or driver from the earliest Code Integrity event, not from the final error alone.
Restore the component only from a supported Windows, OEM, or software-vendor package that matches the device and Windows version.
Check whether a security product, driver update, or offline servicing action replaced a protected file.

Read-only checks

Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 50

Secure Boot policy and UEFI-variable changes can affect whether a device boots. For ERROR_SECUREBOOT_FILE_REPLACED, capture the current state first and use only the approved signed policy or OEM workflow for changes.

Microsoft: Viewing Code Integrity events

Microsoft: Code Integrity event log messages

Microsoft: Secure Boot

Looking for a different code? Search another status or error code.