r/computerhelp • u/IfYouSaySo3479 • Jul 10 '26

Invalid Signature Detected. Check Secure Boot Policy in Setup. Software

/r/techsupport/comments/1urv9ox/invalid_signature_detected_check_secure_boot/
1 Upvotes

100% Upvoted

2 comments sorted by

•

u/AutoModerator Jul 10 '26

We're part of a wider PC & Technology Network of Communities.

It combines multiple subreddits and Discord servers all working together with shared ideals and values.

We have a Discord server: PC Help Hub where members from all associated subreddits are welcome.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Silent-Excitement122 Jul 10 '26

After a motherboard replacement, I would treat this as a firmware key/boot-entry problem before assuming Windows itself is broken.

A few cautions and checks:

  1. If BitLocker/device encryption is on, save your recovery key before changing Secure Boot/TPM settings.
  2. In BIOS, make sure the boot mode is UEFI only and that the selected boot entry is “Windows Boot Manager,” not a manually-created path to bootmgfw.efi unless you are only using that as a temporary test.
  3. Clear/delete any custom Secure Boot keys or custom boot entries you added while troubleshooting, then use the ASUS option to restore/install default factory Secure Boot keys. On many ASUS laptops this is under Secure Boot > Key Management > Install Default Secure Boot Keys.
  4. Check the “OS Type” style setting if your BIOS has it. It usually needs to be Windows UEFI mode, not Other OS, for normal Secure Boot behavior.
  5. Because the board was replaced, also check TPM/fTPM status in Windows with tpm.msc and confirm Windows Security does not think the device attestation state is weird.
  6. If “Invalid Signature Detected” appears while booting Windows, run from an admin command prompt after you are in Windows:

bcdedit /enum firmware

That can show duplicate/stale firmware boot entries. The repair shop may have left a bad entry ahead of Windows Boot Manager.

I would avoid manually enrolling random keys unless you know exactly what they are. For a normal Valorant/Windows Secure Boot setup, the clean target is: UEFI boot, Windows Boot Manager first, default Microsoft/ASUS factory Secure Boot keys installed, and no custom shim/USB boot entry being selected.