Secure Boot prevents Windows from booting — error 0xc0430001

Hello. I’m asking for help diagnosing a Secure Boot issue.

Computer configuration

• Motherboard: MSI B550M PRO-VDH (MS-7C95)

BIOS: latest version, 7C95v2P2

Windows 10, build 19045

The problem

When I enable Secure Boot in UEFI settings, Windows starts with a recovery screen showing error 0xc0430001. If I disable Secure Boot, the computer boots normally.

What I’ve already checked

BitLocker is disabled on the system drive, which is fully decrypted.

The active bootloader, \EFI\Microsoft\Boot\bootmgfw.efi, has a valid Microsoft Windows signature issued by Windows UEFI CA 2023.

In Windows, UEFICA2023Status is set to Updated. The TPM-WMI event log contains Event ID 1808 entries reporting that the Secure Boot certificates/keys were updated successfully.

With Secure Boot disabled, PowerShell reports SecureBoot = 0 and SetupMode = 0.

I have not reset the Secure Boot keys.

How this started

I downloaded the new Call of Duty: Warzone, and it prompted me to update the BIOS. I went to MSI’s official website, downloaded the latest BIOS version to a USB flash drive, and installed it using M-FLASH. The computer booted after the update, but then I encountered this issue. I searched online, went into the BIOS, and disabled Secure Boot. Windows has worked since then, but I need Secure Boot enabled.

I’ve spent the last three days trying to fix this without success. Please let me know what additional information or logs you need to diagnose the issue, and what safe fix you recommend for this motherboard and BIOS version. I need to preserve the installed Secure Boot keys and avoid damaging the Windows installation or its boot configuration.Hello. I’m asking for help diagnosing a Secure Boot issue.

Computer configuration

Motherboard: MSI B550M PRO-VDH (MS-7C95)

BIOS: latest version, 7C95v2P2

Windows 10, build 19045

The problem

When I enable Secure Boot in UEFI settings, Windows starts with a recovery screen showing error 0xc0430001. If I disable Secure Boot, the computer boots normally.

What I’ve already checked

BitLocker is disabled on the system drive, which is fully decrypted.

The active bootloader, \EFI\Microsoft\Boot\bootmgfw.efi, has a valid Microsoft Windows signature issued by Windows UEFI CA 2023.

In Windows, UEFICA2023Status is set to Updated. The TPM-WMI event log contains Event ID 1808 entries reporting that the Secure Boot certificates/keys were updated successfully.

With Secure Boot disabled, PowerShell reports SecureBoot = 0 and SetupMode = 0.

I have not reset the Secure Boot keys.

How this started

I downloaded the new Call of Duty: Warzone, and it prompted me to update the BIOS. I went to MSI’s official website, downloaded the latest BIOS version to a USB flash drive, and installed it using M-FLASH. The computer booted after the update, but then I encountered this issue. I searched online, went into the BIOS, and disabled Secure Boot. Windows has worked since then, but I need Secure Boot enabled.

I’ve spent the last three days trying to fix this without success. Please let me know what additional information or logs you need to diagnose the issue, and what safe fix you recommend for this motherboard and BIOS version. I need to preserve the installed Secure Boot keys and avoid damaging the Windows installation or its boot configuration.