Secure Boot Violation on PXE Boot

Hansen, Joshua 20 Reputation points
2026-08-20T13:14:49.9066667+00:00

Hi all. I work as IT at a company. When setting up new PCs PXE Boot is used to install Windows 11. Recently I got the error Secure Boot Violation when using PXE Boot. The PC boots to the pre-installed Windows instance just fine. Installing with a USB stick works as well.

I did not develop our PXE system, but the guy that did is VERY adamant about it being the Secure Boot on my devices

My company has locations outside of the US and PXE Boot works just fine for them. What may be the problem?

Windows for business | Windows Client for IT Pros | Devices and deployment | Set up, install, or upgrade
0 comments
Answer accepted by question author
Hoang Le 4,580 Reputation points Independent Advisor
2026-08-20T15:49:17.1566667+00:00

Hello Hansen, Joshua,

The Secure Boot Violation error during PXE boot indicates that the bootloader files provided by your PXE system do not meet the Secure Boot requirements of the UEFI on your clients. The fact that devices with pre-installed Windows or via USB boot without issue shows that the local bootloader signatures are valid, while the PXE-provided files are either unsigned or come with an older certificate. In many environments outside the US, PXE works because Secure Boot is either disabled there or the PXE servers use updated Microsoft UEFI CA 2023 signatures.

You should check whether your PXE server is providing the latest bootloader files (bootx64.efi, wdsmgfw.efi) from Windows Deployment Services or the latest ADK/WinPE package. If these files are older or not signed with the new Secure Boot certificates, the clients' UEFI will block booting. Comparing them with the version on a working USB installation medium will help identify the differences. It's also crucial that the clients' NVRAM database contains the Microsoft Windows Production PCA 2011 and the Windows UEFI CA 2023, as only bootloaders with these signatures are accepted.

In short, the problem isn't with the clients, but with the PXE boot files, which don't comply with the current Secure Boot requirements. Update the bootloader files on the PXE server with the latest versions from the Windows ADK/Deployment Tools, and the Secure Boot Violation error should disappear.

If my answer is helpful, please click "Accept the answer" to support me.

Thank you,

HL.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-20T13:15:08.79+00:00

    A likely cause is a Secure Boot trust mismatch in the PXE path, not Secure Boot on the device by itself.

    When PXE or network boot is first in firmware boot order, the device can measure one signing authority during the PXE attempt and a different one when it falls back to the local Windows boot manager. The documented example is:

    1. PXE boot path signed by Microsoft UEFI CA 2011.
    2. Local Windows boot manager signed by Windows UEFI CA 2023.

    That creates inconsistent Secure Boot measurements and can trigger BitLocker recovery or boot trust problems. Microsoft’s guidance for this scenario is:

    1. Check firmware boot order and confirm whether PXE/network boot is ahead of the local disk.
    2. If PXE is not required for normal startup, set the on-disk Windows boot manager first.
    3. If PXE is required, ensure the PXE infrastructure uses a 2023-signed Windows boot loader.

    Given that USB install works and the preinstalled Windows instance boots normally, the issue points more strongly to the PXE environment than to a general Secure Boot failure on the PCs.

    A practical troubleshooting path is:

    1. On an affected device, enter UEFI/BIOS and verify Secure Boot is enabled.
    2. Check whether PXE/network boot is first in the boot order.
    3. Test PXE on one affected device after changing boot order so local Windows Boot Manager is first, and invoke PXE only when needed.
    4. Compare the PXE boot files used at the failing location with the locations where PXE still works.
    5. Verify the failing PXE environment is serving updated boot media signed for the newer 2023 trust chain.

    If the device shows a Secure Boot violation only during PXE, but local disk and USB media work, the strongest documented explanation is that the PXE infrastructure is using boot content that does not match the device’s current Secure Boot trust chain.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.