Windows Boot Manager might be blocked by the current security policy if Secure Boot has an issue, the UEFI boot configuration is misconfigured, or changes were made to the boot file or bootable device. It can also happen after changing BIOS/UEFI settings, replacing a drive, or trying to boot from an operating system or device not trusted by the current security policy. If you are seeing this error, try a few steps to get Windows Boot Manager working again.
Windows Boot Manager has been blocked by the current security policy
Windows Boot Manager has been blocked by the current security policy
The message Windows Boot Manager has been blocked by the current security policy means that the computer’s firmware is stopping the bootloader from starting up because it does not meet the Secure Boot requirements. Secure Boot is a UEFI feature that helps prevent untrusted bootloaders from running when the computer starts. If the boot settings have changed or the firmware doesn’t recognize the Windows bootloader correctly, it may block the Windows Boot Manager.
If the Windows Boot Manager is blocked, follow the solutions below.
- Reset BIOS to default settings
- Check the Secure Boot setting
- Make Windows Boot Manager the first boot option
- Restore the default Secure Boot keys
- Repair Windows Boot Manager
Let us talk about them in detail.
1] Reset BIOS to default settings
The first thing you should try is resetting your BIOS/UEFI settings to their default configuration. An incorrect boot mode, Secure Boot setting, or other firmware configuration can prevent Windows Boot Manager from loading. To reset BIOS settings, restart your computer and repeatedly press the BIOS/UEFI key during startup. Depending on your computer manufacturer, this can be F2, F10, F12, Delete, or Esc.
Once you enter the BIOS/UEFI setup, look for an option such as Load Setup Defaults, Load Optimized Defaults, Restore Defaults, or Reset to Default. Select the option, confirm the change, and then choose Save and Exit. Your computer will restart automatically. Check whether Windows now starts normally.
Do keep in mind that resetting the BIOS can change settings such as boot order, virtualization, fan profiles, and other custom configurations. If you have made specific BIOS changes previously, you may need to configure them again.
2] Check the Secure Boot setting
If resetting the BIOS does not fix the problem, check the Secure Boot configuration. Enter your BIOS/UEFI settings again and look for Secure Boot under the Security, Boot, or Authentication section. If Secure Boot is enabled, temporarily disable it, save the changes, and restart the computer.
If Windows starts after disabling Secure Boot, the issue may be related to the system’s Secure Boot configuration or the firmware rejecting the bootloader. If this fixes the issue, investigate the underlying boot configuration, then enable Secure Boot again.
3] Make Windows Boot Manager the first boot option
A wrong boot priority can also prevent the correct Windows bootloader from starting. Open the BIOS/UEFI settings and go to the Boot section. Look for Windows Boot Manager in the list of available boot devices. If it is present, move Windows Boot Manager to the top of the boot priority list. Save the changes and restart your computer. If you have multiple SSDs or hard drives installed, make sure Windows Boot Manager associated with your Windows installation is selected as the primary boot option.
4] Restore the default Secure Boot keys
If Secure Boot is enabled but Windows Boot Manager still gets blocked, you may need to restore the Secure Boot keys stored in the firmware. Follow the steps mentioned below to do the same.
- Open BIOS/UEFI and look for an option such as Restore Factory Keys, Install Default Secure Boot Keys, or Restore Secure Boot Keys.
- Select the appropriate option and save the changes.
- The exact option and its location will depend on your computer or motherboard manufacturer.
After restarting the computer, check whether Windows Boot Manager loads normally.
5] Repair Windows Boot Manager
If the BIOS/UEFI configuration is correct, the Windows boot files themselves may be damaged. In this case, start your computer using a Windows installation USB or recovery drive and select Repair your computer > Troubleshoot > Advanced options > Command Prompt
From Command Prompt, you can check and repair the Windows boot configuration.
First, run the following command.
bootrec /scanos
This checks for Windows installations that are not currently included in the boot configuration.
You can also use BCDBoot to recreate the boot files using the command mentioned below.
bcdboot C:\Windows
Keep in mind that the Windows partition may not be assigned the letter C: inside the Windows Recovery Environment. First, identify the correct Windows partition before running the command.
That’s it!
Read: Windows Boot Manager not showing in BIOS in Windows 11
How do I unblock Windows Boot Manager?
To unblock Windows Boot Manager, first enter your BIOS/UEFI settings and reset the BIOS to its default configuration. Then make sure Windows Boot Manager is selected as the first boot option, and check the Secure Boot settings. If the error continues, temporarily disable Secure Boot and restart the computer. You can also use a Windows installation or recovery drive to access Startup Repair and repair the boot configuration.
Read: Boot into legacy Boot Manager & display Startup Settings in Windows 11
How to fix a corrupted Boot manager?
To fix a corrupted Windows Boot Manager, boot into the Windows Recovery Environment using a Windows installation or recovery drive and select Troubleshoot > Advanced options > Startup Repair. If Startup Repair does not resolve the problem, open Command Prompt from Advanced options and use tools such as bootrec and bcdboot to repair or recreate the boot configuration. Make sure you identify the correct Windows partition before running bcdboot.
Also Read: Enable or disable Windows Boot Manager on Windows.
