Secure boot issue - how to repair usb?

[Crystal420]

I recently built a new server, complete new hardware save for 1 cache drive from old system. I had an older nvme which I took from a laptop that initially booted into windows but I then wiped it through the uefi.

The first boot went fine, and i was able to access the webui. I did a 'shut down' in unraid and subsequently I was having trouble booting into unraid it went straight to uefi.

Rightly or wrongly went online and tried a bunch of things - saw there were solutions which talked about chnaging efi- folder to efi. So put the unraid usb into my windows and checked... it was already efi, but I also ran the 'make-bootable.bat'... which I feel was a mistake.

 

Since then when the unraid usb in the system I get the error 'invalid signature detected'

I have been trying to disable secureboot but no luck it just alwasy stays enabled. Have disabled tpm and all other boot protections but nothing saves.

Even tried a cmos reset through the button on my mobo (asrock) and disconnecting the cmos battery. (After complete power down and unplugging, and draining capacitors.

Tried disconnecting all other hdd and booting without anything and couldn't get a display..  display is back when plugging in unraid usb but still cannot disable secure boot or get into unraid. (Insecure msg is back)

 

My thinking is I have messed up the usb drive and I was thinking I would try with a fresh install, but really down want to lose my set up if at all possible.

 

Can you copy over theb'system' files and keep setup files? Which ones? 

Or does anyone have any other ideas... completely at a loss here. 

 

New server is:

12600 with igpu.

32gb ram

Asrock z690m itx/ax

 

[JonathanM]

This isn't a USB issue, you must disable secure boot.

[Crystal420]

9 minutes ago, JonathanM said:

This isn't a USB issue, you must disable secure boot.

I have tried, so many times... beyond a joke these times. Its never been so difficult on any of my systems. As I never experienced this before I assumed it had to be something with the usb as it seemed to reset everytime. 

Any ideas on any other settings that influence secure boot? Switching it ti disabled doesn't seem to work. I wonder if there is another setting that is 'resetting' it that I need to turn off first.

[JorgeB]

15 minutes ago, Crystal420 said:

Any ideas on any other settings that influence secure boot?

Usually there's only option to control that, secure boot enabled or disabled.

[Crystal420]

7 minutes ago, JorgeB said:

Usually there's only option to control that, secure boot enabled or disabled.

I know! Very much my previous experience.  It just doesn't save... I change from enabled to disabled.  Exit and save. But the next boot... the same thing. The Insecure signature only appears on the unraid usb boot.

Sounds like it is an issue with the Motherboard itself... but can't for the life of me understand what it could be. 

[JorgeB]

Look for a BIOS update, in case it's a BIOS bug.

[Crystal420]

7 minutes ago, JorgeB said:

Look for a BIOS update, in case it's a BIOS bug.

Thanks for the idea, I will try and flash it I guess

[Crystal420]

Have now flashed with the latest firmware, still same error... what's more the secure boot options are not all greyed out. Cannot interact with them at all. So frustrating.

Is that because there is now no option for secureboot? It's still marked as enabled, I just can't change it.

Has anyone had any experience or solutions to that?

Edited May 13 by Crystal420
New info

[JorgeB]

8 hours ago, Crystal420 said:

what's more the secure boot options are not all greyed out.

Try enabling CSM/legacy boot, some BIOS don't let you disable secure boot if only UEFI boot is enabled.

[Crystal420]

Have no external gpu so cms is not an option.

I changed the usb folder efi to efi- in a reverse that a lot of things said... and that has prevented the 'invalid signature' error message.. but secure boot is still greyed out, and it doesn't boot.

Do you have any other ideas? 

Thank you for your time and thoughts by the way

[JorgeB]

6 minutes ago, Crystal420 said:

Do you have any other ideas? 

I'm afraid not really, looks like a board/BIOS issue.

[Crystal420]

2 minutes ago, JorgeB said:

I'm afraid not really, looks like a board/BIOS issue.

Yes, im leaning on that too... even more frustrating. I will see if I can roll back the firmware version as I feel it had been success on the earlier version. Maybe if I combine these ideas I will get lucky.. 

Asrock support are very slow in responses and still focused on 'make sure everything is up-to-date.'

Thanks for you help. Hate that it seems I have a 2 grand paperweight until then.

[Crystal420]

Okay, so i have a working system!

 

For anyone in future:

I rolled back to 1302... still same issue as before. Thought I'd do cmos reset again. But rather than pull the battery out I used a short on the clear cmos pins... (the manual says a jumper, but didn't come with one so just used a screwdriver) 

Apparently that is the proper trick. Saw a 'setup' screen I hadn't seen before and was able to disable secureboot. And it saved. 

Had to do the efi- trick again to reliable uefi boot. 

Updated to 17 firmware just to see... it still has greyed out secureboot but it remained disabled... and booted unraid.

All good. Finally.