Can't enable secure boot in BIOS without a Platform Key

[dc2000]

I'm trying to enable secure boot in BIOS before I install Windows 10. I first disable CSM. That part is easy. But then when I try to enable secure boot I get this error:

Secure Boot can be enabled when Platform is in User Mode. Repeat operation after enrolling Platform Key (PM).

Now say, what???

Here's the screenshot:

 

[lexy.zhitenev]

there should somewhere in uefi/bios you can click install default Pk keys

The Provision Factory Defaults should be the way to reinstall Microsoft keys.

Why is it saying "DO NOT TRUST" there?
And what's that "TEST AMI"?

Because these are AMI manufacturer test keys, not intended to secure an operating system, but rather for development/programming purposes. These keys can be available to many people and thus do not secure the boot process.

 

[larrycumming]

there should somewhere in uefi/bios you can click install default Pk keys

 

[dc2000]

there should somewhere in uefi/bios you can click install default Pk keys

You know if I click "key management" and then "Platform Key (PK)" and then pick "Set new" it creates it but then if click that PK again and go into details, it shows this:

Why is it saying "DO NOT TRUST" there?

And what's that "TEST AMI"?

 

[dshort01]

I think you need to also make sure you enable UEFI boot mode and disable legacy devices.

 

[larrycumming]

"TEST AMI" are the default keys shipped with your motherboard.

Do you have a TPM installed?

I think you're supposed to change it from Custom back to Standard mode before enabling UEFI boot.

there should somewhere in uefi/bios you can click install default Pk keys

You know if I click "key management" and then "Platform Key (PK)" and then pick "Set new" it creates it but then if click that PK again and go into details, it shows this:

Why is it saying "DO NOT TRUST" there?

And what's that "TEST AMI"?

 

[lexy.zhitenev]

there should somewhere in uefi/bios you can click install default Pk keys

The Provision Factory Defaults should be the way to reinstall Microsoft keys.

Why is it saying "DO NOT TRUST" there?
And what's that "TEST AMI"?

Because these are AMI manufacturer test keys, not intended to secure an operating system, but rather for development/programming purposes. These keys can be available to many people and thus do not secure the boot process.

 

[nahyahanbill11]

Problem Solved with my asus.
U have to insert flash drive with OS first. Then enrol platform pk to save the variable into flashdrive so that on bootup the bios can read the bootable usb.
Goodluck to all. Regards nyo nalang ako