"SecureBoot Is Not Enabled" Bug Report

me too it works now

Followup, as of today I was able to load bf6 once. Unsure if a javelin update went out or got lucky once

and else im sitting since summerbreakes 5 weeks with this found it to days ago i need new motherboard

because if i got to msinfo32 it shows why pcr7 dosent work "Automatic Device Encryption Support reasons why automatic device encryption was not successful: PCR7 binding is not supported., Hardware security test interface failure. The device does not support Modern Standby., Unallowed DMA-capable bus/devices detected."

Did you tried the pendrive thing?

If so, has to be the problem you mentioned.

So sorry.

because only some biostars can do it and the z590 A silver can do it because it  is described as a offic pc motherboard

but i tried everything and nothing even works an pcr7 needs to be activatete s0 low power modiule idle because in my system information it says that because off that pcr7 wont turn on

Don't buy a new motherboard! 

I had the exact same issue with Battlefield 6 on this setup and fixed it.

Your motherboard is fine; the issue is that your Secure Boot is active but running without its database keys loaded (it's stuck in 'Setup Mode'), so EA Anti-Cheat rejects it.

Do this in your BIOSTAR BIOS to fix it:

• Go to the Boot tab and make sure CSM Support is DISABLED (Secure Boot won't work in legacy mode).
• Go to Security -> Secure Boot.
• Change 'Secure Boot Mode' from Standard to Custom.
• Click on Key Management (or look for an option that says Restore Factory Keys / Reset to Default). 
• Accept the prompt to load the default Microsoft keys.
• Change the Mode back to Standard (or Windows UEFI Mode if available).
• Press F10 to save and reboot.
• Once back in Windows, press Win + R, type msinfo32 and check 'Secure Boot State' and PCR7. 
• It will now say ON and PCR7 will be bounded, and Battlefield 6 will launch perfectly. 

Also, forget about S0 state; S3 is the proper standby mode for ATX desktop PCs!

If this doesn't work, try additionally the pendrive step described on my comment down.

i have the same problem and need to buy a new motherboard have an rtx 4060 ti phanther oc edition from gainward and a intel i9 11900kf and dont have the low pomer idle and my biostar z590 A SILVER cant run s0 only s3 could you help me guys wich mainboard and one that is avalible i found it out to days ago after sitting for 5 weeks and looking

Hey everyone,

After dealing with the frustrating "Secure Boot is Not Enabled" / EA Javelin launch error following recent updates, I finally managed to fix it and wanted to share the exact solution in case it helps others.

Even though Windows and some tools reported that Secure Boot was active, my PCR7 configuration showed as "Binding Not Possible", which blocks EA Javelin from initializing properly. On older motherboards or specific setups, the motherboard NVRAM often fails to register or update the Microsoft keys correctly even if you toggle them in the BIOS.

Here is the definitive step-by-step workaround that forced the motherboard to properly handshake and bind everything:

Prerequisites Checklist: 
Ensure your system is running on a GPT partition disk (convert via `mbr2gpt` if it was legacy MBR), update your motherboard BIOS to the latest available version, and make sure your discrete or integrated TPM 2.0 is fully enabled.

The Recovery USB Trick:

Format a USB stick to FAT32.

Create a folder structure inside: `EFI` -> `BOOT`.

Go to `C:\Windows\Boot\EFI` on your PC, copy the file named `SecureBootRecovery.efi`, paste it into the USB's `BOOT` folder, and rename it to `bootx64.efi`.

BIOS Settings for Nano-Fix:

 Enter your BIOS, go to Boot-> CSM and set it to Disabled (Pure UEFI mode).

Go to Secure Boot, set OS Type to Windows UEFI mode, clear/reset keys, and install default factory keys (set mode to Standard).

Executing the Recovery:

Plug the USB into the PC, save changes (`F10`), and immediately spam your motherboard's boot menu key (e.g., F8 / F12 depending on your board).

Choose to boot directly from the UEFI USB.

The Microsoft recovery script will run instantly (it might flash or blink quickly), inject the proper certificates into your motherboard's NVRAM, and automatically reboot the system. Unplug the USB during this reboot.

Once back in Windows, check `msinfo32` (run as an admin)—Secure Boot should now show as On, and PCR7 configuration will successfully show as Bound.
EA Javelin will finally launch without throwing errors. (!!!!!!)

Hope this helps anyone still struggling with the anti-cheat block! 😄

FYI EA_Aljo​ EA_Barry​ 

Edit / Update (September 9, 2026): Windows Security Updates can break the PCR7 binding again.

Just a quick heads-up: if Windows installs a security or system update, it might replace the SecureBootRecovery.efi file with a newer version. When this happens, Secure Boot gets effectively disconnected again because Windows and your TPM 2.0 module no longer share the exact same security certificates, causing the PCR7 binding to fail.

This exact scenario happened to me yesterday (08.09.2026) after a Windows update. I suddenly lost Secure Boot and PCR7 binding, and EA Javelin blocked me from launching the game again.

How to fix it if it breaks after an update:

You simply need to repeat the USB trick mentioned above to resync the certificates.

• Copy the newly updated SecureBootRecovery.efi from C:\Windows\Boot\EFI to your FAT32 USB drive's BOOT folder.
• Rename it to bootx64.efi as before.
• Boot directly from the USB to force the motherboard and TPM 2.0 module to register the new Microsoft certificates.
  
  

Once the recovery script runs and automatically reboots the PC, your PCR7 will be successfully bound again and the game will launch normally.