Operating System Loader has no signature. Incompatible with SecureBoot (when using DETech for UEFI (Standalone) version)

Technical Articles ID: KB89725
Last Modified: 2023-04-25 12:03:15 Etc/GMT

Environment

Drive Encryption (DE) 7.x

For details of DE-supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Problem

After creating a DETech for UEFI (Standalone) bootable USB recovery media as per the DETech User Guide, the following error displays during system startup:

Operating System Loader has no signature. Incompatible with SecureBoot

The problem occurs on UEFI-enabled systems that have SecureBoot enabled.

No problems are seen when using the WinPE version of DETech with the following BIOS boot configurations:

Legacy
UEFI SecureBoot enabled

DETech standalone is required because the WinPE version does not have the Emergency Boot functionality.

Cause

The EpeTechEfi32.efi and EpeTechEfi.efi files aren't signed and don't allow booting with Secure Boot enabled.

As stated in the "What DETech does" section in the Drive Encryption 7.2 DETech User Guide, when using the tool for "DETech (UEFI) for software and Opal encryption on UEFI-based systems":

On UEFI systems, SecureBoot should be disabled in order to use DETech (Standalone).

Workaround

Per the DETech User Guide, disable SecureBoot or create a DETech WinPE bootable media.

DETech WinPE vs. DETech Standalone
Reasons why you should create and use a DETech WinPE recovery media even though the DETech Standalone version includes more functionality, such as being able to do an Emergency boot:

The WinPE version is much faster than the standalone version.
The WinPE version also allows you to access the encrypted hard disk, fix Windows problems, or copy user data off to another drive before re-imaging.
You can also run any of the Windows tools as well, and access the network.

NOTES:

DETech Standalone is not backward-compatible. This means that you should always use a matching DETech recovery media version. If the client has DE 7.2 installed, create a DETech 7.2 Standalone recovery media to perform any recovery actions.
Refer to the community posting to obtain a DETech ISO recovery image. Note that additional files are still required to execute a drive recovery.

IMPORTANT: It's not possible for Trellix to provide customers with a WinPE recovery CD because a valid Microsoft license is needed.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Operating System Loader has no signature. Incompatible with SecureBoot (when using DETech for UEFI (Standalone) version)

Environment

Problem

Cause

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Operating System Loader has no signature. Incompatible with SecureBoot (when using DETech for UEFI (Standalone) version)

Environment

Problem

Cause

Workaround

Affected Products

Languages:

Choose your region

Title

Title