MSI Secure Boot Maximum Security Secure Boot Violation even after Resetting Keys and Setup Mode

[hungryplanet264]

Hello I have MSI PRO A620M-E, there is a known issue in MSI boards, where secure boot must be set to Maximum Security (instead of Hardware OS/Compatibility) or secure boot basically does nothing. I dual boot windows, and kernel anti-cheat require Maximum Security to work, however even after resetting my secure boot keys and entering setup mode I get Secure Boot Violation on Maximum Security. I don't know if this is an issue with lanzaboote and MSI but I figured I might post here. Thanks

[dawidpotocki]

Are you sure you are actually entering Setup Mode?

Just clearing keys is not enough to enter Setup Mode, even if the firmware is telling you that it will do it. This is because it defaults to re-enrolling Factory Keys, which you need to disable.

[musjj]

I'm using MSI Click BIOS 5 with version E7E02IMS.160. I was having the same problem and here's what I did.

This is just the result of my trial-and-error, so some parts may be redundant, unnecessary or incorrect. Feel free to point out any mistakes. Also, I don't dual-boot Windows, so I'm not sure if there will be any differences.

Note: If you feel like you've messed some settings up, you can reset and apply the "optimized" defaults by pressing F6.

1. Add the following settings to your NixOS config:

   boot = {
     loader.systemd-boot.enable = lib.mkForce false;
     lanzaboote = {
       enable = true;
       pkiBundle = "/var/lib/sbctl";
       autoGenerateKeys.enable = true;
       autoEnrollKeys = {
         enable = true;
         autoReboot = true;
       };
     };
   };

2. Run nixos-rebuild boot --install-bootloader --flake $YOUR_FLAKE_PATH.
3. Reboot and spam Del on startup to enter your BIOS menu.
4. If you're on EZ Mode, switch to Advanced mode by clicking the button on the top or F7.
5. Go to Security ⇒ Secure Boot.
6. Set Secure Boot to [Enabled], Secure Boot Mode to [Custom] and Secure Boot Preset to [Maximum Security].
7. Go to Key Management.
8. Set Provision Factory Default keys to [Disabled].
9. Click the ✖ button on the top right or F10.
10. Press Yes when asked if you want to save your configuration and exit.
11. Re-enter the BIOS menu before your OS boots up.
12. Go to Security ⇒ Secure Boot ⇒ Key Management.
13. Click on Delete all Secure Boot variables.
14. Press Yes when asked if you want to proceed and delete all Secure Boot variables.
15. Press Yes when asked if you want to reset without saving.
16. After booting up, you should now see a message saying: Enrolling secure boot keys

Secure boot should now be fully functional. Run bootctl status to confirm it.

Finally, if you haven't set a password yet, you should do so in your BIOS menu by going to Security ⇒ Administrator Password.