Allow the image to run in Secure Boot mode.
Enroll SHA256 Hash certificate of a PE image into Authorized Signature Database (db)
Remove 'UEFI CA'
from DB
Device Guard ready system must not list 'Microsoft UEFI CA' Certificate in Authorized
Signature database (db)
Restore DB defaults Press 'Yes' to restore DB variable to factory defaults
Restore DB variable to factory defaults
Chapter 3 – AMI BIOS Setup
73