An Acer Nitro 17 running BIOS v1.26 stopped booting after a Windows update. It showed a Security error and "Default Boot Device Missing or Boot Failed", and the BIOS then asked for a password the owner could not supply. We got it booting again without touching the BIOS by replacing the new-certificate boot manager on the EFI partition with the factory original. No update rollback was needed, and after we installed the remaining updates, including the Secure Boot KEK update, the machine stayed up to date and kept booting normally. The fix resolves the Windows boot failure and has held through every update since. It does not clear the BIOS password lockout, which is a separate problem.
What we saw
- The laptop showed a Security error during boot, and the Insyde screen: Default Boot Device Missing or Boot Failed. Insert Recovery Media.
- The BIOS prompted for a password. The owner did not have it, and whether it was set earlier and forgotten or came from somewhere else is unknown. Either way there was no firmware access and no USB boot.
- The laptop was on BIOS v1.26. Acer Community threads report the same pattern on other Nitro models after that BIOS, tied to Microsoft's Secure Boot certificate change. See the AN16-41 thread and the AN17-41 thread. Those are user reports, not Acer documentation.
What we found on the drive
We imaged the SSD first, then mounted it on another PC and looked at it read-only.
- BitLocker was off, so no recovery key was needed.
- The OS was Windows 11 24H2 (build 26100) with no pending.xml, no Windows.old and no pending firmware capsule.
- The EFI partition boot manager (EFI\Microsoft\Boot\bootmgfw.efi) was build 10.0.28000.342, byte-identical to Windows\Boot\EFI_EX\bootmgfw_EX.efi, the new-certificate variant. EFI\Boot\bootx64.efi was the same file.
- EFI\OEM\Boot still held the factory boot manager, build 22621, signed by Microsoft Windows Production PCA 2011.
Our reading, not proven: the firmware did not accept the new-certificate boot manager, so it found nothing it could start.
The fix
- Image the SSD. Remove it from the laptop and attach it to a working PC.
- In an elevated prompt, mount the EFI System partition with diskpart (list disk, select disk, list part, select the System partition, assign letter=S).
- Back up the whole EFI folder somewhere safe.
- Copy the factory boot manager over both files:
copy S:\EFI\OEM\Boot\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
copy S:\EFI\OEM\Boot\bootmgfw.efi S:\EFI\Boot\bootx64.efi
- Compare file hashes against the OEM copy, remove the drive letter, put the SSD back and boot.
The laptop booted into Windows with every update still installed.
After it booted
Once back in Windows we installed all the pending updates, including the Secure Boot KEK update that Windows offered. The machine is now fully up to date and boots normally.
- We took that step with a full image of the SSD and a backup of the EFI folder in hand, because with no BIOS access there is no way to reset the keys if a firmware write goes wrong. It went through cleanly here. We can't promise it will on every model or BIOS.
- We have not re-checked which boot manager file is on the EFI partition now, so we can't say whether Windows replaced our copy during those updates.
Limits and what to watch
- On the Windows side this has been a durable fix for us. It has held through every update installed since, including the KEK update. It does not fix the BIOS lockout. The root cause is still not confirmed, and the BIOS stayed on v1.26 with the BIOS, Secure Boot keys and TPM untouched, so keep the backup in case a later update behaves differently.
- For a supervisor password you cannot recover, the route is Acer support with the serial number and proof of purchase.
- Not every case will look like this one. If the factory copy is not on the ESP, or BitLocker is on and you lack the key, stop and check before changing anything.
If you manage fleets of laptops that need this kind of recovery, see our managed IT service.
