Advice Request maxsun mobo loading a weird PK

[Cleo]

Hi Guys,
I have a Maxsun B760itx board and I couldn't get Secure Boot to work.
In the BIOS I found it loading a "Do Not Trust - AMI Test PK" in Secure Boot's Load Factory Keys feature.
What do I do now?

C.

 

[Bot]

Hi Guys,
I have a Maxsun B760itx board and I couldn't get Secure Boot to work.
In the BIOS I found it loading a "Do Not Trust - AMI Test PK" in Secure Boot's Load Factory Keys feature.
What do I do now?

C.

Short answer

Do not enable Secure Boot with a test Platform Key loaded.

The “Do Not Trust - AMI Test PK” entry strongly suggests the board firmware includes a test key, and that is not what you want for normal Secure Boot use.

What this likely means

Secure Boot relies on trusted keys stored in firmware:

• PK = Platform Key
• KEK = Key Exchange Keys
• db = allowed signatures
• dbx = revoked signatures

A test PK is typically meant for development or validation, not for production use. If that key is actually installed, Secure Boot trust would not be in a normal vendor/Microsoft state.

What you should do

Use the lowest-risk path first:

1. Do not manually select or enroll the AMI test key.
2. Check whether the BIOS has an option such as:
   • “Install default Secure Boot keys”
   • “Restore factory keys”
   • “Windows UEFI mode”
   • “Standard” instead of “Custom”
3. If there is more than one key set shown, choose the normal production/default/factory Microsoft/OEM key set, not anything labeled test.
4. Update the BIOS from Maxsun’s official support page if a newer firmware is available and the changelog mentions Secure Boot, key updates, or UEFI fixes.
5. If the only factory-key option available loads the AMI test PK, stop there and contact Maxsun support, because that is not something I can safely call normal.

Before changing anything

A few practical precautions:

• Make sure Windows is installed in UEFI mode, not Legacy/CSM mode.
• If CSM is enabled, disable it before expecting Secure Boot to work.
• If BitLocker or device encryption is enabled, back up the recovery key first.
• Do not delete existing keys unless you are prepared to recover from a boot failure.

How to verify the current state in Windows

You can check what Windows sees:

• Press Win + R, type msinfo32
• Look for:
  • BIOS Mode: UEFI
  • Secure Boot State: On/Off

If Secure Boot stays off even in UEFI mode, the firmware key state is probably still wrong or incomplete.

If you want a safe conclusion

If the board only offers “AMI Test PK” under factory/default keys, I would treat that as a firmware problem or at least something that needs vendor clarification, not something to “just try.”

The safest next step is to avoid that test key, update to the latest official BIOS, and if the behavior remains, contact Maxsun support or post BIOS screenshots from the Secure Boot key pages for careful review.

 

[lokamoka820]

Check out the "O&O ShutUp10" program, as its latest version displays the secure boot status and what is recommended to do. There are other solutions in this thread:

Serious Discussion Thread 'Secure Boot certificate updates'

Feb 16, 2026

Read this:

Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

For verification, read this:

How to check if Windows 11 has applied the new Secure Boot 2023 certificates (replaces Secure Boot 2011)

The easiest way to check seems to be with PowerShell.
My PC has not yet received the certificate.

• Sampei.Nihira
• Replies: 21
• Forum: Windows 11

• 
• 

 

[Halp2001]

The first step is to check if your BIOS offers the option Restore Factory Keys or Install Default Keys.

If the BIOS shows a key marked as “AMI Test PK”, the recommended action is to update to the latest available version and then use that option to reinstall the default Secure Boot keys.

If the test key still appears as the only option after that, it looks more like a firmware issue with the motherboard rather than a configuration problem. In that case, the best approach is to contact Maxsun directly.

 

[Cleo]

I can clear all keys but loading factory defaults adds the bad key back in.
Win11 boots with Secure Boot disabled but as soon as I enable it boot fails due to invalid signature.

 

[Halp2001]

I can clear all keys but loading factory defaults adds the bad key back in.
Win11 boots with Secure Boot disabled but as soon as I enable it boot fails due to invalid signature.

The fact that restoring factory keys always brings back the AMI Test PK shows this is a firmware issue in the BIOS. Before giving up, I’d suggest two quick checks:

1. Update the BIOS from Maxsun’s official site, in case a newer version already fixes this.
2. Manually enroll the Microsoft key, if your BIOS has options like 'Enroll PK' or 'Key Management'.

If you’re already on the latest BIOS and there’s no way to load external keys, then it’s clearly a firmware bug. At that point, the only workaround is to keep Secure Boot disabled and contact Maxsun support for a fix.

Important note if you try Step 2:

• Make sure to back up your BitLocker recovery key before touching the BIOS keys, just in case Windows triggers a recovery screen on the next boot.
• Your USB drive must be formatted in FAT32, and you will need the official Microsoft certificate file in a compatible format (like .auth or .der).

 

[Cleo]

The fact that restoring factory keys always brings back the AMI Test PK shows this is a firmware issue in the BIOS. Before giving up, I’d suggest two quick checks:

1. Update the BIOS from Maxsun’s official site, in case a newer version already fixes this.
2. Manually enroll the Microsoft key, if your BIOS has options like 'Enroll PK' or 'Key Management'.

If you’re already on the latest BIOS and there’s no way to load external keys, then it’s clearly a firmware bug. At that point, the only workaround is to keep Secure Boot disabled and contact Maxsun support for a fix.

Important note if you try Step 2:

• Make sure to back up your BitLocker recovery key before touching the BIOS keys, just in case Windows triggers a recovery screen on the next boot.
• Your USB drive must be formatted in FAT32, and you will need the official Microsoft certificate file in a compatible format (like .auth or .der).

It's strange.
I don't have BitLocker enabled, and it asks me to reset my PIN each time I try to enable Secure Boot.
There is no visible indication on the mobo which version it is. I tried the latest BIOS for both V2 and V3, and they
both had the exact same issue. I do recall an option to "Enroll EFI image". Is that what I want to try? The OsRecovery
Signatures dbr shows as empty.

 

[Halp2001]

The fact that restoring factory keys always brings back the AMI Test PK confirms that the problem comes directly from the firmware Maxsun compiled for this board. Since you already tried the latest versions for both V2 and V3 and got the same result, it’s clear this is a manufacturer oversight that hasn’t been fixed.

Regarding your doubts:

• Enroll EFI Image won’t help here: That option only authorizes a specific .efi file (like an alternative bootloader), but it does not replace the defective root key (PK). It won’t fix Windows Secure Boot.
• The PIN issue: Even if you don’t use BitLocker, Windows relies on the TPM chip to protect credentials (like your Windows Hello PIN). Every time you change something in the BIOS related to Secure Boot, the TPM detects it as a security change and asks you to reset the PIN. This is normal behavior, not a bug.

In summary:Since the OsRecovery signature database is empty and the board keeps loading a test key that breaks Windows 11 boot, you’re facing a factory bug.

For now, the only practical solution is to keep Secure Boot disabled (Windows 11 will run fine, though note that some competitive games with anti-cheat or banking apps may require it). If Secure Boot is important for you, the best option is to contact Maxsun support for a BIOS patch, or even return the board if that’s still possible.

 

[Zero Knowledge]

Who needs @Bot or LLM agents when we have our own A.I generated content provider Halp2001. Just call or Better Call Halp2001.

 

[Bot]

Who needs @Bot or LLM agents when we have our own A.I generated content provider Halp2001. Just call or Better Call Halp2001.

Let’s keep the thread on the Secure Boot issue.

From what was described so far, “Enroll EFI Image” is not the fix. That option usually whitelists a specific bootloader or EFI file, but it does not correct a bad Secure Boot key set in firmware.

What the current symptoms suggest

• Restoring factory keys reintroduces AMI Test PK
• Enabling Secure Boot then causes Windows boot to fail with an invalid signature
• Windows asks to reset the PIN after Secure Boot changes, which can happen because TPM/Windows Hello reacts to trust changes

That combination points much more toward a bad or incomplete Secure Boot key/database setup in the BIOS than a normal Windows configuration issue.

About the empty OsRecovery dbr

By itself, an empty OsRecovery database is not the main problem here. The more important issue is that the board appears to restore a test PK instead of a normal production key set.

Practical conclusion

• Do not rely on Enroll EFI Image as a fix for this specific problem
• If both V2 and V3 BIOS files behave the same way, there is not enough evidence to say there is a safe end-user fix in BIOS
• The safest workaround is to leave Secure Boot disabled for now
• If Secure Boot is required, the right next step is to contact Maxsun support or the seller and report that Restore Factory Keys installs AMI Test PK and breaks Windows boot

If you want to document it clearly for support

Include:

• Board model: Maxsun B760ITX
• Current BIOS version used
• That Load/Restore Factory Keys installs Do Not Trust - AMI Test PK
• That Windows 11 boots with Secure Boot off, but fails with invalid signature when Secure Boot is enabled
• That testing multiple BIOS versions did not change the behavior

Bottom line

Based on the symptoms shown, this looks like a firmware-side Secure Boot key problem, and Enroll EFI Image is not the proper remedy. The most sensible path is to keep Secure Boot disabled unless Maxsun provides corrected firmware.