Verifying shim SBAT data failed: Security Policy Violation
This issue mentioned above typically occurs on dual boot computers. It is most triggered after a Windows update has been installed. This update applies SBAT (Secure Boot Advanced Targeting) to systems that run Windows. This stops vulnerable Linux EFI (Extensible Firmware Interface) Shim bootloaders from running.
Please proceed with the steps listed below to prevent this issue.
Step 1: Suspend the BitLocker
Start the computer in Windows, launch Powershell in elevated mode (as Administrator) and execute the following command.
Suspend-BitLocker -MountPoint "C:" -RebootCount 1
Step 2: Disable the Secure Boot (Temporarily)
To disable Secure Boot, you need to access your computer's BIOS/UEFI setup, locate the Secure Boot setting, and change it to disabled. This typically involves restarting your computer and pressing a specific key (like F2, F12, or Delete) during the boot process to enter the BIOS/UEF.
Step 3: Remove SBAT policy
Start the computer in Linux, launch Terminal and execute the following command, followed by the password.
sudo mokutil --set-sbat-policy delete
Please reboot the computer.
Step 4: Verify SBAT revocations
Start the computer in Linux, launch Terminal and execute the following command. On the list there will be no revocations.
mokutil --list-sbat-revocations
Step 5: Re-enable the Secure Boot
Please refer to the Step 2 and enable Secure Boot.
Step 6: Check the Secure Boot status
mokutil –sb-state
Courtesy:
Fix - Verifying shim SBAT data failed security policy violation (Linux Dual Boot Issue) KB5041585