This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 97%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGV%3C/text%3E%3C/svg%3E)
I have a Surface Pro 9 it worked fine for several months and then sometime in January during start up it started to show a red bar with an unlocked padlock during start up. I know this is because Secure Boot isn't turned on. I boot into UEFI and go into Security menu and click on Change Configuration. I choose Microsoft only and click on OK. I get an error that says: The system failed to update the Secure Boot certificate keyset. I tried Microsoft or 3rd party, same error message. I have tried re-imaging the tablet with no luck and I'm not finding anything else online. Now to make it even worse, my Surface Pro 9 stopped identifying as a Surface Pro 9. It has the serial number wrong and shows up as OEMLO with serial number 123123123. So when I try to run the Surface Toolkit it rejects opening because it's only for Surface devices and think my Surface is not a Surface. Has anyone run into this and has found a fix?
Answer accepted by question author
George,
I've seen a few cases like this. The only solution has been to send in to Microsoft for an exchange. If your SP9 is not under warranty, it will cost $650 US https://support.microsoft.com/en-US/surface/hardware-warranty/how-much-does-out-of-warranty-service-cost-for-your-device-or-accessory-united-states and you will get a refurbished device.
Wow. That's incredibly frustrating that Microsoft breaks their own product through a update and the onus and cost is on the customer. $650 is more than I paid for this used surface pro 9. Unfortunately the warranty ended May of last year.
But thank you for your answer and expertise.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 23%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Re-imaging only reinstalls Windows. This problem lives below Windows in the UEFI/firmware layer. No amount of OS-level reinstallation can touch it, because the corruption is in the firmware flash storage itself.
Kindly go through the suggestion of Barb Bowman MVP:
https://learn.microsoft.com/en-us/answers/questions/5645016/secure-boot-disable-and-not-supported
Thanks, but that doesn't solve my problem. As Barb said "although they may not install because of the SKU change to OEMLO."
I can't run it because of the OEMLO reading.
