<!--
{
  "availability" : [
    "macOS: 27.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Virtualization",
  "identifier" : "/documentation/Virtualization/VZEFIVariableStore/enrollDefaultSecureBootSignatures()",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Method",
  "symbol" : {
    "kind" : "Instance Method",
    "modules" : [
      "Virtualization"
    ],
    "preciseIdentifier" : "c:objc(cs)VZEFIVariableStore(im)enrollDefaultSecureBootSignaturesWithError:"
  },
  "title" : "enrollDefaultSecureBootSignatures()"
}
-->

# enrollDefaultSecureBootSignatures()

Enrolls the default signatures to Secure Boot databases.

```
func enrollDefaultSecureBootSignatures() throws
```

## Discussion

This operation adds Microsoft Key Exchange Keys, UEFI CA signatures, and the latest UEFI revocation list
to the Key Exchange Key (KEK) database, allowed signature database (db), and forbidden signature database
(dbx) respectively. You can add these signatures before or after enrolling a Platform Key. The framework preserves
the Platform Key, if present.

This allows Microsoft-signed Linux distributions to boot with Secure Boot enabled.

For more information about these signature files, see the [Microsoft Secure Boot Objects repository](https://github.com/microsoft/secureboot_objects).

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)