The system firmware returned an error Unspecified error when attempting to update a Secure Boot vari

[pisboi]

Here is more info from HP:
HP Commercial PCs - Prepare for new Windows Secure Boot certificates | HP® Support

• Platforms released in 2017 and earlier do not receive a BIOS update related to this change, because HP no longer supports those platforms.

So I guess your EliteDesk 800 G4 will not recieve a BIOS update for this issue.

I'm still waiting for BIOS updates for a bunch of our supported models. According to the link above they should be released before 2026.

Windows checks if HP PC's have a SBKPFV3 flag. If yes it supports everything around adding the 2023 certificates. If no, it will intentionally fail (like we have seen here). I will probably use the SkipDeviceCheck=1 registry value on these unsupported PC's.

You can check with PowerShell:

$Manufacturer = (Get-CimInstance -Class Win32_ComputerSystem).Manufacturer
if ( ($Manufacturer -eq "HP" -or $Manufacturer -eq "Hewlett-Packard") -and (Get-CimInstance -ClassName Win32_ComputerSystemProduct).Version -contains "SBKPFV3" ) {
    Write-Host "This HP BIOS officially supports adding the 2023 Secure Boot certificates. (Win32_ComputerSystemProduct Version contains ""SBKPFV3"")"
}
elseif ( ($Manufacturer -eq "HP" -or $Manufacturer -eq "Hewlett-Packard") -and (Get-CimInstance -ClassName Win32_ComputerSystemProduct).Version -notcontains "SBKPFV3" ) {
    Write-Host "This HP BIOS does NOT support adding the 2023 Secure Boot certificates. (Win32_ComputerSystemProduct Version does not contain ""SBKPFV3"")"
}

Most models released before 2018 don't support Windows 11 anyway, but some of them do.