EliteDesk 800 G3 SureStart screen on bootup, but not enabled in BIOS

[MarTechServ]

I've got an EliteDesk 800 G3 that suddenly started displaying a SureStart screen every time the system is powered on or rebooted.  It asks for the system password and a keyboard layout.  Typing in the account password for the main admin user allows the system to boot.

This SureStart screen appeared out of nowhere.  It's never done this before.  I went into the BIOS and there's no BIOS Admin password or POST password created.  I also checked the SureStart section and there doesn't seem to be anything enabled there, either.  Just "Dynamic Runtime Scanning of Boot Block" and "Enhanced HP FIrmware Runtime Intrusion Prevention and Detection"  the "Sure Start BIOS Settings Protection" option is grayed out, with no checkmark in the box, and underneath it is says "Requires BIOS Administrator Password to be set".  So by all accounts, it looks like Sure Start shouldn't be asking for a password during boot.

What might have caused this?  Should I disable the two SureStart options and hope the password screen goes away?  Is there something else I'm missing?

BIOS was a couple revisions behind, so I went ahead and updated it, but the SureStart screen remains.

[banhien]

@MarTechServ 

It is in BIOS. I removed Sure Start/Sure Run another day and machine was unstable therefore I have to put back. Please try

Restart your operating system (PC) and as soon as it gives a sign it is about to start, begin hitting the ESC button repeatedly (like tap-tap-tap). Or if the restart does not work, press and hold the power-on button for 5-6 seconds until the unit powers off, then start it normally.

HP Start up Menu will appear, Use the mouse to go to BIOS settings (or press F10 to load BIOS)

Go to the Security tab/settings and turn the password off

Remember to save this.

Regards.

[MarTechServ]

I'm attaching what the BIOS screens currently show.  As far as I can tell, there is no set BIOS password to turn off.

[MarTechServ]

I'm following up on this old thread since I finally found the answer, and wanted to pass it along to anyone else searching for a solution.  It wasn't in the BIOS at all.  HP has a program called HP Client Security Manager that's installed in Windows.  Apparently it has direct access to the BIOS.  Even if you make changes directly in the BIOS to remove SureStart, it won't work if the HP Client Security Manager software has specifically turned it on in its own settings.  There's a setting to turn on client protection with a login password "before windows starts", which in this case turns on SureStart and requires a login password from an administrator account.  If you disable the settings in the client software, then SureStart will be fully disabled (as long as it's also disabled in the BIOS).