HP 800 G6 Desktop Mini and Tower - Issue with Secure Boot Certificate Renewal

[BeeFriend]

Hello HP,

we activated  Secure Boot Certificate Deployment  with GPO and now we see isues withe HP 8000 G6 DM and TWR with BIOS S01 Ver. 02.25.00 which stuck in BitLocker Recovery Screen.

We let the computers search every month for new BIOS and drivers from Microsofts Update Catalog and in April 2026 BIOS S01 Ver. 02.25.00 was installed. Now I cannot find this version anymore on HPs Support HomePage and also not at Microsofts Update catalog.

Is there a known issue with that BIOS Version? How can I do a (scripted) downgrade to Version 02.24.00 ?

Thankks fro your reply!

[NikFre]

We hit the same issue on HP EliteDesk 800 G6 after Secure Boot certificate update. Devices started prompting for BitLocker recovery after reboot.
In our case, this was triggered by the Secure Boot DB/KEK update in combination with existing BitLocker protection.
Workaround that worked for us:
- Temporarily suspend BitLocker protection before applying Secure Boot/BIOS related updates (e.g. via manage-bde or similar method)
- Apply the update
- Resume BitLocker after reboot

For already affected devices, recovery key entry + reboot cleared the state.
We also limited rollout to specific device models to avoid broad impact.

We observed this on fully updated systems (latest BIOS and Windows updates), primarily on G6 models.

[BeeFriend · Accepted solution]

Hello, I  got a feedback from our HP customer service.

BIOS Version 2.25 has  a bug and will be updated in next Version which should be released at ~20. May 2026 .

In the meanwhile we have to turn on following on HP 800 G6 BIOS Setting for Secure Boot.

We do this with HP BCU with following  text config file:

BIOSConfig 1.0

Windows UEFI CA 2023

Disable

*Enable

Microsoft Option ROM UEFI CA 2023

Disable

*Enable

Microsoft UEFI CA 2023

Disable

*Enable

Enable MS UEFI CA key

No

*Yes

We deploy this using a SCCM Tasksequence with CommandLine, because the import wiht HP BCU using PowerShell always failed with the correct BIOS password.

Good Luck to all others who have such issue.