HP HP ProDesk 400 G4 DM BIOS

[itdept97]

Is there an updated bios for the following machines? The machines have a cpu and TPM that meet Windows requirements ,but don't have a firmware version that supports the 2023 UEFI Certs from what I can see on the driver page for the products. The current newest firmware is HP Q23 Ver. 02.31.00, 7/8/2025 for all these devices.

HP HP ProDesk 400 G4 DM (TAA) Machine Product 4ZX63US HP HP ProDesk 400 G4 DM (TAA) Machine Product 6KL86US

[Paul_Tikkanen]

BIOS version 02.31.00 is the latest BIOS update HP currently has for the model series.

See these links for some information for how to update the secure boot certificates:

HP Business PCs - Prepare for new Windows Secure Boot certificates | HP® Support

how to manually/force apply updated secure boot certificates without a firmware update? - Microsoft ...

Also check the secure boot status messages in Windows:

Go to Settings>Privacy and Security>Windows Security>Device Security and check the Secure Boot Status.

It should show one of the following messages:

If you see this message in the Secure Boot section:    What you should do:

Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed.	No action is needed.
Secure Boot is on, but your device is using an older boot trust configuration that should be updated.	Make sure your device has the latest Windows updates installed. Restart if prompted.
Secure Boot is on, but your device is affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution. The update will resume automatically once resolved.	No action is needed. The certificates update will resume automatically once the issue is resolved.
Secure Boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update. Visit the link below for more information.	Your device might need additional validation before the update can proceed automatically.  Visit aka.ms/getsecureboot for more information.
Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations. Contact your device manufacturer for assistance.	Contact your device manufacturer for assistance.
Secure Boot is on, but this device can no longer receive required updates for the Windows boot experience.	Your device is still using an old certificate after the expiration dates. Visit aka.ms/getsecureboot for guidance.

[idj_779]

Hi itdept97,

Welcome to the HP Community! I am a new volunteer here participating in the HP Solve-a-thon. Following up on Paul's excellent breakdown of the Windows Security status messages, I can give you a bit more specific context regarding your exact ProDesk 400 G4 machines and those 2023 certificates.

As an independent PC Hardware enthusiast with experience in managing enterprise workstation fleets, the expiration of the 2011 UEFI CA certificates is understandably a massive headache. However, for the HP ProDesk 400 G4 DM, you do not actually need to wait for a newer firmware update beyond the 02.31.00 version you already have deployed.

Here is why your machines are fully compliant, and what you need to do next:

The ProDesk 400 G4 Architecture

The ProDesk 400 G4 series uses the HP Q23 BIOS family. According to HP's official commercial engineering bulletins regarding the Secure Boot transition, the necessary NVRAM allocation adjustments to accept the larger Microsoft UEFI CA 2023 certificate payloads were baked into the Q23 firmware branches in late 2024.

The version you are currently running (02.31.00 from July 2025) already possesses the correct underlying firmware hooks to support the update.

Why It Shows as Unsupported in Windows

If your machines meet the CPU/TPM requirements but Windows 11 is throwing a "hardware or firmware limitations" error in the Secure Boot Status menu, it is because of how the database is currently populated, not a limitation of the firmware itself.

You likely need to manually trigger the DBX (Revocation List) and DB (Allowed Signatures) update payload through the OS, as Microsoft's phased rollout frequently stalls on commercial endpoints governed by group policies.

The Resolution Steps

Since your BIOS is already compliant, you need to force Windows to push the certificates into the firmware's NVRAM.

1. Ensure the machines are fully updated via Windows Update, specifically looking for any pending "Security Update for Secure Boot DBX" patches.

2. If the automated update continues to stall, you can manually script the injection using PowerShell. Microsoft provides the specific script to manually apply the updated secure boot certificates without waiting for the phased Windows Update rollout. You can find the exact script and parameters in the Microsoft Tech Community thread Paul linked above.

Once the PowerShell script successfully commits the 2023 certificates to the DB, the Windows Security dashboard will update to reflect that no further certificate changes are needed.

Thank you for being a part of the HP Community!

I am an independent tech enthusiast and volunteer participating in the HP Solve-a-thon, not an HP employee.

If my steps helped you out, please click the Thumbs Up/Yes button below. If this completely resolved your issue, please click Accept as Solution so other users can easily find the answer!