HP OMEN 25L GT12 – Secure Boot Platform Key missing after BIOS F.24 update

[wan1231]

Hello,

I have an HP OMEN 25L Desktop GT12-1xxx with an AMD Ryzen 7 5700G processor, motherboard 8876, and BIOS version F.24.

After updating the BIOS, I cannot enable Secure Boot.

My current situation:

• BIOS Mode: UEFI

• Secure Boot State: Off

• Platform Key (PK): Not Enrolled

• Confirm-SecureBootUEFI returns False.

• Get-SecureBootUEFI -Name PK reports that the variable is undefined.

I have tried loading the HP factory default Secure Boot keys in BIOS several times, but the Platform Key remains Not Enrolled after saving and restarting.

TPM is working, and Windows 11 boots normally. I do not want to clear the TPM or risk losing access to Windows.

I found another HP Community discussion about the same issue on an OMEN 25L with motherboard 8876 and BIOS F.24.

Could an HP moderator or technical specialist please confirm whether this is a known BIOS issue and provide a safe, official fix to restore the Platform Key and enable Secure Boot?

Thank you.

[Hawks_Eye]

Hi @wan1231 

Welcome to the HP Support Community! We're here to help you get back up and running.

Thank you for providing the detailed information. We understand the goal is to restore Secure Boot functionality on your HP OMEN 25L GT12 while avoiding any unnecessary TPM changes or risk to the existing Windows installation.

Based on the information shared, the system is already configured for UEFI boot, TPM is operational, and the Secure Boot databases appear to be present. However, the Platform Key (PK) remains unassigned, which keeps the system in Setup Mode and prevents Secure Boot from being enabled. The Secure Boot key hierarchy relies on the Platform Key (PK), and when the PK is not enrolled, Secure Boot cannot transition to an active state. 

Please try the following sequence:

Restore Secure Boot Factory Keys

• Enter BIOS (F10).
• Navigate to Secure Boot Configuration.
• Select Reset Secure Boot Keys to Factory Defaults.
• Save and restart.
• Verify whether the Platform Key changes from Not Enrolled to HP. This reset function is documented by HP as restoring the factory Secure Boot keys.

Verify UEFI Configuration

• Confirm BIOS Mode is UEFI.
• Confirm Legacy Support is disabled.
• Confirm Windows Boot Manager is the primary boot option.

Install All Windows Updates

• Ensure the system is fully updated.
• HP documentation notes that Secure Boot certificate updates are delivered through Microsoft's update process, while HP BIOS updates prepare the platform for those certificates.

Check for a Newer BIOS

• If a BIOS newer than F.24 is available for the specific OMEN 25L GT12 model, update to that version and then repeat the factory key restoration process.

HP BIOS Recovery

• Consider BIOS Recovery only if the Platform Key still remains undefined after the above steps.
• This is a more advanced recovery path and would not typically be the first recommendation when the system is otherwise booting normally.

For a community response, I would avoid stating that the issue is caused by "corrupted or outdated Secure Boot keys," because the information provided only confirms that the Platform Key is not enrolled. The root cause has not been definitively established from the available diagnostics.

A stronger HP-style response would focus on:

• Restoring factory Secure Boot keys.
• Verifying UEFI settings.
• Applying Windows and BIOS updates.
• Using BIOS Recovery only as a final troubleshooting step.

That keeps the guidance aligned with the symptoms reported and avoids making assumptions about the underlying cause.

Take care, and have an amazing day!

Regards, 

Hawks_Eye