HP Pavilion Gaming Desktop – Secure Boot Violation after enabling secure boot

[Omar189]

I'm having a Secure Boot issue on my HP Pavilion Gaming Desktop TG01-2xxx running Windows 11 (64-bit).

The PC boots and works perfectly normally when Secure Boot is disabled. However, as soon as I enable Secure Boot in the BIOS, the computer never reaches Windows. Instead, it immediately displays:

Secure Boot Violation
Invalid signature detected. Check Secure Boot Policy in Setup.

The message appears before Windows starts loading.

The reason I need Secure Boot enabled is because several games, including Valorant, require Secure Boot to be enabled in order to launch. At the moment, I have to choose between either booting into Windows with Secure Boot disabled or enabling Secure Boot and being unable to boot into Windows at all.

What I've already tried:

• Updated the BIOS to the latest version (F.29).
• Restored the factory Secure Boot keys.
• Confirmed Secure Boot is enabled and the Platform Key is enrolled.
• Performed an in-place Windows 11 repair install ("Fix problems using Windows Update / Reinstall Windows").
• Ran sfc /scannow and repaired any corrupted system files.
• Re-enabled the Windows Recovery Environment (WinRE).
• Verified that the EFI System Partition exists and contains the Windows boot files (bootmgfw.efi, bootmgr.efi, BCD, SecureBootRecovery.efi, etc.).
• Confirmed the system is booting in UEFI mode.
• Confirmed BitLocker/Device Encryption is disabled.
• Restored BIOS defaults and reconfigured Secure Boot.

None of these steps changed the behavior.

Additional information:

• Model: HP Pavilion Gaming Desktop TG01-2xxx
• BIOS Version: F.29
• Operating System: Windows 11 24H2 (64-bit)
• Windows boots normally when Secure Boot is disabled.
• The problem started suddenly. Secure Boot worked correctly in the past, and I was previously able to play Valorant without any issues.

Has anyone experienced this exact issue on an HP desktop, or is there an HP-specific procedure to rebuild or recover the Secure Boot database? Any help would be greatly appreciated.

[NonSequitur777]

@Omar189,

Welcome to our HP Community forum!

Based on your detailed troubleshooting (hat-tip btw!) you've already eliminated nearly all of the common causes.

You've confirmed:

• BIOS updated to the latest version (F.29).
• UEFI boot mode is enabled.
• Secure Boot factory keys have been restored.
• Platform Key (PK) is enrolled.
• EFI System Partition is present and contains the Microsoft boot files.
• Windows 11 has been repaired.
• sfc /scannow completed successfully.
• BitLocker/Device Encryption is disabled.
• BIOS defaults have been restored and Secure Boot reconfigured.

Since the "Secure Boot Violation - Invalid signature detected" message appears before Windows begins to load, the failure is occurring during the UEFI firmware's verification of the Windows Boot Manager, not within Windows itself.

A few questions that may help narrow this down:

1. Did this problem begin immediately after a Windows Update, BIOS update, or other firmware update?
2. Has any hardware been changed recently (SSD, graphics card, CMOS battery, etc.)?
3. Have you ever installed Linux or another operating system that may have replaced the Windows boot loader?
4. What is the motherboard SSID (shown in HP System Information as a 4-digit alphanumerical code as "BaseBoard Product") or msinfo32)?

One thing I would verify is that the Windows Boot Manager entry still points to Microsoft's signed boot loader.

Open an elevated Command Prompt ('as Administrator') and run:

bcdedit /enum {bootmgr}

The path should be:

\EFI\Microsoft\Boot\bootmgfw.efi

If it points elsewhere, that would explain the Secure Boot violation.

If it already points to bootmgfw.efi, the next step would be to rebuild the EFI boot files. From Windows Recovery or Windows installation media, this can be done with:

diskpart

list vol

select vol <EFI volume>

[please note: The EFI partition normally:

• has FAT32 filesystem
• is usually 100–300 MB
• has no drive letter
• shows System in the Info column
• On many systems, this is Volume 1.  You would type: select vol 1]

assign letter=S

exit

bcdboot C:\Windows /s S: /f UEFI

This recreates the Microsoft UEFI boot files without affecting your personal data.

One thing that caught my attention is your statement that Secure Boot worked correctly in the past and the problem started suddenly. If that's the case, this is unlikely to be a simple BIOS configuration issue. It suggests one of the following:

• the EFI boot files have become corrupted or mismatched,
• the Secure Boot database stored in firmware has become inconsistent, or
• there is a firmware compatibility issue between this platform and recent Microsoft Secure Boot certificate updates.

If rebuilding the EFI boot files does not resolve the problem, I would be interested in seeing the output of msinfo32 (System Summary) and the motherboard SSID, as that will identify the exact HP motherboard used in your TG01-2xxx and help determine whether this is a platform-specific firmware issue.

Kind Regards,

NonSequitur777

[Omar189]

Thank you for the detailed response.

I checked the Windows Boot Manager, and it is pointing to the Microsoft bootloader:

Windows Boot Manager
device: partition=\Device\HarddiskVolume2
path: \EFI\MICROSOFT\BOOT\BOOTMGFW.EFI

The PC has never had Linux or any other operating system installed, and no hardware has been changed recently. The issue appeared suddenly, although I can't say for certain whether it started immediately after a Windows Update or BIOS update.

I also previously attempted to rebuild the EFI boot files using:

bcdboot C:\Windows /s S: /f UEFI

However, it failed with the following error:

"Could not open the BCD template store. Status = [c000000f]"

Because of that, I performed an in-place Windows 11 repair install. After the repair, I verified that the EFI System Partition contains fresh Microsoft boot files, including bootmgfw.efi, bootmgr.efi, BCD, and SecureBootRecovery.efi. Unfortunately, enabling Secure Boot still produces the exact same "Secure Boot Violation – Invalid signature detected" message before Windows begins loading.

Here is the information from msinfo32:

• BIOS Mode: UEFI
• Secure Boot State: Off (Windows is currently booted with Secure Boot disabled)
• BaseBoard Manufacturer: HP
• BaseBoard Product: 8860
• BIOS Version/Date: AMI F.29, 9/17/2025
• System SKU: 33V37AA#ABA

One additional detail that may help: when Secure Boot is enabled, the system immediately displays the "Secure Boot Violation – Invalid signature detected" message before Windows begins loading. I don't even see the HP logo or the Windows loading spinner.

Please let me know if there are any HP-specific Secure Boot recovery procedures or firmware fixes that I should try next. Thank you for your help.

[NonSequitur777]

@Omar189,

Thank you for providing those additional details. They help narrow things down considerably.

The fact that:

• bcdedit confirms the Windows Boot Manager points to the correct Microsoft-signed bootmgfw.efi,
• the EFI System Partition contains the expected Microsoft boot files after the Windows repair,
• the system has never been dual-booted with Linux,
• no hardware has been changed, and
• the Secure Boot violation occurs before the HP splash screen or Windows loader appears,

suggests to me that Windows itself is no longer the primary suspect.

Your motherboard (SSID 8860) and BIOS F.29 are the latest currently available for that platform, so there isn't a newer HP BIOS you can install at this time.

One thing that stands out is the failure of:

bcdboot C:\Windows /s S: /f UEFI

with:

Could not open the BCD template store.

Status = c000000f

Whilst the subsequent in-place repair appears to have recreated the EFI boot files, that earlier error makes me wonder whether the Windows installation or EFI partition was already in an inconsistent state before the repair.

At this point, I would check one additional item:

From an elevated Command Prompt (as Administrator), run:

reagentc /info

and post the results.

Also, from an elevated PowerShell window, run:

Confirm-SecureBootUEFI

(while Secure Boot is disabled, it should simply return False rather than an error).

Finally, I'd verify that the EFI partition itself is healthy by running:

chkdsk S: /f

after temporarily assigning it a drive letter.

If all of those checks come back clean, I think we're left with two likely possibilities:

1. The Secure Boot databases (PK/KEK/db/dbx) stored in firmware have become corrupted or internally inconsistent, despite loading the factory default keys successfully.
2. A firmware issue involving the 8860 platform and Microsoft's newer Secure Boot certificate updates.

The second possibility has become more plausible over the past year. Microsoft has been rolling out Secure Boot certificate (CA 2023) and revocation (dbx) updates to address known bootloader vulnerabilities. While most systems handle these updates transparently, there have been isolated reports of older OEM firmware rejecting otherwise valid Microsoft bootloaders after these changes.

Since your system previously booted with Secure Boot enabled and now rejects the Microsoft bootloader before Windows even begins loading, I don't believe this is a normal Windows configuration problem anymore.

If HP has not released a newer BIOS for the SSID 8860 platform, there unfortunately isn't an end-user procedure to rebuild or repair the Secure Boot databases beyond restoring the factory keys, which you've already done.

At this point, the only remaining software step that would definitively rule out Windows would be a completely clean installation of Windows 11 onto a GPT-initialized drive. If a fresh installation still produces the same "Secure Boot Violation – Invalid signature detected" message immediately after Secure Boot is enabled, I would consider that strong evidence of a platform firmware issue rather than an operating system issue.

Kind Regards,

NonSequitur777

[Omar189]

Thank you again for the detailed explanation.

I have already verified that reagentc /info reports Windows Recovery Environment is enabled and properly configured. I also previously ran Confirm-SecureBootUEFI while Secure Boot was disabled, and it returned False, which I believe is expected since Windows is booting with Secure Boot turned off.

I then mounted the EFI System Partition using:

mountvol S: /S

and attempted to run:

chkdsk S: /f

from an elevated Command Prompt. However, chkdsk returned "Access is denied." I was running Command Prompt as Administrator.

Based on everything we've tested so far, do you still believe this is more likely to be a firmware/Secure Boot database issue than a Windows issue, or is there anything else you would recommend checking before considering a clean installation? What should I do next?

Thank you again for your help.

[Omar189]

I also just ran bcdboot C:\Windows /s S: /f UEFI and it said boot files successfully created, so i tried enables secure boot but it still gave the same message.

[Omar189]

Sorry for all of the updates, but I also just realized I only restored security settings to factory defaults, not the default keys. I have a "Load HP factory default keys" option which is greyed out, and a "Clear All Secure Boot keys" Option.

[NonSequitur777]

@Omar189,

No worries -been there, done that!

In any regards, thank you for the additional testing -it actually helps narrow this down quite a bit.

The fact that bcdboot now completed successfully rules out one of my earlier concerns that the EFI boot files might not have been rebuilt correctly.

At this point we've established that:

• Windows Boot Manager points to the Microsoft-signed \EFI\Microsoft\Boot\bootmgfw.efi.
• The EFI boot files have been recreated successfully.
• WinRE is configured correctly.
• The system is booting in UEFI mode.
• Secure Boot is disabled only because enabling it immediately causes a Secure Boot Violation before Windows even starts.

That sequence makes it increasingly unlikely that Windows itself is responsible.

Regarding:

Load HP factory default keys is greyed out.

That is actually significant!

On many HP systems, Load HP Factory Default Keys is only available when the existing Secure Boot keys have first been cleared. In other words, the normal sequence is:

1. Clear All Secure Boot Keys
2. Save and exit (or reboot back into the BIOS)
3. The firmware should then offer Load HP Factory Default Keys
4. Load the default keys, save, and reboot.

However, I would not recommend trying that immediately -unless you're comfortable recovering the system from the BIOS should something unexpected occur. Once the Platform Key (PK) is cleared, Secure Boot is effectively disabled until the factory keys are reinstalled.

If you've already used Restore Security Settings to Factory Defaults, it's possible the firmware believes the default keys are already present, which would explain why the option is unavailable.

At this point, I think the possibilities have narrowed to:

• a corruption or inconsistency in the Secure Boot key database stored in firmware, or
• a firmware defect on the SSID 8860 platform that is rejecting Microsoft's signed bootloader despite it being valid.

The latter has become a more realistic possibility as Microsoft has rolled out newer Secure Boot certificate and dbx (revocation) updates over the past couple of years. We've seen a small number of legacy platforms exhibit behavior very similar to yours after those changes.

Since you've already:

• updated to BIOS F.29,
• rebuilt the EFI boot files,
• verified the Boot Manager,
• repaired Windows,
• restored the security settings,

I'm not convinced a clean installation of Windows would change the outcome. A clean install would certainly eliminate any remaining doubt about the operating system, but because the Secure Boot violation occurs before Windows begins loading, I suspect the firmware would reject a freshly installed Windows Boot Manager in exactly the same way.

If this were my own system, my next step would actually be to contact HP Support and report the behavior against the SSID 8860 / BIOS F.29 platform. If multiple owners are seeing the same issue, HP would be in the best position to determine whether a BIOS update is needed to address a Secure Boot compatibility problem.

Please let me know whether you decide to try clearing and reloading the Secure Boot keys, as I'm very interested in whether Load HP Factory Default Keys becomes available afterward and whether that changes the behavior.

Kind Regards,

NonSequitur777