HP ProDesk 400 G5 Microtower PC - Windows 2023 Secure Boot certificates

[Vic24]

My HP ProDesk 400 G5 MT has not successfully installed the Windows 2023 Secure Boot certificates. In my Windows 11 (2026H2) Device Security, it shows a yellow flag, and a message essentially saying the device needs a manufacturer BIOS update first. It is already running  BIOS HP Q3 Ver 02.30.00 Rev A,  30/12/2024. 

Is there some other patch or BIOS upgrade or procedure that will enable the updated secure boot certificates to be used? I have seen similar questions on this site but the HP comments say that a separate post is required for different sub-models.

[Pallipurath]

Hi @Vic24 

Welcome to the HP Support Community.

Thank you for posting your query.

The yellow flag in Windows 11 Device Security occurs because HP's automated mechanism for updating to the 2023 Secure Boot certificates requires a specific firmware modification—inserting an SBKPFV3 string into the SMBIOS Type1 version field. This string tells Windows Update that it is safe to automatically append the new 2023 certificates to the system's UEFI databases.

While HP provided this automated firmware update for select commercial models (such as the ProDesk 400 G5 Desktop Mini), the HP ProDesk 400 G5 Microtower (MT) and Small Form Factor (SFF) models are not included in the automated BIOS update scope. Consequently, even though your PC is running the latest BIOS Ver 02.30.00 Rev A, it lacks the SBKPFV3 string, causing Windows 11 to temporarily pause certificate updates and display the warning.

To resolve this issue, HP provides an official Manual / EOSL Secure Boot Certificate Package containing a PowerShell deployment script and the 2023 certificates.

Suspend BitLocker Drive Encryption

• Crucial Step: Before running any script or modifying Secure Boot variables, suspend BitLocker (or any third-party disk encryption) in Windows. Modifying Secure Boot certificates while BitLocker is active will trigger a BitLocker recovery loop upon reboot.

Obtain the HP Secure Boot Certificate Package

• Go to hp.com/go/contacthp and register your ProDesk 400 G5 MT using its Serial Number and Product Number.
• Access HP Support Chat and request the HP EOSL Secure Boot Certificates Package (eosl-products-package-v5 ZIP file and instruction document). HP Support agents distribute this package directly to ensure compatibility.

Execute the Certificate Enrollment Script

• Extract the downloaded eosl-products-package-v5 file to a temporary folder on your PC.
• Open Windows PowerShell as Administrator.
• Navigate to the extracted directory and run the enrollment script:.\enroll-sb-vars.ps1

(Optional parameters: append -MS3PUC if you need third-party Secure Boot certificates installed, or -MSUpdBootMgr to initiate Windows Boot Manager updates).

Reboot Your PC

• Restart your computer after the script reports successful certificate enrollment.
• Some systems may require up to two reboots for all UEFI changes to register in Windows.

Re-enable BitLocker

• Once the PC reboots cleanly and the warning flag disappears in Windows Device Security, resume/re-enable BitLocker protection

HP Business PCs - Prepare for new Windows Secure Boot certificates
Solution to HP ProDesk 400 G5 new Secure boot certificates

Take care and have an amazing day!

[Vic24]

Many thanks for your very detailed reply.  Although I hadn't mentioned it in my earlier post I confirm I had already tried that script. The script It seems to have updated the certificates in the firmware but left a condition that still displays the warning yellow flag in Windows Settings. Specifically, within the registry  WindowsUEFICA2023Capable = 2, the signature on the Boot Manager is with the new 2023 certificate but Windows Security, Device Manager still shows the yellow flag.