OMEN 40L secure boot violation

[Jer223]

Hello, I have an HP OMEN 40L Gaming Desktop, product number 7P4K8AA, motherboard SSID 8949, running Windows 11 Home version 25H2.

My PC displayed “Secure Boot Violation — Invalid signature detected.” I can currently boot into Windows with Secure Boot disabled. Event Viewer also shows repeated Secure Boot SBAT update failures with error 0x800700c1.

I found BIOS update F.38 (sp167162) on HP’s website, but its listed Windows 11 support versions only go through 24H2. Could you confirm whether this BIOS update is appropriate for my PC running 25H2 and provide the recommended procedure to repair Secure Boot safely?

I have my BitLocker recovery key and want to avoid losing access to Windows or my files.

[Bill_To]

Greetings @Jer223 

The Secure Boot violation means your PC does need a HP BIOS update. This future BIOS update would need to update the EFI Secure Boot PK database.

Right now your PC, most likely, cannot apply the new W11 2023 security certificates. Your PC has a mismatch between the W11 security certificates and the EFI Secure Boot PK database.

This is why you have to run the PC with Secure Boot-off and Legacy Support enabled.

BIOS update:

All HP: W10 or W11 BIOS updates will install on W11 25H2.

The latest BIOS update, version F.39, is available for your PC Here. This update should install on your W11 25H2 PC.

There is nothing in the "Fixes" section at the above HP site to indicate this update fixes the Secure Boot problem.

Device Encryption (BitLocker):

Device encryption must be turned off prior to doing a BIOS update. Please see this Site for instructions.

I don't know why you are using Device encryption on a Desktop gaming PC. I don't use it. Possible loss of access to the system drive can happen for a number of different reasons.

I hope you do routine data backups to NAS or other external media.

You would have to reinstall W11 if the BitLocker recovery key should ever fail to unlock the system drive.

The Secure Boot problem:

You may have to try a Secure Boot workaround if the latest HP BIOS version (F.39) does not fix the Secure Boot problem.

This workaround is available at this HP Forum Link.

Or you may have to wait for a future HP BIOS update if you don't want to do the workaround.

Regards