OMEN 875 – Secure Boot verification failure despite Secure Boot ON (Windows 11 / BIOS F.35)

[imjen1]

Device: OMEN by HP Obelisk Desktop 875
BIOS: AMI F.35 (12/19/2023)
OS: Windows 11 Home

Secure Boot State shows ON in BIOS and msinfo32.
Platform Key is enrolled.
Legacy Boot is disabled.
TPM is enabled.

Despite this, Secure Boot attestation fails and software that requires UEFI Secure Boot (Riot Vanguard) reports:
"UEFI Secure Boot verification failure."

BIOS options are greyed out and keys cannot be reloaded.
This appears to be a firmware bug, not user configuration.

Requesting HP BIOS team escalation or Secure Boot key reprovisioning.

Troubleshooting already performed:
• Toggled Secure Boot OFF/ON
• Loaded HP Factory Default Secure Boot Keys
• Verified Platform Key enrolled
• Legacy/CSM disabled
• TPM enabled and functioning
• BIOS updated to latest available (F.35)
• Riot Vanguard fully uninstalled and reinstalled
• Windows reports Secure Boot ON (msinfo32)

Issue persists with identical error:
"UEFI Secure Boot verification failure" (VAN: RESTRICTION: 1)

[imjen1]

[VikramTheGreat]

Hi @imjen1,

Welcome to the HP Support Community.
 

Thank you for posting your query. I will be glad to help you.

I can imagine how frustrating this feels, everything in BIOS and msinfo32 says Secure Boot is On, TPM is ready, yet Vanguard still stops you with a stark “UEFI Secure Boot verification failure (VAN: RESTRICTION: 1)”. Let’s walk through a precise, HP‑correct path with steps, and I’ll include the official links so you’re never guessing.

First, a quick validation inside Windows (no changes yet)

1. Confirm real Secure Boot status (PowerShell, Admin): Confirm-SecureBootUEFI

Expect True. If it’s False, Windows and firmware disagree, and we’ll focus on firmware first.

1. Check BIOS Mode & TPM:
   • Press Win + R → msinfo32 → ensure BIOS Mode = UEFI and Secure Boot State = On.
   • Press Win + R → tpm.msc → Status: The TPM is ready for use and Specification Version: 2.0.
     Vanguard requires both Secure Boot and TPM 2.0 on Windows 11.

HP‑specific firmware steps (guided, safe order)

Do these in order. If a step is greyed out, note it and move on. We’ll collect details for escalation if needed.

1. Enter BIOS and verify boot policy names
   On the Obelisk 875, the Boot Options screen typically shows items like:
   • Secure Boot
   • Set up Mode Select / Secure Boot mode (Standard/Custom)
   • Platform Key Pending Action
   • Boot Keys (Clear / Load HP Factory Default Keys / Load MSFT Debug Policy Keys)
     This matches HP’s BIOS simulator for the 875‑1000i family.
      
2. Cycle Standard ↔ Custom to refresh keys (non‑destructive):
   • Set Secure Boot = Disabled.
   • Change Secure Boot Mode from Standard → Custom.
   • In Boot Keys, select Load HP Factory Default Keys (if available).
   • Switch Custom → Standard, then set Secure Boot = Enabled again.
   • Save & reboot.
     This “toggle‑to‑reinstall keys” pattern is commonly used to re‑provision PK/KEK/DB on HP UEFI when the status is inconsistent.
      
3. If key options are greyed out:
   That indicates a firmware lock or setup mode that blocks changes. Document the greying (photo) and proceed to the next steps; we’ll include this in the escalation.
    
4. Update firmware, BIOS & re‑apply keys (if any newer exist): Official HP® Support
    

I hope this helps.

Take care and have an amazing day!
 

Did we resolve the issue? If yes, please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!

Regards,

VikramTheGreat

[VikramTheGreat]

Hi @imjen1,
 

I hope this helps.

Take care and have an amazing day!
 

Did we resolve the issue? If yes, please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!

Regards,

VikramTheGreat