Problem with enabling Secure Boot

[bennie132]

Hello,

I'm having issues starting up my OS with Secure Boot enabled. Whenever I enable, I get an "violation" saying Boot Device Not Found

I have an HP Pavilion Gaming Desktop TG01-0004nc (product number 8KT69EA#BCM).

My system information is:

• Motherboard ID: HP 8653

• Current BIOS: AMI F.20 (May 29, 2020)

• Operating system: Windows 11

• BIOS boot mode: UEFI

I am experiencing a problem where enabling Secure Boot causes a "Secure Boot Violation" and "Boot Device Not Found (3F0)" error. Windows boots normally when Secure Boot is disabled.

I found BIOS update F.37 Rev.A (SoftPaq sp150172), dated November 13, 2023, listed for motherboard SSID 8653. However, the download page lists Windows 10, and HP Support Assistant reports that my system is up to date.

Could anyone please confirm:

1. Is BIOS F.37 (sp150172) compatible with my exact computer model running Windows 11?

2. Is it safe and supported to upgrade directly from F.20 to F.37?

3. Could this BIOS update resolve my Secure Boot startup issue?

Thank you for your assistance.

[Bill_To]

Greetings @bennie132 

BIOS version F.37 is a valid BIOS update for your PC's 8653 MB.

BIOS version F.37 should install on Windows 11.

BIOS version F.37 will not fix the Secure Boot error.

HP has placed a substantial group of AMD PCs into Legacy status. No future BIOS updates are in the pipeline.

However, your PC sports an Intel H370 MB. H370 chipsets date back to Q2'18.

I'm guessing your PC may be in Legacy status.

You can try the Secure Boot workaround solution in this HP Forum Thread.

But some Forum members are not having a good experience using the Secure Boot workaround.

Or disable Secure Boot/enable Legacy support so you can use Windows.

Unfortunately, zero future BIOS updates and an outdated EFI Secure Boot PK database means your PC will become more insecure as time progresses.

Regards

[bennie132]

[SOLVED] HP Pavilion Gaming Desktop — Secure Boot Violation / Boot Device Not Found (3F0) — Windows 11

Hi everyone,

I wanted to share a solution to a Secure Boot problem I experienced on my HP Pavilion Gaming Desktop. Hopefully, this helps anyone experiencing the same issue.

My PC specifications:

• Model: HP Pavilion Gaming Desktop TG01-0004nc (TG01-0xxx)

• Product Number: 8KT69EA#BCM

• Motherboard: HP 8653

• BIOS: AMI F.20 (May 29, 2020)

• Operating System: Windows 11 (64-bit)

• BIOS Mode: UEFI

The problem

My computer had been running Windows 11 with Secure Boot enabled without any problems.

However, one day, my PC suddenly stopped booting correctly and displayed errors such as:

• Secure Boot Violation

• Invalid Signature Detected

• Boot Device Not Found (3F0)

The only way I could get back into Windows was by manually disabling Secure Boot in BIOS.

With Secure Boot disabled, Windows worked normally. However, games such as VALORANT require Secure Boot to be enabled on Windows 11, meaning I could no longer play.

Every time I tried enabling Secure Boot again, the same boot errors returned.

I tried several troubleshooting methods, including restoring the factory Secure Boot keys, but nothing fixed the issue.

I also considered updating my BIOS, but ultimately a BIOS update was not necessary.

What turned out to be the problem?

After investigating, I discovered that my BIOS was missing the newer Windows UEFI CA 2023 certificate from its Secure Boot trusted signature database (db).

My firmware originally contained only these certificates:

• HP UEFI Secure Boot DB 2017

• Microsoft Corporation UEFI CA 2011

• Microsoft Windows Production PCA 2011

The Windows UEFI CA 2023 certificate was missing.

This suggested that my firmware might not trust the newer Microsoft boot components, causing the Secure Boot Violation.

After restoring the missing certificate, Secure Boot worked again.

How I fixed it

IMPORTANT: This procedure modifies Secure Boot certificates stored in your motherboard's firmware. Back up important data before proceeding. Although it worked for me without any data loss, I cannot guarantee that it will work on every HP computer.

Step 1 — Check your Secure Boot certificates

Boot into Windows with Secure Boot disabled.

Open PowerShell as Administrator and run:

Get-SecureBootUEFI -Name db -Decoded

This displays the certificates stored in your firmware's Secure Boot database.

Look for:

Windows UEFI CA 2023

In my case, this certificate was missing.

If yours is already present, your problem may have a different cause.

Step 2 — Check for Microsoft's recovery utility

In PowerShell, run:

Test-Path "C:\Windows\Boot\EFI\SecureBootRecovery.efi"

If the result is True, the recovery utility exists on your system.

You can also check its digital signature:

Get-AuthenticodeSignature "C:\Windows\Boot\EFI\SecureBootRecovery.efi" | Format-List Status,StatusMessage,SignerCertificate

My result showed:

Status : Valid

The file was digitally signed by Microsoft Windows.

Do not use a recovery utility downloaded from an unknown third-party website.

Step 3 — Check BitLocker

Before changing any firmware settings, check whether BitLocker encryption is enabled.

Open PowerShell as Administrator and run:

manage-bde -status C:

In my case, the drive was fully decrypted and BitLocker protection was disabled.

If BitLocker is enabled on your computer, make sure you have securely backed up your recovery key and follow Microsoft's guidance on suspending protection before making firmware changes.

Step 4 — Prepare a recovery USB

You will need a USB flash drive formatted as FAT32.

Warning: Formatting the USB erases its contents.

1. Plug in your USB flash drive.

2. Open File Explorer and select This PC.

3. Right-click the USB drive and select Format.

4. Select FAT32 as the file system.

5. Format the drive.

6. Open the USB and create the following folder structure:

USB Drive
└── EFI
    └── BOOT
        └── bootx64.efi

To create the bootx64.efi file:

1. Navigate to C:\Windows\Boot\EFI.

2. Copy SecureBootRecovery.efi.

3. Paste the copy into the USB's EFI\BOOT folder.

4. Rename the USB copy to bootx64.efi.

Do not delete, move, or rename the original file in your Windows directory.

Step 5 — Boot from the USB

1. Leave Secure Boot disabled in BIOS.

2. Keep the USB plugged in.

3. Restart your computer.

4. Repeatedly press F9 to open HP's Boot Device Options menu. On some HP systems, press Esc first and then F9.

5. Select your USB drive under UEFI Boot Sources.

On my computer, the option was:

UEFI: USB Flash Disk 1100

After selecting it, Microsoft's recovery utility launched and displayed a message indicating that the system would reboot in 10 seconds.

I allowed the computer to restart automatically.

Step 6 — Verify that the certificate was restored

Once Windows started again, I opened PowerShell as Administrator and ran:

Get-SecureBootUEFI -Name db -Decoded

This time, the output included:

CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US

The missing certificate had successfully been added to my firmware!

Step 7 — Re-enable Secure Boot

After confirming the certificate was present:

1. I removed the USB flash drive.

2. Restarted my computer.

3. Entered BIOS using F10.

4. Enabled Secure Boot.

5. Kept Legacy Support disabled.

6. Saved the settings and restarted.

Windows booted successfully with Secure Boot enabled!

Step 8 — Confirm Secure Boot is working

Once Windows started, I opened System Information (msinfo32).

It displayed:

BIOS Mode: UEFI
Secure Boot State: On

I also ran this PowerShell command:

Confirm-SecureBootUEFI

The result was:

True

This confirmed that Secure Boot was successfully enabled.

Final result

After using Microsoft's recovery utility:

• Windows booted normally with Secure Boot enabled.

• The Windows UEFI CA 2023 certificate was restored.

• The Secure Boot Violation no longer prevented startup.

• No BIOS update was required.

• No Windows reinstall was required.

• No personal files or installed applications were lost.

Conclusion: In my case, restoring the missing Windows UEFI CA 2023 certificate resolved the Secure Boot startup problem. The successful repair strongly suggests a certificate trust mismatch was responsible, although I cannot confirm exactly what originally caused it.

This solution may not work for everyone, particularly if your Secure Boot error has a different cause.

I hope this helps someone experiencing the same frustrating issue!

Microsoft reference: Secure Boot certificate updates and recovery documentation