Secure Boot Measured Boot/SBAT Firmware Issue — TPM Attestation Failing in Fortnite

[rd146]

Hello, I need this issue escalated to HP's BIOS/firmware engineering team.

I have an OMEN by HP Obelisk Desktop, motherboard 84FD, BIOS AMI F.35 (12/19/2023), which HP has confirmed is the latest publicly available BIOS for this motherboard.

Fortnite/Easy Anti-Cheat reports:
“TPM attestation failed: unable to verify secure boot. event missing from measured bootlog.”

TPM 2.0 is present, ready, and capable of attestation. Secure Boot is enabled, the Platform Key is enrolled, the system is booting in UEFI mode, and Confirm-SecureBootUEFI returns True.

However, Windows Measured Boot reports:
SecureBootEnabled.ValueFromComputer = true
SecureBootEnabled.ValueFromTcgLog = false

The TCG log is present and PCRs match the TCG log.

Windows Event Viewer also repeatedly reports Kernel-Boot Event ID 292:
“Failed to update the SBAT value in FW.”

I contacted Microsoft Support and they reviewed these results. They stated that the evidence does not indicate a TPM or Windows configuration problem and that the discrepancy suggests the firmware-generated Measured Boot event is missing, incomplete, or incorrectly reporting the Secure Boot state. Microsoft recommended that I have HP investigate this at the firmware level.

Could you please escalate this to HP's BIOS/UEFI firmware engineering team and determine whether BIOS F.35 for motherboard 84FD has a Secure Boot/Measured Boot/SBAT firmware issue?

I am not looking for instructions to simply enable TPM or Secure Boot, as both have already been verified. I am specifically requesting investigation of the firmware-generated TCG measured-boot data.

[resistencia]

Hi @rd146 

Unfortunately, this PC model will not receive an update that would allow it to run Fortnite.

HP AMD platforms with ASP fTPM - TPM Attestation failure | HP® Support

Now, SBAT(Secure Boot Advanced Targeting)  It is used as a secure boot option for users who run both Windows and Linux on the same computer. If you only have Windows installed, it will not be updated; you must also have Linux installed. This does not affect the certificates emitted by Microsoft in any way.

SBAT It is not installed as a standalone program; it is automatically integrated into the bootmanager ( GRUB) of modern Linux distributions to manage Secure Boot revocation lists.

So when Linux is installed, Windows updates SBAT to incorporate its certificates and configure both operating systems to use Secure Boot (SBAT).

You need is the following command in PowerShell as an administrator; if it returns “True,” everything is fine.

Active DataBase

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

Check default DB

 ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')

[rd146]

I ran the two Secure Boot database checks you requested.

The active Secure Boot database returned:
True

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

The default Secure Boot database returned:
False

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')

Therefore, the active db contains the Windows UEFI CA 2023 certificate, while dbdefault does not.

Secure Boot is enabled and Confirm-SecureBootUEFI returns True.

The original issue remains: Windows Measured Boot reports SecureBootEnabled.ValueFromComputer = true but ValueFromTcgLog = false, and Kernel-Boot Event ID 292 repeatedly reports “Failed to update the SBAT value in FW.”

Please advise whether the dbdefault = false result is expected for this HP 84FD/F.35 firmware, and whether it has any relationship to the measured-boot/SBAT issue.

[rd146]

Thank you for the article. I checked the affected-platform list and my system does not appear to be covered by it.

My system has an Intel Core i5-9400F, not an AMD Ryzen processor, and my TPM manufacturer is Intel (INTC) with TPM firmware 403.1.0.0.

My system is:

• OMEN by HP Obelisk 875-0xxx
• Motherboard/SSID: 84FD
• BIOS: F.35
• CPU: Intel Core i5-9400F
• TPM: Intel 2.0

I also confirmed that the active Secure Boot db contains Windows UEFI CA 2023 (db check returned True).

Therefore, could you please confirm that the AMD ASP fTPM article is not applicable to my Intel/84FD system?

My remaining issue is specifically the Measured Boot discrepancy:

SecureBootEnabled.ValueFromComputer = true
SecureBootEnabled.ValueFromTcgLog = false

together with repeated Kernel-Boot Event 292:

“Failed to update the SBAT value in FW.”

Microsoft Support reviewed this information and concluded that the evidence points to a firmware-to-measured-boot inconsistency and recommended HP investigate the UEFI firmware.

Please escalate this as a BIOS/UEFI measured-boot/Secure Boot firmware issue for the 84FD platform, rather than the AMD ASP fTPM issue.

[resistencia]

As I mentioned earlier, SBAT is only used if you're running Linux, which is why you're getting that error, and you should ignore if you're not running Linux and Windows at the same time.

It should be using the default database (you haven't made any manual changes); this isn't a BIOS issue, but rather the database hasn't been updated by Microsoft. Check to see if there are any updates available.

[resistencia]

This only applies to AMD; Intel is not affected. SBAT, as I mentioned, is only used if you're running Linux; any PC that doesn't run Linux will encounter that SBAT error.

[rd146]

I will check Windows Update as suggested. However, I want to clarify that the issue is not simply the presence of Event 292.

Windows Measured Boot reports:
SecureBootEnabled.ValueFromComputer = true
SecureBootEnabled.ValueFromTcgLog = false

The TCG log is present and PCRs match the log. TPM 2.0 is also ready and capable of attestation.

My concern is that this mismatch is exactly what Easy Anti-Cheat reports as “event missing from measured bootlog.”

I understand that SBAT is commonly associated with Linux/GRUB, but Windows itself is generating Kernel-Boot Event 292 stating “Failed to update the SBAT value in FW.” Therefore, could you clarify why Windows is attempting this firmware update on my Windows-only system and whether that failure can safely be ignored?

I will also check Windows Update for any available Secure Boot/firmware updates.

[rd146]

I checked Windows Update as requested. It reports that Windows is up to date. The only update installed was Microsoft Defender Security Intelligence Update KB2267602 (Version 1.457.350.0), which is an antivirus definition update and does not appear to be a Secure Boot, SBAT, TPM, or firmware update.

[resistencia]

SBAT is not Windows firmware; it is a file that is installed on the UEFI partition, and only a Linux installation can install it—and not just any version of Linux; it must be one of the latest versions that support Secure Boot. Windows simply checks for the presence of SBAT at every boot and, if it is present, updates the certificates to prevent conflicts between Linux and Windows when Secure Boot is enabled.

That is why it is listed as a caution in the event log rather than as an error.