Secure Boot is enabled in BIOS, but Windows reports Secure Boot State: Off.

[iamsergio]

I have an HP OMEN 30L GT13 desktop with motherboard SSID 8876, updated to BIOS F.24.

Secure Boot is enabled in BIOS, but Windows reports Secure Boot State: Off.

The BIOS shows Platform Key: Not Enrolled. Selecting Load HP Factory Default Keys schedules enrollment for the next boot, but after saving and restarting, the Platform Key remains Not Enrolled.

Windows PowerShell confirms:

• Confirm-SecureBootUEFI: False

• Get-SecureBootUEFI -Name PK: Variable is currently undefined (0xC0000100)

• Get-SecureBootUEFI -Name SetupMode: {1}

Windows boots in UEFI mode, and TPM 2.0 is recognized and functional.

Please advise whether there is an HP-approved firmware recovery or Secure Boot key provisioning procedure for this motherboard and BIOS version.

Please help with a solution.

[Bill_To]

Greetings @iamsergio 

BIOS version F.24 running on GT13-1000a PCs has introduced a EFI Secure Boot Platform key database problem.

Some GT13-1000a PC's push a EFI Secure Boot violation error at system startup when Secure Boot is enabled. Your PC seems to be okay in this respect.

However, if you are seeing a Secure Boot violation at startup, you'll have to temporarily disable Secure Boot and enable Legacy support.

This is a known problem. HP is working on a future BIOS update to mitigate this issue.

At this time you have two options:

1. It is recommended to periodically check this HP Site for a BIOS update that supersedes BIOS version F.24. Or routinely check HPSA for a future, post F.24, BIOS update. Also do a wild card check, using GT13-1000a, for future BIOS updates.

2. Or  you can follow steps at this *Forum Link *to attempt to fix the current F.24 Secure Boot problem you are experiencing.

Note: the above (* Forum Link*) fix has helped many folks in the Forum. However, it is not 100% guaranteed to work in all cases.

Regards

[iamsergio]

Thanks for the information about the known BIOS F.24 Secure Boot issue.

I'm experiencing a similar problem on my HP OMEN 30L GT13-1000 series desktop (motherboard SSID 8876).

I've updated my BIOS from F.13 to F.23 and then F.24. I've enabled Secure Boot and attempted to restore the HP factory default keys multiple times. However, the BIOS continues to show "Platform Key: Not Enrolled," and Windows reports "Secure Boot State: Off."

I've also confirmed the following using PowerShell:

• Confirm-SecureBootUEFI: False

• Platform Key (PK): Variable is currently undefined (0xC0000100)

• SetupMode: 1

• Secure Boot db: Present

• Secure Boot KEK: Present

• UEFICA2023Status: Updated

• AvailableUpdates: 0

Windows is running in UEFI mode, TPM 2.0 is recognized, and BitLocker protection is enabled.

I found the workaround involving Microsoft's SecureBootRecovery.efi utility, which is present on my computer. However, I'm unsure whether that workaround addresses my particular issue, since my Platform Key is missing rather than Windows reporting a Secure Boot violation at startup.

Could someone clarify whether the missing Platform Key is part of the known F.24 issue and whether SecureBootRecovery.efi can resolve it? 

If not, is there an HP-approved procedure to restore the Platform Key, or will this require another BIOS update?

I'm trying to enable Secure Boot to meet Call of Duty's security requirements.

Thanks for any guidance.

[Bill_To]

Greetings @iamsergio 

Option 2, in my previous response, is the only BIOS version F.24 workaround I'm aware of at this time.

The EFI platform key issue may be related to a firmware mismatch and the new 2023 Windows security certificate updates.

You'll have to wait for a future BIOS update if the option 2 workaround does not help.

Regards