Secure Boot won't work after a BIOS Update

[littlegiusi]

I have an HP OMEN 30L GT13-0024 running BIOS AMI F.32 dated March 31, 2025. Secure Boot worked before the BIOS update. Since updating, enabling Secure Boot causes “Secure Boot Violation — Invalid signature detected.” Windows boots normally when Secure Boot is disabled. Windows is in UEFI mode, my TPM is ready, and the Platform Key is enrolled. Windows Boot Manager is first in the boot order. Please confirm whether this is a known BIOS Secure Boot compatibility issue and provide an official fix.

[Deep_World]

Hi  @littlegiusi 
 
Welcome to the HP Support Community!

Thanks for reaching out!

I understand that Secure Boot was functioning correctly before the BIOS update, and after updating to BIOS F.32, enabling Secure Boot results in a "Secure Boot Violation – Invalid signature detected" message. 

I appreciate the troubleshooting you have already completed, including verifying UEFI mode, TPM readiness, Platform Key enrollment, and the Windows Boot Manager boot order.
 

To better understand the situation, could you kindly confirm the below details :

• Is BitLocker or Device Encryption enabled on the system?
• Have any hardware changes been made recently, such as replacing the SSD, graphics card, or motherboard?
• Does the error appear immediately after enabling Secure Boot, or only when Windows begins to load?

Meanwhile, kindly try the below steps and confirm :

1. Disconnect any external USB drives, memory cards, or other peripherals and restart the PC.
2. Enter the BIOS (F10 during startup) and load BIOS default settings.
3. Navigate to the Secure Boot settings and restore the factory Secure Boot keys, if the option is available.
4. Confirm that: 
   • Boot Mode is set to UEFI
   • Legacy Support is disabled
   • Windows Boot Manager is listed first in the boot order
5. Save the changes, enable Secure Boot, and restart the system.
6. If BitLocker is enabled, kindly suspend BitLocker protection (But kindly ensure you have backup of the recovery key) before making Secure Boot changes.

You may also find the following HP document helpful, as it specifically addresses the "Invalid Signature Detected - Check Secure Boot Policy" message and includes additional troubleshooting guidance:

HP Desktop PCs - Invalid Signature Detected - Check Secure Boot Policy - Click here 
 

I hope this helps.