Secure boot violation

[Mr-Skip]

HP support issue

Secure Boot Violation / 3F0 Boot Failure — HP Pavilion TP01, Motherboard 8767, BIOS F.54

Product: HP Pavilion Desktop TP01-1008na
Product number: 1K2V2EA#ABU
System board: HP 8767
Processor: Intel Core i5-10400
BIOS: AMI F.54
Operating system: Windows 11 Home 25H2
Boot drive: Samsung 256 GB NVMe SSD

Problem

Enabling Secure Boot causes the computer to fail during startup with:

• Secure Boot Violation — Invalid signature detected
• Boot Device Not Found — Hard Disk (3F0)

Disabling Secure Boot allows Windows to boot normally.

The computer is configured for UEFI boot, and the BIOS reports that the Platform Key is enrolled.

Diagnostic findings

1. The Windows EFI bootloader has been verified as signed by Microsoft Windows Production PCA 2026.
2. Inspection of the firmware Secure Boot databases identified HP and Microsoft certificates dating from 2017 and 2011 respectively. The presence of the Windows UEFI CA 2023 certificate has not been confirmed.
3. Windows Secure Boot servicing reports:
• UEFICA2023Status = InProgress
• UEFICA2023Error = 0
• WindowsUEFICA2023Capable = 0
4. Windows has recorded Microsoft-Windows-TPM-WMI Event ID 1796, reporting an SBAT update failure with error 0x800700C1.
5. The Microsoft Secure-Boot-Update scheduled task is present and operational. A certificate-update request using AvailableUpdates = 0x40 was submitted and the task executed. The request was subsequently cleared, but the 2023 certificate could not be verified in the firmware database, including after restarting.
6. Inspection of BIOS F.54 confirmed:
• Secure Boot: Disabled
• Platform Key: Enrolled
• Pending Action: None
• No visible facility for installing individual Secure Boot certificates
7. A Windows Recovery USB has been created and successfully boot-tested with Secure Boot disabled.

The Secure Boot keys and TPM have not been cleared or reset.

Additional hardware information

The computer previously suffered intermittent complete freezes. Faulty memory was identified through diagnostic testing and replaced. The replacement memory passed testing, and there have been no further freezes.

The remaining Secure Boot failure is being investigated separately.

Related HP Community case

A remarkably similar problem has been reported on another HP Pavilion TP01 computer with the same motherboard (8767) and BIOS F.54:

https://h30434.www3.hp.com/t5/Desktop-Boot-and-Lockup/Secure-Boot-SBAT-Failure-Event-1796-0x800700C1...

That case describes the same Secure Boot Violation, 3F0 startup failure, missing certificate and SBAT error.

Questions for HP

1. Is HP aware of a compatibility problem involving motherboard 8767, BIOS F.54 and Microsoft’s Secure Boot certificate/SBAT updates?

2. Does BIOS F.54 support the required newer Microsoft Secure Boot certificates, including those needed to validate the currently installed Windows EFI bootloader?

3. Is there an HP-approved firmware update or certificate-deployment procedure for this motherboard?

4. If no remedy is currently available, is HP investigating this issue, and what is the recommended interim configuration?

I would prefer not to clear the Secure Boot keys, restore factory keys, downgrade the BIOS or reinstall Windows without a documented technical justification.

I can provide additional diagnostic information if required.

Thank you.

[VikramTheGreat]

Hi @Mr-Skip,

Welcome to the HP Support Community.

Thank you for providing the detailed diagnostic information.

Before proceeding, please confirm how BIOS F.54 was installed on the computer:

• HP Support Assistant
• Windows Update
• HP Software and Driver Downloads
• Another source

Please do not clear the Secure Boot keys, reset the TPM, or attempt to install BIOS F.51 at this stage.

First, restore the BIOS defaults:

1. Restart the computer and repeatedly press F10 to open BIOS Setup.
2. Select Apply Factory Defaults and Exit or Load Setup Defaults.
3. Save the changes and restart the computer.
4. Return to BIOS Setup and confirm the BIOS version displayed.
5. If enabling Secure Boot still causes the Secure Boot Violation and 3F0 error, leave Secure Boot disabled temporarily so Windows can start.

Please also run the storage test:

1. Turn off the computer.
2. Turn it on and repeatedly press Esc.
3. Press F2 to open HP PC Hardware Diagnostics.
4. Select Component Tests > Storage.
5. Run the available storage tests and note any 24-digit Failure ID.

Since Windows starts normally when Secure Boot is disabled, please do not use BIOS recovery or a USB drive to force BIOS F.51. BIOS recovery is intended for situations where the BIOS is corrupted, or the computer cannot start.

Only install a BIOS package offered for the exact product number 1K2V2EA#ABU and system board 8767 through the HP Software and Driver Downloads page: HP Pavilion Desktop - TP01-1008na undefined.

Please let us know how BIOS F.54 was installed, the version displayed after restoring the defaults, and the result of the F2 Storage Test. This information is required before recommending any further BIOS action.

[Mr-Skip]

Hi, thank you enormously for helping,  my ChatGPT assistant has composed the following.

Re: Secure Boot Violation — Results of requested diagnostics

Hi VikramTheGreat,

Thank you for your guidance. I have now completed the requested checks.

BIOS installation history

The computer is running AMI BIOS F.54, dated 04/08/2025.

I have never deliberately updated the BIOS. I examined Windows Update history, including Driver Updates and Other Updates, but found no identifiable BIOS or firmware update entry. I therefore cannot confirm how F.54 was installed.

Storage diagnostics

I ran HP PC Hardware Diagnostics UEFI, version 9.1.0.0.

• SMART Check: PASSED

• SSD Wear Check: PASSED

• Short DST Check: PASSED

• Extended storage test: PASSED

• Samsung SSD MZVLQ256HAJD-000H1: 8% wear, 92% remaining life

No failure ID was generated.

Restoring BIOS defaults

I entered BIOS Setup using F10 and selected Exit → Load Setup Defaults.

This changed Secure Boot from Disabled to Enabled. The Platform Key remained Enrolled, and OS Boot Manager remained first in the UEFI boot order.

I saved the configuration and restarted.

The original fault immediately returned:

1. Secure Boot Violation — "Invalid signature detected. Check Secure Boot Policy in Setup."

2. After acknowledging this error: "Boot Device Not Found — Hard Disk (3F0)."

I subsequently disabled Secure Boot again, leaving the Secure Boot keys and TPM untouched. Windows 11 then started successfully and the PC is operating normally.

Request for further guidance

The evidence suggests that the 3F0 error is secondary to the Secure Boot signature-validation failure.

Since restoring BIOS defaults did not resolve the problem, could you advise on the next specific corrective action?

In particular, should we investigate the Secure Boot signature database, the Windows bootloader signature, or a known compatibility issue involving BIOS F.54?

I have not cleared Secure Boot keys, reset the TPM, downgraded the BIOS or attempted BIOS recovery, in accordance with your instructions.

Computer: HP Pavilion Desktop TP01-1008na
Product number: 1K2V2EA#ABU
System board: 8767

Thank you for your assistance.

[Kuroi_Kenshi]

Hi @Mr-Skip,

Thank you for completing the requested checks and sharing the detailed results.

It's helpful to know that all SSD diagnostics passed and that Windows boots normally when Secure Boot is disabled. Since restoring the BIOS defaults did not resolve the signature violation, I would not recommend repeating the reset or clearing the Secure Boot keys or TPM.

At this stage, the results do not conclusively establish whether the issue is related to the firmware's Secure Boot certificate database, the bootloader's signature validation, or a compatibility issue with BIOS F.54.

Given the detailed findings and the fact that the issue persists after restoring defaults, we recommend taking the conversation to our phone support team. They'll work with you one-on-one to get the issue sorted, possibly with some remote assistance magic.

Kindly Click here to Contact support to find options like chat, phone, or email for your HP products (depending on your product's warranty status)

Regards,

Kuroi_Kenshi

[Mr-Skip]

Thank you for your response and for acknowledging the diagnostic work already undertaken.

I appreciate that the evidence does not yet conclusively identify the cause of the Secure Boot signature violation. However, the problem is reproducible, and the investigations have already established that:

• The SSD passes the HP hardware diagnostics.

• Windows boots successfully with Secure Boot disabled.

• Enabling Secure Boot produces the signature violation and subsequent 3F0 boot error.

• Restoring BIOS defaults does not resolve the problem.

I am concerned that transferring the issue to general telephone support may simply result in repeating diagnostic procedures that have already been completed, without progressing towards identifying the underlying fault.

Could you please advise:

1. Whether this issue can be escalated to HP's BIOS/firmware engineering specialists for technical investigation.

2. Whether BIOS F.54 is confirmed as the correct supported version for my particular Pavilion model, and whether HP is aware of any Secure Boot compatibility or signature-validation problems associated with that version.

3. Whether the diagnostic findings already documented in this thread can be passed to the appropriate technical team, avoiding unnecessary repetition of the investigations.

I am entirely willing to undertake further diagnostic work where there is a clear technical justification. However, I would prefer that the next steps build upon the evidence already gathered.

Thank you for your assistance.

[Pallipurath]

Hi @Mr-Skip 

Thank you for responding.

Thank you for your detailed feedback and for carefully documenting the troubleshooting already performed. I understand your concern that repeating the same diagnostic steps through general support may not provide additional value, given the consistent and reproducible nature of the Secure Boot issue. Based on the information provided, I will take your comments as feedback and ensure that the diagnostic findings already outlined are taken into consideration for any further review.

Regarding the BIOS version, the latest BIOS version currently listed for your Pavilion model on the HP support page is F.51, not F.54. As such, we are unable to confirm F.54 as the supported production BIOS version for your system based on the information currently published by HP.

At this time, there is no confirmed information available indicating a known Secure Boot signature-validation issue associated with the supported BIOS release. However, we recognize that the findings you have documented, including the successful SSD diagnostics, normal operation with Secure Boot disabled, reproducible failure when Secure Boot is enabled, and unsuccessful BIOS default restoration, provide a strong basis for any future technical investigation.

Have a good day.

[Mr-Skip]

Hi Pallipurath,

Thank you for your response.

You stated that F.51 is the latest BIOS listed for my Pavilion model and that HP therefore cannot confirm F.54 as a supported production release.

I have located two official HP documents that appear to contradict this.

1. HP BIOS package SP163235

https://ftp.hp.com/pub/softpaq/sp163001-163500/sp163235.html

This identifies BIOS F.54, ROM family 8767, effective 16 September 2025, and includes the Pavilion TP01-1xxx series.

2. HP Intel Chipset Firmware Security Update advisory

https://support.hp.com/vn-en/document/ish_13131466-13131488-16

This explicitly lists the Pavilion Desktop TP01-1xxx with motherboard 8767 and BIOS F.54 (SP163235).

My machine is a Pavilion TP01-1008na, product number 1K2V2EA#ABU, motherboard 8767, currently running BIOS F.54.

Could HP please reconcile these published documents with your statement concerning F.51, and confirm whether F.54 is supported for my exact product number?

Given the reproducible Secure Boot failure and the diagnostics already completed, I would also appreciate confirmation that this issue can be referred to an appropriate HP BIOS/firmware specialist.

I am not proposing any further BIOS changes until its compatibility and the appropriate corrective action have been established.

Thank you for your assistance.

[Pallipurath]

Hi @Mr-Skip 

Thank you for responding.

Thank you for providing the additional documentation and references. The BIOS version information you have cited appears to require further review to determine applicability to your specific system configuration.

As this matter involves BIOS version validation, firmware compatibility, and a reproducible Secure Boot issue, it is beyond the scope of standard troubleshooting. The most appropriate next step is to contact an authorized HP Service Center https://support.hp.com/in-en/help/service-center
 

Given the apparent discrepancy between the published HP documentation and the BIOS information currently associated with your product, a service-center review is necessary to formally verify BIOS support status and determine whether a firmware correction, recovery procedure.

Have a good day.