HP ENVY 34 All-in-One BitLocker Recovery After Secure Boot KEK Change (No Recovery Key)

[Slinger52]

I have an HP ENVY 34-inch All-in-One Desktop (product number 7H9V2AA#ABA), running Windows 11 with BIOS F.21.

Following a possible recent Windows update, my computer became extremely slow. After restarting, it entered BitLocker recovery with the message:

"Secure Boot policy has unexpectedly changed."

The additional recovery information shows:

• Error: E_FVE_SECURE_BOOT_CHANGED

• Mismatched PCR: 7

• Mismatched event: KEK (Key Exchange Key)

• Expected and observed KEK measurements do not match

I have confirmed that Secure Boot and TPM are enabled. HP hardware diagnostics show that my SSD passes SMART and drive tests.

I do not have access to my 48-digit BitLocker recovery key, and the computer contains important files that cannot be lost.

I suspect a recent Windows update or a power outage may have changed the Secure Boot KEK configuration.

My question: Is there a documented, non-destructive procedure for this specific HP ENVY model to restore the previously trusted Secure Boot configuration and allow the TPM to unlock the drive?

I have not changed BIOS security settings, cleared the TPM, or restored factory Secure Boot keys.

I would appreciate guidance from someone experienced with HP firmware, Secure Boot certificate updates, and BitLocker recovery.

Thank you.

[Bill_To]

Greetings @Slinger52 

HP BIOS version F.21, dated 10-14-24, is not a recent BIOS update.

So I don't think Windows Update pushed a newer BIOS update to your PC. BitLocker must be turned off prior to doing a BIOS update.

I can only guess Windows Update may have pushed the latest KEK 2K CA 2023 certificates.

Your PC may now have a a security certificate PK database mismatch resulting in a BitLocker Recovery key prompt.

And, a power outage could also have corrupted the UEFI Secure Boot signature database variables.

But I'm not aware of any way to bypass the BitLocker recovery key requirement.

The Microsoft Account associated with your PC's initial OOBE setup should have recorded the BitLocker recovery key. Sign in to this account using a different PC to locate the BitLocker recovery key.

You will lose all data on the encrypted system drive if you don't know the BitLocker recovery key and you cannot locate the BitLocker recovery key. And, there are unusual situations where the correct BitLocker recovery key fails to unlock the system drive.

Finally, resetting the BIOS to defaults or clearing CMOS could also result in a BitLocker recovery key prompt.

Data recovery without having a viable BitLocker recovery key is not looking good.

The following comments will not solve your immediate problem:

I don't use BitLocker. There are other ways to encrypt data.

And I always do multiple, redundant, data backups to avoid the very unfortunate situation you are now experiencing.

Regards