Secure Boot - Invalid Signature Detected

[ppeetteerr]

Hello,  I have a HP All-in-One 24-cb0000 series PC.

I have an issue whereby pc will not boot in Secure Boot only in Disabled Boot

I've tried all the steps to resolve the issue: Updated/ drivers,/Updated Bios/Deleted and reinstalled Security Keys/Installed and run Microsoft Media Creation Tool/Hardware Diagnostic Tests/ SSD tests/Smart Checks/ DST checks Memory Tests (all the tests and checks passed successfully) but  still not resolved.

I saw the following suggested cmd prompt on Google AI   (cmd C:\windows s C: /f UEFI ) and wondered you could you advise is is correct and safe to try and fix the problem , it states "Force Windows to Regenerate Fresh, Clean Signatures.

Regards       

[Pallipurath]

Hi @ppeetteerr 

Welcome to the HP Support Community.

Thank you for posting your query.

The suggested command string cmd C:\windows s C: /f UEFI is syntactically invalid and incorrect. It appears to be a garbled version of standard Windows utilities (such as bcdboot C:\Windows /s C: /f UEFI or chkdsk), but as typed, it will fail with a syntax error in Command Prompt.

Understanding the Error

The "Secure Boot Violation - Invalid Signature Detected" error occurs when your system's UEFI firmware detects that a bootloader, driver, or operating system component lacks a valid digital signature or fails verification against the keys stored in the system BIOS. This mismatch commonly happens after recent Windows Cumulative Updates, BIOS updates, or when Secure Boot key databases become unsynchronized.

Step 1: Temporarily Disable Secure Boot and Clear Keys

1. Restart your PC and repeatedly press F10 as soon as the system powers on to enter the HP Computer Setup (BIOS).
2. Navigate to the Boot Options tab (or Security > Secure Boot Configuration, depending on your BIOS version).
3. Set Secure Boot to Disabled.
4. Select Clear All Secure Boot Keys (or Clear Secure Boot Keys).
5. If an on-screen pass code is displayed, enter the numeric code and press Enter.
6. Press F10 to save changes and exit, then allow the computer to boot into Windows.

Step 2: Install Windows Updates and Update System Drivers

1. Once inside Windows, open Start > Settings > Windows Update.
2. Click Check for updates and allow Windows to download and install all pending quality and driver updates. Ensure updates such as cumulative update KB5068861 or system firmware patches finish installing.
3. If the OS boots into the Windows Recovery Environment (WinRE) instead of the desktop, navigate to Troubleshoot > Advanced options > Startup settings > Restart > Option 4 (Safe Mode), open Device Manager, and uninstall any newly updated or conflicting security drivers (e.g., Intel TXT modules).

Step 3: Re-Enable Secure Boot and Load Factory Default Keys

1. Restart your computer and press F10 to re-enter the BIOS Setup.
2. Go back to the Boot Options tab or Security > Secure Boot Configuration.
3. Set Secure Boot to Enabled.
4. Click Load HP Factory Default Keys (or Reset Secure Boot keys to factory defaults) and confirm by selecting Yes.
5. Press F10 to save changes and exit BIOS, then restart the system

Click here for more steps.

Take care and have an amazing day!