Secure Boot UEFI CA 2023 Update trouble

[mstauber]

Hi all,

is there anyone in the community, who fixes the well known update trouble, related to the BIOS fw Q02.30.00 Rev. A, that isn't capable to update UEFI CA 2023 certs via automated MS update rollout (blocked)...

The BIOS won't be upgraded by HP, seems, that NVRAM of my model has some limitations / restrictions...

HP told now, after months, model is EOL / EOS and won't offer newer BIOS or a workaround.

Therfor I ask you, if anyone with the same Hardware ( maainboard 83EC KBC Version 07.D4.00) and BIOS

has got a solution by HP or found a "trick" (for example via usb stick, that writes to the EFI partition or similar to find in tec forums), that works with that hard- / software and BIOS.

Thanks

[Bill_To]

Greetings,

I am not aware of any way to bypass the UEFI update requirement needed to successfully install the 2023 Windows security certificates.

The Windows 2023 security certificate updates will not happen if HP does not update the UEFI  Secure Boot (PK) database.

Your PC will still work as expected.

But as time passes your PC will be exposed to emerging Secure Boot vulnerabilities since Windows Update will not be able to apply  future Secure Boot mitigations to your operating system.

However, future Windows security updates for all other non-Secure Boot vulnerabilities should be provided by Windows Update.

Regards

[mstauber]

Hi Bill_To,

thanks for your feedback,.

It's that, what I found in month of weak support by HP and I worry that.

But I still have a bit hope, because I've read from IT professionals in tec forums, that they've tricked similar, not the same maschine then mine by, I'll shorten that, format a stick to EFI, boot it and were able to update (write to EFI partition).

Limitation: it doesn't write in the NVRAM, so lost of it, when CMOS battery goes empty.

Thanks so far

[TunaBalkan]

I did in my surface pro 4 by creating EFI  folder in fat32 formatted USB with recovery file in windows secure boot folder as mentioned in many sites and it worked perfectly. However, I wonder whether this will create a boot failure or not in my zbook studio g3 running windows 11 since it is mentioned in several talks that nvram size is not suitable for CA 2023.

[TunaBalkan]

I don't think that hp will release a new bios. So working with EFI will not be a problem. In any case turning secure boot and hp sure start off will make the system bootable again. However, I will read more to understand hp legacy and uefi bios computers with sure start technology security and boot algorithms before attempting to make changes on bios settings and uefi partition since I have Windows 11 Pro on unsupported cpu Zbook Studio G3 mobile workstation. It is since an excellent computer and I don't understand why hp is not going to release new bios for especially business laptops which are really powerfull. I understand from hp documentation bios is not the problem and it is capable for CA 2023 certificates. However, there may be another problem which I should clearify first. The problem is partially explained in the following hp documentation.

https://support.hp.com/us-en/document/ish_9642671-9641393-16?jumpid=in_r11839_us-en/PCSecureBootErr