Secure boot update failed to update SBAT

[ejnc]

Noticed that I am getting a message about secure boot. The current message is:

The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

This seems to go back a few weeks with the original message being this:

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.
DeviceAttributes: FirmwareManufacturer:AMI;FirmwareVersion:F.31;OEMModelBaseBoard:89B5;OEMManufacturerName:HP;OSArchitecture:amd64;
BucketId: 5d0ca651242894982fadd0b688bd4abf6f1fdb4f506f0eefe4ddac007c1bbce2
BucketConfidenceLevel:
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

My guess is that this is related to the 2023 certificates that should be installed. I have no idea if they are installed or not. BIOS is updated, I just updated to the latest version, which I believe is about 6 weeks old.

What do I need to do to get this error resolved?

[Meghana_10]

@ejnc, Welcome to the HP Support Community. 

Thanks for reaching out about your query regarding the HP ENVY Desktop PC TE01-3000i (4M0M1AV).

We're thrilled to have the opportunity to assist you and provide a solution. We hope our assistance has been helpful! 

The error code you are encountering, "0x800700c1", indicates an issue with updating the Secure Boot. Here are some steps you can take to troubleshoot this problem:

1. Check for Software Updates:

2. Ensure that your system is up to date with the latest firmware and software. You can find the necessary updates on the HP Customer Support - Software and Driver Downloads page by entering your product model.

3. Install Latest BIOS:

4. Go to the HP Support site.
5. Enter your serial number or product name and click "Submit".
6. Click on "Software, Drivers, and Firmware".
7. Select your Operating System version and click "Submit".

8. Find and download the latest BIOS update and follow the on-screen instructions to update it.

9. Secure Boot Configuration:

10. Access the BIOS/UEFI settings of your computer by pressing F10 during startup.
11. Navigate to the "Security" section and ensure Secure Boot is enabled.

12. Ensure the Secure Boot keys are correctly installed.

13. Verify Secure Boot Keys:

14. Ensure that the Secure Boot keys are set to factory defaults by choosing the option to reset Secure Boot keys.

15. Check for Any Pending Windows Updates:

16. Some updates might provide additional compatibility for Secure Boot.

I hope this helps!

Take care and have an amazing day! 

If you would like to thank us for our efforts to help you, go to the public post and give us a virtual high-five by clicking on "Yes" for the question "Was this reply helpful?" below my message, followed by clicking on the "Accept as solution" on my public post.

Regards,

Meghana

[ejnc]

As stated in the original post, BIOS is updated. About a week after I made the original post, Windows installed "Secure Boot Allowed Key Exchange Key (KEK) Update" KB ID: 5062710. The only possible update left in Windows is a preview version of 2026-02.

The issue persists.

[Meghana_10]

Thank you so much for your response @ejnc 

Could you please follow the steps provided below and check if the issue still persists?

It seems that you've recently updated the BIOS on your HP ENVY Desktop PC model TE01-3000i and then received a KEK update from Windows. Here's some information about Secure Boot and the KEK update:

1. What is Secure Boot? Secure Boot is a security feature that ensures only trusted software is allowed to boot on your system. It helps prevent unauthorized or malicious software from executing during the boot process.

2. Understanding KEK Update: The Key Exchange Key (KEK) update, like KB ID 5062710, typically involves updating the keys used in Secure Boot to ensure continued security compliance and integrity when booting into Windows.

3. Future Windows Updates:

4. You mentioned that there is a preview version of a 2026 update available. This might contain further security enhancements, bug fixes, or new features for your system.

5. Preview updates are optional and are generally released for testing purposes before the actual full update. It's important to install these only if you are prepared for potential minor issues that can arise from pre-release software.

6. Next Steps:

7. Keep your device updated with future BIOS and Windows updates to ensure that your system continues to operate securely.
8. Regularly check both HP Support and Windows Update for future mandatory updates rather than just previews.

Take care and have an amazing day! 

If you would like to thank us for our efforts to help you, go to the public post and give us a virtual high-five by clicking on "Yes" for the question "Was this reply helpful?" below my message, followed by clicking on the "Accept as solution" on my public post.

Regards,

Meghana

[ejnc]

The next steps are basically wait and hopefully someone will provide an update that will correct this. That's not really next steps. Seems like the fix for the issue is to disable secure boot. Since it isn't updating, as per HP and Microsoft sources, eventually it is going to stop working, effectively disabling it anyway.