BIOS Secure Boot Platform Key failure

[nathsan01]

Hello, 

I understand this is a lot to read but I’ve expensed all of my options. I am experiencing a firmware-level issue with my HP Omen 30L Desktop GT13-1xxx (Board ID 8876, BIOS F.23).

Problem:

• Secure Boot cannot be enabled because the Secure Boot Key Database is empty.
• In BIOS, under Boot Options, the Platform Key (PK) always shows “Not Enrolled”.
• When I select “Load HP Factory Default Keys”, the option temporarily ungreys, but after reboot the Secure Boot keys are still missing.
• This creates a loop where Secure Boot remains greyed out and unusable.

Evidence Collected:

1. BIOS shows: Platform Key: Not Enrolled
2. Attempting to load factory keys → returns to greyed-out Secure Boot, no keys enrolled
3. Error screen: “The Secure Boot Key Database is Empty”
4. Windows Event Viewer:
   
• TPM-WMI Event 1796 – “The secure boot update failed to update a secure boot variable with error: secure boot is not enabled on this machine.”
• Confirms Windows cannot talk to Secure Boot because the database is missing
5. msinfo32 reports UEFI boot mode, TPM ready, GPT partition style, but Secure Boot = Off

Steps Already Tried

• Reflashed BIOS to F.23 using HP BIOS Update and Recovery
• Attempted rollback to earlier BIOS (F.13, F.20, F.22) — recovery rejected older versions
• Performed CMOS battery replacement and reset
• Cleared and reloaded Secure Boot keys multiple times — no effect
• Full Windows reinstall (clean + repair install)
• Verified TPM is present and functional (Get-Tpm in PowerShell = TPM ready, enabled, activated, owned)

This is not a Windows or TPM configuration problem. The Secure Boot key database is not being provisioned by the BIOS firmware, and “Load HP Factory Keys” does not populate it. Please escalate this case to HP BIOS/Firmware Engineering for the Omen 30L (board 8876). The system requires a firmware fix so that the Secure Boot key databases (PK, KEK, db, dbx) are properly provisioned and Secure Boot can function as designed. Also, I cannot play certain  games because of secure boot. 

[Garp_senchau]

@nathsan01, Welcome to HP Support Community,

Thank you for posting your query; I’m here to help by guiding you through steps to resolve this issue

Thank you for providing such a thorough and detailed account of the issue you're facing with your HP Omen 30L Desktop. I understand how frustrating it can be when Secure Boot isn’t functioning correctly, especially with it impacting game performance and security.

Here are the steps I would recommend to resolve this issue:

Re-verify BIOS Version F.23

Even though you’ve already reflashed to BIOS F.23, we recommend re-checking the HP website to see if a newer version (or even a Beta BIOS) has been released since your last update. Occasionally, newer firmware releases may resolve issues like this one, or offer a fix specific to your motherboard (Board ID 8876).

Check HP Support for any newer BIOS versions or related updates.

Check Secure Boot Configuration from the HP Omen Control Panel

The HP Omen series may have additional proprietary settings in the Omen Control software. I would suggest verifying if there are any settings in the Omen Control Panel related to Secure Boot or UEFI settings that could influence BIOS behavior.

Open the Omen Control Panel and check for any additional options or updates related to Secure Boot or UEFI.

Reset BIOS to Default Settings Manually

Since the "Load HP Factory Default Keys" isn’t fully enrolling the Secure Boot keys and resets to a non-functional state, I recommend performing a full reset to default BIOS settings manually:

Power off the system.

Hold the Power Button for 10-15 seconds to ensure complete discharge of power.

Boot into BIOS and manually reset settings to Default/Optimized Defaults.

After this, manually enable Secure Boot and see if the Platform Key is enrolled after a reboot.

Ensure TPM Settings in BIOS are Correct

Since TPM is involved in the Secure Boot process, ensure that the TPM settings in the BIOS are configured correctly.

Check Security or Advanced menu in BIOS and ensure that TPM is Enabled and Active.

If TPM settings are incorrectly configured, it could prevent Secure Boot from being enabled properly.

I hope this helps.

Please feel free to reply here if you have any questions or if you need further clarification on any of the steps. 

Take care and have a good day. 

Did we resolve the issue? If yes, please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!

Regards,

[nathsan01]

Thank you for the suggestions. I’ve already tried the recommended steps:

• BIOS F.23 has been reflashed multiple times; rollback was rejected.
• Omen Control Panel has no Secure Boot/UEFI options.
• BIOS was reset to defaults and TPM verified as enabled/active.
• Despite this, the BIOS still reports:
  
• Platform Key: Not Enrolled
• Secure Boot Key Database is Empty
• Attempting Load HP Factory Default Keys does not populate PK/KEK/db/dbx databases.
• Event Viewer repeatedly logs:
  
• TPM-WMI 1796 (Secure Boot variable update failed)
• SCEP/AIK enrollment errors tied to missing Secure Boot keys.
• Windows Update telemetry confirms: “Secure Boot CA/keys need to be updated.” 
  
• This confirms the root cause is not configuration, but a firmware-level defect in BIOS F.23 for board 8876.

[nathsan01]

This is what I have compiled when I checked in powershell as admin:
Unfortunately, I don't think updating KB5036210 will do anything because it would silently skip because there's no Secure Boot db to modify. Since my Secure Boot key database is empty, will HP release a BIOS patch for board 8876 that will properly provision the Platform Key and Secure Boot Keys?

[Lukas60]

i have a simullar problem  i load factory keys and it says next boot factroy keys  then i go back to windows and it says secure boot off i do the same and the PK is empty and its like a loop and i cant fix it

[Garp_senchau]

Hey @nathsan01, 

Thanks for reaching out! Since the issue remains unresolved, I suggest contacting our phone/chat support team for personalized assistance. They can provide one-on-one help and may even be able to work their remote assistance magic to fix the problem.

Note: There might be a nominal charge for the service they provide.

Regards,

[nathsan01]

Okay, thanks for the offer but absolutely not. I am not paying for an HP “tech support service” when they will do everything that I have already tried and in the end tell me they can’t do anything until HP releases a BIOS update that will have my PKs enrolled. I’m tired of the constant issues that I’ve had over the years with this computer and having to fix it over and over again by myself. On the bright side, at least I’ve learned a lot about troubleshooting computers thanks to this HP desktop. This is the end of the line for me with HP products.