Secure boot violation into OS missing.

[Giblish]

Hi. 
The basics are:
My HP OMEN 25L (product number 672Y4EA#ABU), BIOS F.39, running Windows 11 25H2, displays “Secure boot violation. Invalid signature detected, check secure boot policy in setup” and a missing OS/boot drive when Secure Boot is enabled. Windows boots normally when Secure Boot is disabled. The PK, KEK, db and dbx variables are readable, and the Windows Boot Manager path is correct. The SSD passed diagnostics done through the HP recovery software accessible by pressing F2 during boot. Further extensive testing showed no issues on the system fast test.

What i did to achieve this ungodly state. 
Attempting to install corsair vengeance LPX (2x8GB) to increase my current RAM volume (2x8GB of Hyper X something something, stock i believe) to 32GB.
Pc didnt boot with all sticks, fine, Removed new sticks, original volume boots. attempted booting with each new stick in turn. Restoring bios defaults allowed the corsair sticks to boot on their own in slots 2&4, enabled XMP profile 1 in bios. all sticks in this configuration failed to boot, and proceeded with a crash/restart loop while XMP profile was disabled.
PC Booted to 32GB of memory at 2133MT/s.
In a moment of stupidity, i tried increasing DRAM frequency to 2400MHz, On start, PC emitted long beeps and a failed post.
Safety removed CMOS battery for about 12 minutes. 
PC cannot boot in secure boot. In secure boot, PC states secure boot violation followed up with a Missing OS/Boot device despite being able to start without secure boot just fine with the original ram at automatic settings in bios.
Updated my BIOS from F.20 to F.39, no change. 
Thinking about attempting to keep the automatic ram settings in bios, reinstalling just the new ram and testing further. 

Any advice? I'm not magical with computers, i pick it up decently fast but i am not a wizard.

[Bill_To]

Greetings @Giblish 

BIOS version F.39 is the latest BIOS update available from HP for your PC's MB.

I'm scratching my head as to why your PC is having a Secure Boot problem when you install Corsair memory.

I don't believe Secure Boot checks system memory firmware.

So it is very unusual to see a Secure Boot violation when simultaneously using HP factory memory and Corsair memory. 

But it is generally not a good idea to mix memory modules from different manufacturers. The results could be unpredictable.

Can you do Secure Boot when only using the HP factory installed memory modules in the correct memory slots?

And do the HP memory modules run at the correct MT/s?

I checked some HP GT15 AMD systems at UserBechmark. The PCs I have looked at seem to be using HP branded Kingston memory.

You might have to check eBay for like/kind HP Kingston memory modules.

Maybe @NonSequitur777 has some thoughts on this unusual situation.

Regards

[Giblish]

Hi Bill

The main reason I'm mixing memory modules is because i couldn’t find my memory online anywhere. Perhaps i should look again but it wont help in the meanwhile. 
The RAM sticks i bought are of very very similar spec, it felt like my best bet at the time. 

I cannot do a secure boot when using the HP factory installed memory and are running at the correct speeds of 3200MT/s.

I did some searching and came across a fix for related issues. I found this: https://h30434.www3.hp.com/t5/Gaming-Desktops/Secure-Boot-Violation-0-FIX/m-p/9700910 

I am unsure at the moment, I dont want to do anything i cannot repair and walk back. 

[Giblish]

Im not sure my prior message went through, 
Re-sending it.

Im struggling to understand it as well. I think my bios no longer recognises the Kingston branded HyperX RAM i originally had causing secure boot from working, cant say for sure however.

I bought the corsair memory as i could not find more of my original memory online, chances are i searched poorly, Either way, I bought the corsair memory because its specifications are very very similar to that of the original.
I cannot do a secure boot with my original memory. When booting without secure boot, My windows 11 installation works just fine and i have no warning signs at all, Task manager tells me i am running at the intended 16GB at 3200MHz.

I did some searching and found a similar issue solved here : https://h30434.www3.hp.com/t5/Gaming-Desktops/Secure-Boot-Violation-0-FIX/m-p/9700910 
I am frankly scared of making any new changes to my bios or device that i cannot reverse. 

[NonSequitur777]

@Giblish,

Welcome to our HP Community forum!

OK, I would be inclined to investigate the memory instability and the Secure Boot failure as two potentially separate problems. There are some relevant reports involving other OMEN 25L systems that make me hesitant to attribute the Secure Boot error directly to your Corsair memory. However, I agree with @Bill_To that mixing different RAM brands/models often causes issues in various OMEN platforms.  If the idea is to increase your RAM to 32GB, I would strongly recommend getting a 2x16GB RAM kit such as the HP-branded Kingston HP37D4U1S8HC-16XR, Kingston KF3200C16D4/16GX, Kingston KF3600C18D4/16GX, or Corsair CMW32GX4M2D3600C18.

1. Establish a stable memory configuration first:

For now, reinstall only the original HP factory-installed 2 × 8 GB memory kit in its original slots. Leave the BIOS at its default settings, with XMP/AMP disabled and no manually configured DRAM frequency.

Once the PC is stable, confirm whether Windows still boots with Secure Boot enabled. This is an important diagnostic step, even though it may not resolve the Secure Boot problem.

I would not attempt another four-DIMM configuration or manually increase the memory frequency until the original configuration is working reliably. Please also provide the exact Corsair part number if you have it.

2. Investigate the Secure Boot certificate configuration:

I found a particularly relevant discussion involving another OMEN 25L GT15-0000a (4Q9S4AV). That owner encountered the same invalid-signature error after changing Secure Boot settings. Updating the BIOS and restoring the factory keys did not resolve it, and HP Support ultimately advised waiting for a new BIOS release.

There is also a related discussion involving an OMEN 25L GT15-0xxx, in which the owner documented similar boot failures and problems applying Microsoft's updated Secure Boot certificates.

Microsoft is transitioning Windows devices from the original 2011 Secure Boot certificates to the 2023 certificates. Outdated certificates or firmware compatibility problems can affect boot validation, so this is worth investigating on your Windows 11 25H2 system. See Microsoft's Secure Boot certificate update guidance.

Since you can boot into Windows with Secure Boot disabled, I suggest collecting the following information before making any further firmware changes.

Open PowerShell as Administrator and run these read-only checks:

Get-ItemProperty `
  'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing' `
  -ErrorAction SilentlyContinue |
  Select-Object UEFICA2023Status, WindowsUEFICA2023Capable

Then check whether the firmware's Secure Boot signature database contains the newer Windows UEFI certificate:

([Text.Encoding]::ASCII.GetString(
  (Get-SecureBootUEFI -Name db).Bytes
)) -match 'Windows UEFI CA 2023'

And check the Key Exchange Key database:

([Text.Encoding]::ASCII.GetString(
  (Get-SecureBootUEFI -Name KEK).Bytes
)) -match 'Microsoft Corporation KEK 2K CA 2023'

These commands inspect the current state; they do not modify the Secure Boot databases. If either command returns False, that is useful diagnostic information, although it does not by itself prove the cause of the boot failure.

I would also check Event Viewer → Windows Logs → System for recent TPM-WMI events, particularly IDs 1795, 1796 and 1801, and record the full message of any event concerning Secure Boot certificate updates.

3. Avoid further Secure Boot key resets for now:

You have already reset the CMOS and updated the BIOS to F.39. I would not repeatedly clear or restore the Secure Boot keys, rebuild the Windows bootloader, or reinstall Windows at this stage. The similar cases above show that these measures do not necessarily resolve this type of failure.

If the diagnostics point to an incomplete certificate transition, check HP's support page for your exact product number and motherboard revision, and ask HP* whether a firmware update or supported certificate-enrollment procedure is available for that specific platform.

The important distinction is that the Corsair modules may explain the original POST and memory-training problems, but the Secure Boot violation needs independent investigation.

Could you post the results of the three PowerShell checks above, together with any relevant TPM-WMI event messages? Those results would help distinguish a certificate or firmware compatibility issue from a problem with the Windows boot component itself.

* How you can contact HP UK:

1. Open HP's online support page HP Customer Support — United Kingdom:

Enter your desktop's serial number and product number 672Y4EA#ABU. Select the OMEN desktop and follow the available contact options. HP's UK contact page provides routes to product support, including chat or telephone where available.

2. Request investigation of the Secure Boot problem:

Ask the support agent to check the BIOS/UEFI firmware for this exact product and, if necessary, escalate the case to the team responsible for system firmware. The OP should have the serial number, BIOS version F.39, the motherboard identifier shown in msinfo32, and the exact error messages available.

Suggested wording for the HP support case:

You could submit this message through the contact form or use it when speaking to an agent:

Subject: OMEN 25L GT15-0000a — Secure Boot violation with BIOS F.39

I have an HP OMEN 25L Gaming Desktop, product number 672Y4EA#ABU, running Windows 11 25H2 with BIOS F.39.

When Secure Boot is enabled, the system displays:

"Secure boot violation. Invalid signature detected, check secure boot policy in setup".

This is followed by a missing OS/boot-device error. Windows boots normally when Secure Boot is disabled. The SSD has passed HP diagnostics, and the Windows Boot Manager entry is present.

I have already restored BIOS defaults, cleared CMOS, and updated the BIOS from F.20 to F.39, without resolving the problem.

Could you please confirm:

1. Whether BIOS F.39 has any known Secure Boot or UEFI boot-validation issues affecting this product and motherboard revision.

2. Whether a newer BIOS, firmware fix, or HP-supported recovery procedure is available for this exact platform.

3. Whether this system supports Microsoft's 2023 Secure Boot certificate updates, including the required KEK and db certificate enrollment, and whether any platform-specific restrictions or known issues exist.

If first-line troubleshooting cannot resolve this, please escalate the case to the appropriate firmware/BIOS technical team.

I do not want to reset or manually replace Secure Boot keys again without a confirmed, platform-specific procedure.

Please provide a support case reference and the recommended next steps.

Kind Regards,

NonSequitur777

[Bill_To · Accepted solution]

@NonSequitur777 

I'm pretty sure this PC has a B550 MB.

I haven't verified the above thought. But I thought there were some B550 MBs on the AMD PC end of development (EOD) List; no future BIOS updates for those PCs. I don't know, maybe those PCs are using B450 MBs or B550A MBs.

The verbiage at the above EOD list site is sort of vague. It states " HP does not intend to release a BIOS update with Trusted Platform Modules (TPM) v3.92.5.5 for these legacy platforms".

I guess legacy would be the key word in the above HP statement.

My question would be: does this apply to any type of BIOS update or is this restricted to only updating the TPM version?

Maybe I'm over thinking this. But words matter.

So I'm wondering if HP is going to do any future BIOS updates for those PCs on the EOD list. Probably not??

And it's possible this PC may have a permanent Secure Boot firmware issue which prevents applying the Windows 2023 security certificates. This would also place the PC into legacy status.

I'm also curious to see if @Giblish could try the Secure Boot workaround available Here to see this helps.

EDIT: I recall someone in this Forum, having a "legacy" PC successfully do the BIOS workaround to fix the Secure Boot problem. But I can't locate the thread.

I agree with you. This workaround would only be attempted using the HP factory memory in a stable state.

It's strange the PC seemed to be fine prior to installing the Corsair memory. Or, at least, this is what one might conclude based upon the information provided in the OP's original post.

Again, I agree with you. I don't see a correlation or causality with memory modules and Secure Boot problems.

Regards

[Giblish]

Hello again bill and  non sequitur. 

Thanks for all the suggestions and advice. I have yet to be able to make much progress on my computer in the past two days. 

Ive been doing some thinking. 

I believe the ram was never the culprit of my bios / secure boot problem.

During my attempts to change the memories frequency while having both Kingston and corsair ram installed, my computer would not boot and make a singular loud beep for about a second, the computer would "restart" (lack of better known terminology)

I then attempted a bios reset in hopes to reset the memory profile. 

It had worked in a sense but this is where the secure boot issue came into play.

Ill do as you both suggest.

I think I will attempt the .efi file recovery workaround to reattain the correct modern certificates. If that doesn't work I will start the HP support ticket.

I'll come back with any findings. 

[Giblish]

Bless you Bill, the work around worked. I now have the correct certificates and secure boot works wonders. 

I am still tempted to test my new ram however, Getting the same model as the pc came with is going to be difficult. It would be far simpler for me to buy more of the corsair ram, Link to where i bought it: https://www.ebay.co.uk/itm/257778085600
... and to sell my original. 

Thank you both for your support, Ill do some more testing, If you dont see another response, everything is hunky dory!

[Bill_To]

Greetings @Giblish 

That's great you were able to successfully do the workaround.

I did not know if the workaround would help.

Yes, you can investigate the memory situation. However, I'm pretty sure you could see the Secure Boot problem again should you ever have to set the BIOS to defaults or reset CMOS.

The EFI factory key problem will exist until HP provides a BIOS update to update the factory keys.

If you want more memory you should consider @NonSequitur777's suggestion.

I now quote NonSequitur777:

"I would strongly recommend getting a 2x16GB RAM kit such as the HP-branded Kingston HP37D4U1S8HC-16XR, Kingston KF3200C16D4/16GX, Kingston KF3600C18D4/16GX, or Corsair CMW32GX4M2D3600C18".

Regards