Windows 11 doesn’t recognize secure boot on

[ImPlantinAtA]

I recently updated my BiOS from F21 to F24 because I was getting a failed attestation for trying to play call of duty. After updating to F24, now windows 11 will not recognize secure boot is on even though it shows to be on in the BIOS. I tried to roll back to F21 or F23, but it will not let me. Any help is appreciated.

[NonSequitur777]

@ImPlantinAtA,

Welcome to our HP Community forum!

OK, there are two (2) separate issues here:

1. Secure Boot is enabled in the BIOS.
2. Windows reports Secure Boot as disabled (or games such as Call of Duty fail the attestation check).

A BIOS update alone does not always restore the Secure Boot trust chain, so let's first verify exactly where the problem lies.

1. Verify what Windows reports:

Press Win + R, type: msinfo32

and check these entries:

• BIOS Mode: UEFI
• Secure Boot State: On or Off

Then open PowerShell (as Administrator) and run:

Confirm-SecureBootUEFI

• True = Windows recognizes Secure Boot.
• False = Windows does not.
• An error usually means Windows is not booted in UEFI mode.

2. Verify Secure Boot keys:

Access BIOS and check whether:

• Legacy Support is Disabled
• Secure Boot is Enabled
• Factory Default Keys (or Restore Security Keys) have been loaded.

If you have not already done so, restore the factory Secure Boot keys, save the changes, power the PC completely off, then restart.

3. Check whether the EFI boot files are intact:

Open an elevated Command Prompt and run: mountvol S: /S

followed by: dir S:\EFI\Microsoft\Boot

If the Microsoft boot files are missing or appear corrupted, they can usually be rebuilt.

4. Rebuild the EFI boot files (if necessary):

From an elevated Command Prompt: bcdboot C:\Windows /s S: /f UEFI

You should receive:

Boot files successfully created.

Afterward, reboot and check msinfo32 again.

5. If Secure Boot still reports Off:

Please let me know:

• Does msinfo32 show BIOS Mode = UEFI?

• What is the exact output of: Confirm-SecureBootUEFI

• What motherboard SSID does your system have (shown in BIOS or HP System Information)?
• Is the TPM shown as Ready in Windows Security?

Those details will help determine whether this is a Windows boot configuration issue or a BIOS firmware issue.

One additional question:

Did Windows report Secure Boot as "On" before you updated from BIOS F.21 to F.24, or did you update specifically because Call of Duty reported an attestation failure?

That distinction is important, because if Secure Boot was already being reported correctly before the update, the BIOS update itself may have altered the Secure Boot database or exposed a firmware issue. If Secure Boot was already being reported as Off before the update, the underlying problem may instead be the Windows EFI boot configuration rather than BIOS F.24 itself.

Hopefully, we'll be able to narrow it down from there.

And yes, there are a number of HP PC platforms with TPM/Attestation issues when it comes to playing certain games.  HP is aware of it, and they will either provide a BIOS update, or they will not, such as these platforms which HP specifically listed: HP AMD platforms with ASP fTPM - TPM Attestation failure | HP® Support.

Kind Regards,

NonSequitur777