Re: Windows 11 doesn’t recognize secure boot on - HP Support Community

ImPlantinAtA · ‎08-05-2026

I recently updated my BiOS from F21 to F24 because I was getting a failed attestation for trying to play call of duty. After updating to F24, now windows 11 will not recognize secure boot is on even though it shows to be on in the BIOS. I tried to roll back to F21 or F23, but it will not let me. Any help is appreciated.

NonSequitur777 · ‎08-05-2026

@ImPlantinAtA,

Welcome to our HP Community forum!

OK, there are two (2) separate issues here:

Secure Boot is enabled in the BIOS.
Windows reports Secure Boot as disabled (or games such as Call of Duty fail the attestation check).

A BIOS update alone does not always restore the Secure Boot trust chain, so let's first verify exactly where the problem lies.

1. Verify what Windows reports:

Press Win + R, type: msinfo32

and check these entries:

BIOS Mode: UEFI
Secure Boot State: On or Off

Then open PowerShell (as Administrator) and run:

Confirm-SecureBootUEFI

True = Windows recognizes Secure Boot.
False = Windows does not.
An error usually means Windows is not booted in UEFI mode.

2. Verify Secure Boot keys:

Access BIOS and check whether:

Legacy Support is Disabled
Secure Boot is Enabled
Factory Default Keys (or Restore Security Keys) have been loaded.

If you have not already done so, restore the factory Secure Boot keys, save the changes, power the PC completely off, then restart.

3. Check whether the EFI boot files are intact:

Open an elevated Command Prompt and run: mountvol S: /S

followed by: dir S:\EFI\Microsoft\Boot

If the Microsoft boot files are missing or appear corrupted, they can usually be rebuilt.

4. Rebuild the EFI boot files (if necessary):

From an elevated Command Prompt: bcdboot C:\Windows /s S: /f UEFI

You should receive:

Boot files successfully created.

Afterward, reboot and check msinfo32 again.

5. If Secure Boot still reports Off:

Please let me know:

Does msinfo32 show BIOS Mode = UEFI?
What is the exact output of: Confirm-SecureBootUEFI
What motherboard SSID does your system have (shown in BIOS or HP System Information)?
Is the TPM shown as Ready in Windows Security?

Those details will help determine whether this is a Windows boot configuration issue or a BIOS firmware issue.

One additional question:

Did Windows report Secure Boot as "On" before you updated from BIOS F.21 to F.24, or did you update specifically because Call of Duty reported an attestation failure?

That distinction is important, because if Secure Boot was already being reported correctly before the update, the BIOS update itself may have altered the Secure Boot database or exposed a firmware issue. If Secure Boot was already being reported as Off before the update, the underlying problem may instead be the Windows EFI boot configuration rather than BIOS F.24 itself.

Hopefully, we'll be able to narrow it down from there.

And yes, there are a number of HP PC platforms with TPM/Attestation issues when it comes to playing certain games. HP is aware of it, and they will either provide a BIOS update, or they will not, such as these platforms which HP specifically listed: HP AMD platforms with ASP fTPM - TPM Attestation failure | HP® Support.

Kind Regards,

NonSequitur777

ImPlantinAtA · ‎09-05-2026

https://h30434.www3.hp.com/t5/user/viewprofilepage/user-id/4187452

@NonSequitur777

thank you for the reply. yes the secure boot was on during the F.21 version. And yes I only updated from F21 to F24 because of failed attestation for Call of Duty. I checked msinfo. it shows off on secure boot. I also did the command prompt, it showed false. I tried to clear the BIOS boot keys but the button was not clickable. I then chose to Load the default boot keys. saved and turned off system and turned back on. Secure boot is still off in msinfo. I tried to do the elevated command prompts you suggested. this is where my limited expertise gets lost. i just did a copy and paste of my cmd to show you what is says. Let me know what i am doing wrong or what the next steps are. Thank you again.

MSINFO32 Information:

BIOS Version/Date AMI F.24, 10/8/2025

SMBIOS Version 3.3

Embedded Controller Version 76.26

BIOS Mode UEFI

BaseBoard Manufacturer HP

BaseBoard Product 8876

BaseBoard Version 11

Secure Boot State Off

C:\Windows\System32>mountvol S: /S

C:\Windows\System32>mountS:/S
'mountS:' is not recognized as an internal or external command,
operable program or batch file.

C:\Windows\System32>mountvolS:/S
'mountvolS:' is not recognized as an internal or external command,
operable program or batch file.

C:\Windows\System32>mountvol S:/S
Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E
MOUNTVOL drive: /S

path Specifies the existing NTFS directory where the mount
point will reside.
VolumeName Specifies the volume name that is the target of the mount
point.
/D Removes the volume mount point from the specified directory.
/L Lists the mounted volume name for the specified directory.
/P Removes the volume mount point from the specified directory,
dismounts the volume, and makes the volume not mountable.
You can make the volume mountable again by creating a volume
mount point.
/R Removes volume mount point directories and registry settings
for volumes that are no longer in the system.
/N Disables automatic mounting of new volumes.
/E Re-enables automatic mounting of new volumes.
/S Mount the EFI System Partition on the given drive.

Possible values for VolumeName along with current mount points are:

\\?\Volume{55e1aae6-e59b-4041-85b5-4e6b7f301722}\
C:\

\\?\Volume{29364b9f-5088-45f1-a334-e81ca46ae583}\
*** NO MOUNT POINTS ***

\\?\Volume{4c8b4d0f-87e1-11f1-a60b-7412b35fb81e}\
D:\

\\?\Volume{9747a900-0000-0000-0000-10d007000000}\
E:\

\\?\Volume{08bbd3e2-b7e8-4303-ad1a-5e883d6e1f0a}\
*** NO MOUNT POINTS ***

The EFI System Partition is mounted at S:\

C:\Windows\System32>bcdboot C:\Windows /sS:/fuefi

Bcdboot - Bcd boot file creation and repair tool.

The bcdboot.exe command-line tool is used to copy critical boot files to the
system partition and to create a new system BCD store.

bcdboot <source> [/l <locale>] [/s <volume-letter> [/f <firmware>]] [/v]
[/vbcd] [/m [{OS Loader ID}]] [/addlast] [/p] [/c]
[/nofirmwaresync] [/description <description>]

source Specifies the location of the windows system root.

/l Specifies an optional locale parameter to use when
initializing the BCD store. The default is US English.

/s Specifies an optional volume letter parameter to designate
the target system partition where boot environment files are
copied. The default is the system partition identified by
the firmware.

/v Enables verbose mode.

/vbcd Enables BCD logging.

/m If an OS loader GUID is provided, this option merges the
given loader object with the system template to produce a
bootable entry. Otherwise, only global objects are merged.

/d Specifies that the existing default windows boot entry
should be preserved.

/f Used with the /s command, specifies the firmware type of the
target system partition. Options for <firmware> are 'UEFI',
'BIOS', or 'ALL'.

/t Used with the /s and /f commands, specifies a target directory
under the system partition where the boot environment files
are to be copied. By default, the boot environment files are
copied to the root of the target system partition.

/addlast Specifies that the windows boot manager firmware entry
should be added last. The default behavior is to add it
first.

/nofirmwaresync Disable synchronization with firmware.

/bcdclean Clean the BCD Store. By default, simply removes any duplicate
entries in the BCD. Can be followed by 'full'. In this case,
each entry is scanned. If the corresponding device for that entry
does not exist, the entry is deleted.

/p Specifies that the windows boot manager firmware entry
position should be preserved. If entry does not exist,
new entry will be added in the first position.

/c Specifies that any existing objects described by the template
should not be migrated.

/imageroot Specifies an image root under from the boot files originate. The bcd store of this
image needs to be constructed with paths relative to the root of the image.

/bootex Use the bootex binaries for servicing if necessary conditions are met.

/offline Forces boot file servicing to be handled in an offline manner. Boot
file selection is forced based on presence of 'bootex' switch.

Examples: bcdboot c:\windows /l en-us
bcdboot c:\windows /s h:
bcdboot c:\windows /s h: /f UEFI
bcdboot c:\windows /s h: /f UEFI /t Configuration\Boot
bcdboot c:\windows /m {d58d10c6-df53-11dc-878f-00064f4f4e08}
bcdboot c:\windows /d /addlast
bcdboot c:\windows /p
bcdboot C:\Images\ImageRoot\Files\Windows /f UEFI /imageroot C:\Images\ImageRoot\Files

C:\Windows\System32> bcdboot c:\windows /s h: /f UEFI /t Configuration\Boot
Failure when initializing library system volume.