TPM Security Data Change Detected Issue and Sign-In Not Working After BIOS Update

[GQM]

After the latest BIOS update from HP, installed on 6/03/26, my laptop restarts to a screen that tells me "TPM Security Data Change Detected." The options it gives me are:

[Press F1] Clear and reset the TPM
WARNING: This will permanently erase all stored security keys. Windows will likely require you to enter your BitLocker recovery key to unlock the system after reset.

[Press F2] Continue Booting
WARNING: TPM-dependent security features may be affected until the configuration change is completed.

When I press F2, I am brought to the regular sign-in screen. However, where I would usually log in with a PIN, it says "Something happened and your PIN isn't available. Click to set up your PIN again." Clicking that button does nothing, no matter how many times I try. I am able to try the password sign-in option, but every attempt shows as "incorrect" despite me using the password that logs me in to my Microsoft account and passwords I have used on my local account. It's possible there's an older local password I don't remember, but clicking the option to reset it does nothing. I'm also not sure there was even a local password set since I always logged in with my PIN.

Fixes I've Considered:
1)  I don't think my local account was signed in to Microsoft online, but just in case, I've tried resetting my Microsoft password from my account on a separate computer. That change doesn't apply to the laptop sign in (and I do have it connected to the internet). I never created a password reset disk for the laptop, so that's not an option, and web-based sign-in options are not appearing either.

2) I am hesitant to press [F1] in case it asks for a BitLocker code, which I don't have and never knew was a thing before this happened. I've checked my online Microsoft account for one and it's not available. I also never set BitLocker up myself, and when I checked with Microsoft support, they suggested the manufacturer might have set it up. Further research tells me it may have been quietly auto-installed by Microsoft with a Windows 11 update to my originally Windows 10 laptop. If that's the case, I was never given an option to save a key. If it was the manufacturer, though, I bought this laptop a few years ago, and I have no idea how I'm supposed to have one or who I could contact to get one. My warranty is out of date and HP support is behind a paywall, so I can't call and ask.

3) I've seen suggestions to roll back the BIOS update, but I'm not sure if that's something I should attempt myself, get a technician to do, if I can even do it without signing in, or if that should be a last resort. Ideally, I'd like to try signing back in to see if there are additional updates or fixes that would resolve this issue.

4) Microsoft support suggested a clean installation of Windows 11, but even they admitted it might not fix a BIOS/TPM issue and that I should contact the manufacturer about rolling back the firmware update. Without being able to sign in to my laptop or contact HP without a subscription (which I'd rather avoid, given this was an update from HP and not user error), this is the only way I know to request support on that matter.

5) I have considered a factory reset, but I am unsure if that will fix the TPM and sign-in issue, and I'm not sure whether that would be preferred to a Windows clean install. I am hesitant to try either option unless I'm assured the TPM issue will not persist after and that I will not lose any chance of logging back in. If a fresh Windows installation or factory reset will resolve the TPM/BIOS issues without needing a BitLocker code, this may be my most viable path.

If anyone has a fix that will not brick my laptop, I would love to know what my options are starting from the least invasive. All my personal documents are backed up on USB drives and I'm not worried about resetting if it comes to that.

[Pallipurath]

Hi @GQM 

Welcome to the HP Support Community.

Thank you for posting your query.

I understand that after an HP BIOS update, the laptop detected a change in its TPM (security chip), causing Windows to stop recognizing the user's PIN and preventing them from signing in normally. You woul like to know if you reset the TPM because it could trigger BitLocker encryption recovery, and you do not have a BitLocker recovery key. 

We would not recommend clearing the TPM until all available recovery options have been explored and the BitLocker status has been verified. We suggest first attempting Windows Recovery Environment options such as Startup Repair, System Restore (if available), or BIOS Recovery/Rollback procedures supported by your HP model.

Since the PIN is unavailable and password authentication is not being accepted, the issue may involve the Windows security credentials stored in the TPM rather than a hardware failure. If recovery options do not restore access, a Windows reset or clean installation may be required.

Try Startup Repair

• Select Startup Repair.
• Let Windows check for login and boot issues.
• Reboot and test.

Attempt HP BIOS Recovery

Many HP laptops support BIOS rollback:

1. Shut down completely.
2. Hold Windows + B.
3. Press and hold Power for 2–3 seconds.
4. Release Power but keep holding Windows + B.
5. If the HP BIOS Recovery screen appears, choose recovery/rollback.

Check BIOS Settings

Press F10 during startup:

• Ensure TPM is Enabled.
• Load BIOS defaults if available.
• Save and exit.
• Do not choose "Clear TPM."

Last resort: Reset or reinstall Windows

If your files are already backed up:

• Use Reset this PC from Windows Recovery.
• If that fails, perform a clean Windows installation from a USB installer.

In order to know how to find the Bitlocker Recovery key I would request you to follow the link https://support.hp.com/us-en/document/ish_6600231-6600360-16 

Take care and have an amazing day!

[GQM]

Hi, thank you for your reply! I have attempted a few of these options and this is where I am at. If you could advise on any last steps to try within each of these options before I move on to the last resort, I would appreciate it. While I'm prepared to do a clean install, it would be nice to keep my apps and programs intact if at all possible.

Try Startup Repair

• Startup Repair was not available in my Windows recovery environment (I clicked through all options throughout multiple restarts to be sure).
• I attempted suggested command prompts from another thread to force it to launch, clear corrupted files, or try to recover it. The commands went through successfully and it said corrupted files were cleared; however, there was still no Startup Repair option and the sign-in issues remained the same upon restart.
• The only options I didn't try were System Restore or Windows reset, as I wasn't sure if those were advisable with my issue.
• Would it be advisable to force an Automatic Repair in the absence of Startup Repair, or would that be too risky? Do these perform similar functions?

Attempt HP BIOS Recovery

• I followed the instructions and was met with a screen that said it was finishing BIOS updates. I let it complete and return me to the TPM question, then the sign-in screen, but nothing had changed. There was no option to click anything on the BIOS screen or attempt a rollback.
• I have not attempted it a second time to see if a rollback was an option while not actively updating. I've been cautious of trying anything with the BIOS too many times without proper advisement.

Check BIOS Settings

• My TPM is Enabled.
• TPM Clear is set to no.
• Before trying this option, I wanted to confirm that the suggestion is to load BIOS defaults where the TPM options are? "Restore the Factory Defaults" under the Security Tab?
• Should I do anything with the Factory Default Keys under the Boot Options Settings?
• If these are not the right options, what defaults should I reset?
• Will resetting likely have any short or long-term adverse affects on my device, given I have upgraded to Windows 11 since the factory defaults?

Last resort: Reset or reinstall Windows

Before I move on to the last resort:

• Would a System Restore or the Reset that allows me to keep my files be advisable to try before moving on to a Windows clean install? I want to exhaust every option I can before wiping everything, but not at the risk of bricking my device if these options are not recommended for any reason.
  

Thank you in advance!

[Pallipurath]

Hi @GQM,

Thank you for the detailed update and for carefully working through the troubleshooting steps. I appreciate the thorough information you've provided, as it helps narrow down the available recovery options before considering a clean installation.

Based on what you've described, the TPM remains enabled and has not been cleared, which is the correct approach at this stage since clearing the TPM could potentially trigger BitLocker recovery and may result in data access issues if the recovery key is unavailable.

Regarding your questions:

1.Startup Repair / Automatic Repair
Since Startup Repair is not appearing within the Windows Recovery Environment, forcing Automatic Repair is generally safe to try. Automatic Repair and Startup Repair perform similar functions, focusing on detecting and correcting boot-related issues. While it is unlikely to resolve TPM-related credential problems.

2.HP BIOS Recovery
The behaviour you observed suggests the system completed a BIOS recovery verification. We would not recommend repeatedly performing BIOS recovery unless there is need of BIOS corruption .  

3.BIOS Settings
You may load BIOS default settings using the "Restore Factory Defaults" or "Load Setup Defaults" option available in BIOS. This action typically resets BIOS configuration settings but does not remove Windows 11 or revert the operating system.

Before saving changes, please verify that:

• TPM remains Enabled.
• TPM Clear remains Disabled/No.
• Secure Boot remains Enabled (if previously enabled).

We do not recommend resetting or modifying the Factory Default Keys under Boot Options unless specifically instructed, as those settings are related to Secure Boot certificates and are generally not associated with this type of sign-in issue.

4.System Restore
If a restore point exists from before the BIOS update or before the sign-in issue occurred, System Restore would be one of the preferred next steps. System Restore can revert system files, drivers, and configuration changes without affecting your personal files. 

5.Reset This PC (Keep My Files/ensure the data is backedup before initiating the system reset)
If System Restore is unavailable or unsuccessful, "Reset this PC" with the "Keep my files" option would be a reasonable step before performing a clean installation. While installed applications and programs will need to be reinstalled afterward, your personal files are preserved. This option is less destructive than a full clean installation and may resolve Windows credential and TPM-related configuration issues.

At this stage, we still recommend avoiding TPM Clear until all recovery options have been exhausted and BitLocker status has been confirmed. If you are able to access the BitLocker recovery key, please keep it available before making any TPM-related changes.

I hope this helps.

[GQM]

Thank you for the swift response! I will work through these steps to see if one works.

I used Command Prompt to verify BitLocker status. It says it is currently disabled/unlocked/fully decrypted and there are no recovery keys to be found. Does this mean it would be safe to clear the TPM on the first screen that appears before sign-in, or should I clear it elsewhere? Would clearing the TPM cause more issues even with BitLocker seemingly not enabled? Is it possible for BitLocker to auto-enable if I do this?

Upon reading further into this, it looks like clearing the TPM would require me to reset my PIN, possibly with a password that is currently unusable or at least not remembered. In that case, would clearing the TPM also reset any password issues, or should this be a final thing to try before a clean reinstall?

I System Restored to a point before the drivers were installed. Unfortunately, it did not change the sign-in issue or the TPM message. I haven't attempted resetting the BIOS to default yet, because I wanted to check whether discovering BitLocker was off changed things and I should proceed with clearing the TPM instead. If so, would you advise I System Restore the drivers back to their updated state before clearing and continuing?

In case this is relevant to troubleshooting, I also used Command Prompt /net user to check on the user accounts. It returned "This command completed with one or more errors" and showed all the defaults like Admin/Default/Guest, but my personal account is no longer listed even though it appears at sign-in (unless it is simply "Default Account" and does not use my username). Could the BIOS update/TPM issue have somehow corrupted my user account beyond sign-in issues? If so, what's a good course of action from here?

Thank you!

[Pallipurath]

Hi @GQM 

Thank you for responding.

I understand your concern regarding the TPM clear option and appreciate the detailed information you have shared. Since BitLocker is reported as disabled and no recovery keys are present, clearing the TPM should not affect BitLocker encryption. However, please note that clearing the TPM will reset all TPM‑stored credentials, including PINs and Windows Hello data. This action will not reset or bypass your account password, and if the password is currently unusable, you may still face sign‑in challenges afterward.

For this reason, we recommend treating TPM clear as a last step only after confirming that your account password is accessible or reset through Microsoft’s recovery options. Clearing the TPM does not automatically enable BitLocker, but it will require you to reconfigure PIN or Windows Hello sign‑in.

At this stage, the safest path forward is to:

Ensure you have a working account password before attempting TPM clear.

Use Microsoft’s password recovery tools if needed.

Consider reinstalling Windows only if TPM clear does not restore normal sign‑in.

If you prefer to avoid TPM clear, a clean reinstall remains the most reliable way to reset sign‑in methods and restore system stability.

Have a good day.

[GQM · Accepted solution]

I ended up going with a clean installation of Windows 11  after every other method failed to fix the issue

Thank you for all your help!