After Automated BIOS Update - Stuck in BIOS Secure Boot Authentication Loop

[Yeah-k]

Edited for grammar.

So Windows 11 pushed down an automated BIOS update which was a first for me.

After, I was getting an error telling me that I had to re-enable Secure Start and so I made the huge mistake of checking that checkbox and now my Laptop is stuck in an endless loop of asking me for a four digit number to authorize the BIOS change (which I provide) and where it then reboots and repeats that process endlessly.

There is no escape. 

After the 10th time, I figured this wasn't normal and started trying to actual get back into BIOS.  Ahem... This is where I realized something was very much awry.

None of the Window + V, Windows + B,  F10, Esc tricks work.  It was also set to power up on AC so, of course the second I put the power to it, it starts up on its own.  I mention this in case someone wants to suggest those hold the power button for 2 seconds, 3 seconds, 15 seconds, etc... tricks.. they don't work either.  Note that I get no beeps, that option was also previously disabled in BIOS.

If I could ever actually get to a BIOS menu, that would be huge; but no.  While I do manage to see "Entering BIOS" flash up on the background in every attempt after I enter the code (and just before the entire system goes dark), it never actually goes there, it just reboots and brings up that Secure boot change authorization screen again... endlessly.  I should mention my BIOS is protected with a password... because at some point in the past it told me that I had to do that to make a change, so I chose "password", I only mention because I know someone will ask about it being password protected.

In desperation, I pulled the power, removed the battery, did the 30-second power button thing, pulled the entire motherboard out, removed the CMOS battery (I can't believe you guys buried it under there), left it out for an hour, put it all back together and ... yeah, for some reason not even all that broke the spell.  I was pretty shocked.  I figured for sure it would return to factory defaults to where I could at least get into the BIOS.  Nope.

I'm all ears here guys.  How did this latest BIOS update that Windows itself pushed down to me so badly screw me over to where I can't do anything, including just getting back into the BIOS itself (or even abort to boot from USB or find the BIOS Recovery USB either)  I need this Xeon Workstation back in action.

Does this thing need to go to an HP Shop where an EEPROM flasher solves this problem and if so, how do I arrange that?

[Kuroi_Kenshi]

Hi @Yeah-k,

Welcome to the HP Support Community! We're stoked to have you on board! 

To help us get started on resolving your issue, could you please share the model name of your device?

Need help finding your product number? We've got you covered! Check out this handy guide:  

https://support.hp.com/in-en/document/ish_2039298-1862169-16 

We're looking forward to helping you get back up and running! 

Best regards,

Kuroi_Kenshi

[Yeah-k]

Sorry, It asked for that in advance, I figured it posted the exact system info here.  Sadly, no.

Zbook 15 G6 Xeon with A2000.
Product ID: 8ZS74US#ABA

I should note that with internal battery and CMOS battery removed, I have tried every other trick to clear the secure boot state.  No luck.

When I drain everything and connect AC Power, it lights up from autostart.

On the first boot, it goes through a fairly quick cycle before auto rebooting.

I then get caps lock flash 5 times before it auto reboots again.  

I then get caps lock flash 5 times again before it returns to the Secure Boot authorize changes screen prompting me for the latest 4 digit code (the loop).

USB stick has been tried in all TYPE-A Ports, but the one near the power cord (right side) seems to be the fastest to respond; but still not fast enough..  Stick is USB2, 4GB, FAT32, MBR, 4096 allocation size.

BIOS was selected based on assumed criteria:  Windows 11 / Windows 11 (Target System; as the latest Windows Version is not listed on the list of versions) which is what the system WAS running when this happened.

Downloaded R92_01.35.02 Rev.A File "Run as Admin" from a Windows 10 working PC (to force Auto-Run of USB BIOS Recovery Tool after files extract to the default C:\SWSetusp173016\ folder.  R92_013502.bin is what we were working with.  After Recovery Tool completes, blank flash drive includes the following:

\                                                   (empty)
\HP                                             (empty)
\HP\BIOS\                               (empty)
\HP\BIOS\Current\             (empty)
\HP\BIOS\New\                    (empty)

\HP\BIOS\Previous\           (empty)

\HP\BiosUpdate\                 (empty)

\HP\DEVFW\firmware.bin 

Despite having this USB BIOS Recovery, I can't get it to initialize because of the present condition of being stuck in a hard failure of the firmware trust store subsystem as the loop under a corrupt HP Sure Start enforcement isn't allowing anything.  

After RTC battery removal and drain, I get auto boot when applying any power then this sequence unfolds:

• 2-blink → early BIOS integrity failure detected - Reboots
• 5-blink → recovery attempt aborts before execution - Reboots & Repeats Again
• Secure Boot screen appears → UEFI partially functional.  Fans kick up gradually waiting for the 4-digit code entry.
• Upon input and pressing "Enter" an "instant" reboot occurs → NVRAM write path is broken
• USB BIOS Recovery does not begin initialization until after the 3rd reboot; just before Secure Boot screen comes up, and then it “initializes forever” → USB BIOS Recovery boot chain never reaches execution stage.

This is the loop.  After attempting every documented path to escape to BIOS, escape the loop to recovery USB and to reset to defaults by power discharge, I always end up back at the Secure Boot screen prompting for a new 4 digit code and to hit the Enter key.

I think the fact that the Microsoft 2023 Certificates looked to be missing (the only message I saw after the very first reboot), as well as Secure Start hosing because it can't apply whatever the heck it is trying to apply has me trapped in a place that is unrecoverable without EEPROM intervention, or some other "HP Official Depot" repair where Factory Tools can restore .  It seems crazy that an update I didn't ask for that changed things all by itself is creating all this grief; but here we are.

How do I go about getting this to an HP Depot for reprogramming?  

[Yeah-k]

I've been forced to create a ticket for Depot Repair. 

When someone decides to form a Class Action Lawsuit over this, I will be signing up; because this Commercial Laptop is out of Warranty and re-flashing the EEPROM is required to clear the Secure Boot/HP Sure Start NVRAM issues and as a result, is now going to end up costing me money, for absolutely no reason. 

Case Number: 5161756782v

Customer Service Order #BXND6511-01

I'm not pleased about how this BIOS Update was pushed forcibly via Windows Update, nor how these Certificate changes (missing no less) and Security Settings rolled out, and this will certainly impact my future purchasing decisions.  If you break it, you should be responsible for fixing it.  Having issues with your procedures and validations (clearly not validated) in how these BIOS updates were pushed, incorporated and implemented shouldn't have ever become something that causes unrecoverable down-time, nor should consumers be told that the only avenue of repair is Depot Service at consumer's expense.  If that is the only solution, HP should be eating the cost.