Secure Boot Violation + 3F0 boot errors after CMOS reset (HP Omen) - survived full Windows reinstall

[Kai2731]

Model: HP Omen 25L Gaming PC
OS: Windows 10 or 11

Hi all, hoping someone can help with a firmware-level issue that's survived a full Windows reinstall.

i had claude help me write this so im sure thats why it looks like it does but i could REALLY use this help anything at all would be really really appreciated I cant lose my PC 😅😢

CURRENT STATE:
- With Secure Boot Enabled: alternates between two boot-blocking errors:
- "Secure Boot Violation - Invalid Signature Detected - check Secure Boot policy in setup"
- Error 3F0 "No boot device found. Please install an operating system on your hard disk" (even though Windows Boot Manager is confirmed present and set first in Boot Order)
- With Secure Boot Disabled: boots to the Windows lock screen, but sign-in is broken with: "Your PIN is no longer available due to a change in security settings on this device." No alternate sign-in options appear on that screen.
- Currently running with Secure Boot Disabled (keys untouched, not cleared) so the machine can at least boot to the lock screen.

HOW THIS STARTED:
The CMOS battery appears to have died/reset (date reverted to 1/1/2021 on next boot after an unrelated reinstall attempt). After that CMOS reset, Secure Boot started throwing the Invalid Signature error. I tried "Restore to Factory Defaults" under Security > System Security in BIOS, which required an on-screen confirmation code - this did not resolve the Secure Boot violation.

WHAT I'VE ALREADY TRIED:
- Disabling Secure Boot entirely (lets it boot to lock screen, but PIN sign-in is broken - TPM trust mismatch, presumably from the Secure Boot state change)
- BitLocker recovery key was required at one point and was entered successfully - confirms the drive/data itself is fine
- Full "Reset this PC - Keep my files, Local reinstall" - completed successfully, but the exact same PIN error and a WiFi-icon freeze (clicking the WiFi icon locks up the whole system except the mouse) persisted afterward
- Re-enabling Secure Boot as a test just brings back the boot-blocking errors again

Since a full OS reinstall didn't fix it, I believe this is a Secure Boot certificate/TPM trust state issue at the firmware level, not a Windows problem. My warranty is expired, so I'm hoping to find a BIOS/firmware-level fix (or confirmation that a BIOS update/reflash is the right move) before paying for phone support.

Any guidance appreciated - happy to provide more details/screenshots if helpful.

[haythamkha]

Hi,

I understand the frustration, but I would separate this into two issues:

1. The Secure Boot / 3F0 boot problem.
2. The Windows PIN problem after changing Secure Boot/TPM-related state.

The CMOS reset is an important clue. If the date/time reverted to 1/1/2021, I would replace the CMOS battery first, then enter BIOS, set the correct date/time, load BIOS defaults, save, and reboot. An unstable CMOS state can cause repeated firmware/boot configuration problems.

After that, in BIOS I would check:

• Windows Boot Manager is first in the UEFI boot order.
• Legacy/CSM boot is disabled, if present.
• Secure Boot factory/default keys are restored.
• The system date and time remain correct after unplugging power.

I would not clear the TPM or Secure Boot keys casually, especially since BitLocker has already been triggered. Make sure the BitLocker recovery key and important data are backed up before doing anything TPM-related.

For the PIN message, that is commonly seen after security state changes. If available, try signing in with the Microsoft account password instead of the PIN, then reset the PIN from Windows sign-in options. If no password option appears, that may need Microsoft account/Windows recovery steps.

One note: “Reset this PC – Keep my files” is not the same as a full clean install. It may preserve some profile/security state, so it does not completely rule out a Windows-side issue.

If Secure Boot still gives “Invalid Signature Detected” after replacing the CMOS battery, setting the correct date/time, restoring Secure Boot factory keys, and confirming Windows Boot Manager, then I would update or reflash the BIOS using only the official HP BIOS package for the exact OMEN 25L product number.

At that point I would report it to HP as a Secure Boot / firmware boot issue and provide:

• Exact OMEN 25L product number
• Current BIOS version
• Whether CMOS battery was replaced
• BIOS date/time retention result
• Secure Boot state
• Windows Boot Manager status
• BitLocker recovery history
• Photos of both Secure Boot violation and 3F0 messages

In short, I would start with the CMOS battery and BIOS/Secure Boot defaults first. Then fix the Windows PIN issue separately. I would avoid TPM clearing or random Secure Boot key changes unless data is backed up and HP/Microsoft recovery steps are confirmed.

[Kai2731]

Thanks so much for the reply! Just a quick question before I do anything, you want me to fully replace the CMOS battery? I just want to make sure im not getting a new one when you meant resetting it or anything. Also, would I save time and money by just doing a full wipe of my PC? Because honestly I dont have many important documents on here and would be fine doing that if it meant I could quickly get back to work! Again, thanks.