Keine Aktualisierung - SBAT: HResult Error code: 0x800700c1

[Lumate]

Windows 11 Pro Version 10.0.26200 Build 26200
System Model: HP ProBook 4 G1i 16-inch Notebook AI PC
BIOS Version/Date: HP X72 Ver. 01.04.03, 01.05.2026
Secure Boot State: On
Windows Update: 2026-08 Security Update (KB5121003) (26200.9168).

Error: The Secure Boot update could not update SBAT with the error Unknown HResult Error code: 0x800700c1.

Kernel Boot: Error updating SBAT value in FW.

This error occurs repeatedly when Microsoft offers a security update for download.

[resistencia]

Hi @Lumate 

SBAT(Secure Boot Advanced Targeting)  It is used as a secure boot option for users who run both Windows and Linux on the same computer. If you only have Windows installed, it will not be updated; you must also have Linux installed. This does not affect the certificates emitted by Microsoft in any way.

SBAT It is not installed as a standalone program; it is automatically integrated into the bootmanager ( GRUB) of modern Linux distributions to manage Secure Boot revocation lists.

So when Linux is installed, Windows updates SBAT to incorporate its certificates and configure both operating systems to use Secure Boot (SBAT).

[Lumate]

Hi Resistencia, thanks for your help.

The notebook is only configured with Windows 11. So, no dual-booting. I could install WSL, for example, Debian from Microsoft. I don't know if this type also supports S-Bat.

The UEFI shows the following errors:
Current UEFI DB
X Microsoft Corporation UEFI CA 2011 (revoked: false)
Default UEFI DB
X Microsoft Corporation UEFI CA 2011 (revoked: false)
In total, the UEFI has 3 errors:

2026-06-09 (v1.6.5) [AMD64] : FAIL: 3 failures, 440 successes detected.

Everything is OK on the ZPowerBook—in comparison to the ProBook.

I think HP needs to update the BIOS.

[resistencia]

Check to see if these options are enabled in the BIOS,

2.jpg

[Lumate]

Yes, the (all) BIOS feature "Certificate 2023" is enabled. I've reconfigured the BIOS over the past few days, all to no avail. I'm certain this is clearly an HP issue. Thanks for the input.

[resistencia]

I don't think so. I'd check carefully to make sure I have all the Windows updates. Especially this one:

What is this “Secure Boot Allowed Key Exchange Key (KEK) Update,” and do I actually need to install ...

[Lumate]

Thanks for the advice.

I reconfigured the BIOS. According to my diagnostic tool, it's up to date. (KEK; KEK Cert.; dbx and all certificates.) However, the tool is still reporting the following errors:

2026-06-09 (v1.6.5) [AMD64] : FAIL: 3 failures, 440 successes detected

2026-07-14 [AMD64] : SUCCESS: 291 successes detected

Windows BootMgr SVN : 9.0

Windows CDBoot SVN : 3.0

Windows WDSMgFw SVN : 3.0
I'm still researching why these errors are being logged.

[resistencia · Accepted solution]

I don't understand what this is checking, but all you need is the following command in PowerShell as an administrator; if it returns “True,” everything is fine.

Active DataBase

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

Check default DB

 ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023')

[Lumate]

I ran the two commands you listed in PowerShell.

The result: both are true. Great!

Thank you so much for the tips and support. All the best.

[resistencia]

You're welcome. Please remember that the solution is always marked as the message that provides the solution.