Secure Boot Certificate update downloaded but does not install

[Waldorfer99]

Hi,

We are seeing an issue on HP devices where the new Microsoft Secure Boot certificate/DBX update is downloaded but never applied to firmware.

Current status:

• Secure Boot enabled
• TPM enabled and functional
• Windows Update downloads the Secure Boot update
• Event Viewer shows:
  • TPM-WMI Event ID 1801:
    “Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware”
  • TPM Event ID 17:
    “The Trusted Platform Module (TPM) hardware failed to execute a TPM command”
• DBX update remains pending after multiple reboots

Device details:

• HP platform
• BIOS family: V70
• BIOS version: 01.11.00 Rev.A
• Baseboard: 8B41
• Windows 11 24H2
• BitLocker suspended during BIOS update/testing

Interesting observation:

• HP previously had a newer BIOS release available, but it was later withdrawn.
• Current BIOS package still uses version 01.11.00 Rev.A but appears to contain updated firmware components.

We have verified:

• No “blocked” or “not applicable” messages in Windows Update logs
• Secure Boot update task is executed
• TPM maintenance tasks are executed
• DBX still not applied

Has anyone else seen this on HP systems, specifically V70/8B41 platforms?
Did anyone find a workaround or receive guidance from HP/Microsoft?

Thanks.

[Kuroi_Kenshi]

Hi @Waldorfer99,

Welcome to the HP Support Community! We're stoked to have you on board! 

To help us get started on resolving your issue, could you please share the model name of your device?

Need help finding your product number? We've got you covered! Check out this handy guide:  

https://support.hp.com/in-en/document/ish_2039298-1862169-16 

We're looking forward to helping you get back up and running! 

Best regards,

Kuroi_Kenshi

[Waldorfer99]

Hi, 

Sorry, I forgot to mention that. 
I have a HP EliteBook 1040 G10 Notebook

Thanks for any help