Secure Boot SBAT update fails with TPM-WMI Event ID 1796, error 0x800700c1 on HP OMEN 16-ap0xxx

[ninibond]

Hello,

I need help with a Secure Boot / TPM / Pluton firmware issue on my HP OMEN laptop.

I originally noticed this because Call of Duty / RICOCHET reports that BIOS firmware is “Update Required” or fails the firmware/security attestation check. After digging deeper, I found repeated Secure Boot / TPM related events, especially TPM-WMI Event ID 1796 with error 0x800700c1.

Device details:

• Product: OMEN 16 inch Gaming Laptop PC 16-ap0000 series

• Product/SKU: C57BFEA#ABB

• Baseboard: 8D26

• BIOS: F.13

• BIOS release date: 13/05/2026

• Firmware manufacturer: AMI

• TPM: Microsoft Pluton TPM

• TPM manufacturer/version: MSFT 10.6.0.4

• OS: Windows 11

The TPM and Secure Boot requirements appear to be enabled and healthy:

• Secure Boot is enabled

• TPM is present, ready, enabled, activated and owned

• TPM version is 2.0

• Ready for Attestation: True

• Is Capable for Attestation: True

• TPM Has Vulnerable Firmware: False

• TPM is not locked out

• Windows pre-attestation health checks report the device as “Attestable”

However, Windows repeatedly logs the following error:

Microsoft-Windows-TPM-WMI
Event ID: 1796
Message: The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1.

There is also a repeated Kernel-Boot event:

Microsoft-Windows-Kernel-Boot
Event ID: 247
Message: Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware.

The Secure Boot registry state still shows:

• AvailableUpdates = 0x400

• SBAT UpdateStatus = 0x3

• RebootRequested3POROMDB = 0x1

• UEFICA2023Status = Updated

• ConfidenceLevel = Under Observation - More Data Needed

Event ID 1808 says the device has updated Secure Boot CA/keys and lists:

• Windows UEFI CA 2023 (DB)

• Option ROM CA 2023 (DB)

• 3P UEFI CA 2023 (DB)

• KEK 2023

• Boot Manager (2023)

Steps already tried:

• Updated BIOS to F.13

• Confirmed Secure Boot is enabled

• Confirmed TPM is ready and attestation-capable

• Ran the Microsoft Secure-Boot-Update scheduled task after the retry time

• Rebuilt Windows UEFI boot files using bcdboot

• Checked BitLocker status; protection is off

• Checked disk/EFI partition health; EFI partition is healthy

• HP Diagnostics reports no hardware failure

The Secure-Boot-Update task completes with LastTaskResult: 0, but Event ID 1796 returns every time and SBAT remains pending.

Could HP please confirm whether this model/BIOS version has a known issue with Secure Boot SBAT updates or Pluton-Windows firmware application, and whether a BIOS/firmware update is required?

[gusturney]

Temporarily disable Secure Boot for the Pluton security processor in the BIOS, then re-enable it after restarting and run

sfc /scannow