Event details
HP
I have about 700 systems that are HP G9 and G10s 840 EliteBooks . They have the bios version 1.12.00 and 1.18.00 and they February 2026 date. These systems do not seem to be updating. I see they are under observation more data needed. So on a few In the bios I have checked 3 of the settings in bios - Windows UEFI CA 2023, Microsoft Option ROM UEFI CA 2023, and Microsoft UEFI CA 2023 on a few test systems. On one I had all 4 checked which included the Enable MS UEFI CA key. I put the 5944 in the registry and when I use powershell commands it shows that the 3 certs are updated except for the KEK on all of them. When I put 5944 in the registry it will say in Progress but after a reboot it goes back not started and 0 for available updates . I thought maybe it was the bios so we updated the bios on 1 to 1.18.01 and it still has not updated the KEK. Are they the issue? I know in one of the systems I tested with that had 1.12.00 I was able to get everything updated but that is it.
I am not familiar with the KEK not being updated on HP commercial PCs.
What is the output of these PowerShell commands:
gwmi win32_computersystem | fl model
gwmi win32_bios | fl SMBIOSBIOSVersion
The Secure Boot certificates can be updated by Windows Update (once sufficient data is collected) or by using the 0x5944 registry value and rebooting twice. Windows will append the "Microsoft Corporation KEK 2K CA 2023" to the currently active KEK.
When installing a recent BIOS update, the BIOS will update KEKDefault and DBDefault.
The "Reset Secure Boot keys to factory defaults" BIOS action/setting can be used to copy the defaults to the currently active KEK/DB.
Before using the BIOS action, BitLocker should be suspended to avoid triggering BitLocker recovery being triggered due to a change in the PCR7 BitLocker protector.
After an update to a recent BIOS update, there are BIOS policies (settings) to enable which specific certificates are included in the UEFI DB.
For additional information, see https://support.hp.com/us-en/document/ish_13070353-13070429-16 for the "HP Business PCs - Prepare for new Windows Secure Boot certificates" article. Included are a list of models, a description of each of the related BIOS policies (settings), and other information.
Please update to the latest available BIOS from www.hp.com. If the issue recurs, please contact HP support so that a support case can be opened.