Event details
HP
I have about 700 systems that are HP G9 and G10s 840 EliteBooks . They have the bios version 1.12.00 and 1.18.00 and they February 2026 date. These systems do not seem to be updating. I see they are under observation more data needed. So on a few In the bios I have checked 3 of the settings in bios - Windows UEFI CA 2023, Microsoft Option ROM UEFI CA 2023, and Microsoft UEFI CA 2023 on a few test systems. On one I had all 4 checked which included the Enable MS UEFI CA key. I put the 5944 in the registry and when I use powershell commands it shows that the 3 certs are updated except for the KEK on all of them. When I put 5944 in the registry it will say in Progress but after a reboot it goes back not started and 0 for available updates . I thought maybe it was the bios so we updated the bios on 1 to 1.18.01 and it still has not updated the KEK. Are they the issue? I know in one of the systems I tested with that had 1.12.00 I was able to get everything updated but that is it.
Latest BIOS version for 840 G9 is 1.18.01 and for 840 G10 is 01.12.01. We strongly recommend updating the BIOS to the latest version available. As mentioned, with the latest BIOS versions there are new BIOS settings which allow the BIOS taking control of these new 2023 Secure Boot certificates. Best practice is to leave these new BIOS settings untouched and let first Windows Update add the 2023 certificates to the Secure Boot databases. MS UEFI CA key is related to the 2011 3rd party certificate and if enabled, Microsoft Update process will add the two 2023 3rd party certificates to the db database. If the 2023 KEK certificates is not added, you can try putting 0x4 in the registry which explicitly updates the KEK although 0x5944 should have taken care of the KEK update.