Event details

Have questions about how device manufacturers support the Secure Boot certificate update process? Join OEM Secure Boot Office Hours to connect directly with OEMs and get answers to your questions. Th...
Heather_Poulsen
Updated Jul 15, 2026
Office Hours
epoch71's avatar
epoch71
Copper Contributor
Jul 15, 2026

HP - BIOS upgrades and Bitlocker.

We have 7000+ mostly HP Elitebooks/ZBooks from G7 to current.
With the latest BIOS releases for these models, in our testing when we attempt to force the cert installs (AvailableUpdates 0x5944) we receive a Bitlocker recovery.

If we set the 4 SecureBoot BIOS settings in your article https://support.hp.com/us-en/document/ish_14914515-14914500-16 we get a Bitlocker recovery.

We're struggling to proceed in the face of a potential multi-thousand Bitlocker recovery tsunami.

Any advice would be most welcome.

  • Juergen_Bayer's avatar
    Juergen_Bayer
    Tin Contributor
    Jul 15, 2026

    Hi epoch71​ 

    Ensure that the latest BIOS is installed on your devices. The latest BIOS version is always available as a SoftPaq or through the HP Client Management Script Library (CMSL) command. Windows Update may not provide the latest BIOS version.

    Do not change any of the new 2023 certificate-related BIOS settings. The recommendation published in the article applies to earlier BIOS versions.

    If you follow these steps, you should not see a BitLocker recovery key prompt.

    • epoch71's avatar
      epoch71
      Copper Contributor
      Jul 15, 2026

      Hi.  We are using the latest BIOS, as delivered via HPIA.

      Yet Bitlocker recovery is still triggered (without the cert-related BIOS settings). 

      • E.g. Elitebook 640 G10 BIOS V75 01.12.01 - Bitlocker recovery triggered when enabling certs via AvailableUpdates 0x5944 reg key
      • Yet if we revert to V75 01.11.00 - no Bitlocker recovery triggered.

       

      Reverting BIOS version on 1000s of devices would be incredibly disruptive.