Event details

Have questions about how device manufacturers support the Secure Boot certificate update process? Join OEM Secure Boot Office Hours to connect directly with OEMs and get answers to your questions. Th...
Heather_Poulsen
Updated Jul 15, 2026
Office Hours
Juergen_Bayer's avatar
Juergen_Bayer
Tin Contributor
Jul 15, 2026

Hi epoch71​ 

Ensure that the latest BIOS is installed on your devices. The latest BIOS version is always available as a SoftPaq or through the HP Client Management Script Library (CMSL) command. Windows Update may not provide the latest BIOS version.

Do not change any of the new 2023 certificate-related BIOS settings. The recommendation published in the article applies to earlier BIOS versions.

If you follow these steps, you should not see a BitLocker recovery key prompt.

epoch71's avatar
epoch71
Copper Contributor
Jul 15, 2026

Hi.  We are using the latest BIOS, as delivered via HPIA.

Yet Bitlocker recovery is still triggered (without the cert-related BIOS settings). 

  • E.g. Elitebook 640 G10 BIOS V75 01.12.01 - Bitlocker recovery triggered when enabling certs via AvailableUpdates 0x5944 reg key
  • Yet if we revert to V75 01.11.00 - no Bitlocker recovery triggered.

 

Reverting BIOS version on 1000s of devices would be incredibly disruptive.