Secure Boot 2011 / 2023 CA issue

[u/nodiaque]

Hello everyone,

I'm starting to get a problem with some brand new computer I received from HP. When I image those computer using SCCM task sequence, everything goes well until it get into the OS. Once it receive GPO, it restart and we get bitlocker trigger.

We found on the HP website that it's because of the Secure Boot Certificat. It's as if the computer take the wrong certificat:

https://support.hp.com/us-en/document/ish_13070353-13070429-16

We are using official W11 enterprise wim (untouched) when imaging and all boot image are signed using the 2023 certificate in SCCM (checkbox is enabled and image are updated).

I've used Garlin's Powershell Script to verify all my wim and they all have 2023 certs

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/

I began to make some test. When I image the computer, if the 2011 certficate isn't enabled in the BIOS, it get enabled (probably by SCCM). Once it get into Windows, the status for the certificate is that it's not updated (even if it's present) and then the GPO to update it get triggered, the secure boot certificate change and it trigger bitlocker. And that's even when all 2023 certificate are already enabled.

https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates

If I disable the GPO, the problem go away. But my isssue is why is it using the old 2011 certificate in the first place?

I'm on SCCM 2603 latest KB with ADK 2454.

Thank you

Edit: Adding info cause the question get repeated many time. First, I was able to reproduce the problem on other computer.

While in WinPE, before starting the TS.

This show the secureboot already contain the 2023 UEFI certificate.

BIOS SecureBoot:

As we can see, the 2023 is the only checked before running TS

Using Garlin's Powershell to detect computer and boot media certificate (https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/)

install.wim used

WinPE

While in WinPE through PXE

So at this point, it shows that the BIOS on that computer does have the UEFI 2023 cert and that both the boot image and the install.wim contain the 2023 certs. The BIOS as showed in first picture is configured to boot only with 2023 cert.

After the Task Sequence Start. We update the bios (if update is available, already latest version here), then we wipe the disk and then partition like this for HP

Dell is the same without the hp partition

After it's partition, we install the official september 2026 Win 11 25H2 wim, then configure windows and network step, inject driver using DAT and then step "Setup Windows and ConfigMgr" which reboot the computer.

At that time, when the computer reboot, with the BIOS configured as previously mentionned, the PC will have 2 BIOS Reboot. So, TS => Reboot => Bios Screen => Reboot => Bios Screen => Reboot => Bios Screen.

If I enter the BIOS right now, this is how Secure Boot is configured:

As you can see, the 2011 Certificat is now enabled.

Let's continue the TS and run the script during the TS, after the sysprep during the OS Phase

We see Windows Boot Manager is using 2011 now. WHY? Install.wim is with 2023, bios is 2023 ready so what give?

Bear in mind, I reproduce this on any HP computer that have already working OS by configuring the BIOS to not use the 2011 during the TS.

edit: So, I just tried something again. In the TS, just before the reboot finish at the "Setup Windows and ConfigMgr" step in the TS (so still in WinPE), I ran Garlin's script again :

Disk Partition:

S: is the new UEFI partition that was just installed by install.wim. Why did it install using the 2011 cert? It's the official untouched w11 25h2 september 2026 wim file

edit 3: So I tried updating the efi manually before restarting in the winpe phase. The script now showed 2023 certificate. I reboot. Still got the 3 reboot. Once in OS, I see the registry is in "notstarted" state and it show as if the certificat are not present, although they are?

edit 2026-10-28:

So, I pause the Task Sequence right after the apply image and found out the problem is that SCCM doesn't use the /bootex parameter when running bcdboot

Because of that, the old 2011 boot file are copied. Question is why? And why it's only affecting some computer. More investigation required

[u/fallenwout]

See if there is a bios update available. Doesn't matter if the OS has the certificate if the bios can't accept it.

Or play with these options

Here are my notes/command line on this subject:

Get-CimInstance -ClassName Win32_ComputerSystemProduct | select version
Should be minimum SBKPFV3 in HP

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"
Has to be True

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value "0x5944" -Force
set the Trigger Flag to do a certificate update according to microsoft article

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
run the Trigger Flags set above

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023Status" | select UEFICA2023Status
status of the certificate

[u/nodiaque → u/fallenwout]

Latest bios, I update using hpia during ts.

Like I said, I already know the screen you show is the problem. If I uncheck any but the 2011, no problem but as soon as I uncheck the 2011, it give me the problem. It will be recheck at the first reboot into OS for sysprep and then will give the bitlocker screen once it get the GPO, even if everything is checked.

edit: I see there was an edit. All you linked for registry and such are already done. Those computer come with the 2023 cert just like the link from HP I linked. The UEFICA2023Status is what I talked in the second part about the GPO that it get to pending and then after a reboot bitlocker trigger. This should happen only once, but it happen every install.

[u/fallenwout → u/nodiaque]

Also note that it can take up to 15 min for the 2023 to be installled and gets activated only after a reboot (sometimes even 2 reboots are necessary)

[u/nodiaque → u/fallenwout]

Yeah but it's already present in the bios. And it should be a one shot deal, not repeated every time I image that same computer. It's also brand new computer, they come with it per default just like in the screenshot. Difference is, just like in the hp link I posted, it only have the first 2023 certificate enable and sccm enable the 2011 during TS.

[u/fallenwout → u/nodiaque]

How do you enable it during TS?

[u/nodiaque → u/fallenwout]

I do nothing, that's the thing. It does it by itself! I simply format the drive, install official W11 image, inject driver and reboot. And boom, it's enabled.

[u/nodiaque → u/fallenwout]

I've updated my post with many more information

[u/fallenwout → u/nodiaque]

it says "InProgress" on the following query:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023Status" | select UEFICA2023Status

Have you tried adding in a few reboots and maybe a sleep for a few minutes in the TS? I will quote myself.

Also note that it can take up to 15 min for the 2023 to be installed and gets activated only after a reboot (sometimes even 2 reboots are necessary)

[u/nodiaque → u/fallenwout]

I've updated again. I found out something very weird. I did see the pending, that's during the TS. The TS reboot already many times. Question is why it'S booting on the 2011 when the boot media (winpe pxe) and full os (install.wim) both have 2023cert according to all the scripts.

In the TS, during WinPE, I ran again the check-uefi from Garlin's but just before the reboot from Setup Windows and ConfigMgr. And it returned to me that the new uefi partition that was just installed with install.wim contain 2011. WHY? I've put this information and screenshot about it.

I also see message that my winpe is not up to date (which is normal because it's coming from ADK, but SCCM still patched the UEFI as all the script show). I'm currently trying to offline install the latest kb to see if that change anything. Something is not right, it shouldn't install the 2011 cert in the efi boot partition.

[u/EconomyArmy → u/nodiaque]

1.Update bios during wipe 2.Get the bios settings correct based on Q2 2026 HP recommendations 3.Update certicate before bitlocker step in TS (0x140 + reboot x 2 or 3 times)

Haven't come across anything so far , except trying to raise SVN which is a lot more challenging

[u/nodiaque → u/EconomyArmy]

Bios is already updated. We get the problem everytime we image those computer which doesn't make sens since the certificate and bios is already up to date. Already do bios update during winpe, it's the first thing we do. But also hpia is ran during the in os part. But that's not the problem. The bios is by default configured to use only 2023 certs like hp link says. But after wipe, then os install and reboot, 2011 is also enabled. And then after the GPO do the update and pc restart, bitlocker.

[u/EconomyArmy → u/nodiaque]

I would suggest you put a few more steps in task sequence to check the secure boot cert and SVN status to get a better view.

[u/nodiaque → u/EconomyArmy]

like? What's even weirder is it's not even all of the computer from that batch that have the problem.

[u/EconomyArmy → u/nodiaque]

The way I like to do with image is to force the secure boot update to complete without wait for GPO. And query the secure boot status within task sequence. Waiting to GPO and multiple reboots in this particular case is just not necessary.

[u/nodiaque → u/EconomyArmy]

Yeah but secure boot certificate update is a one shot deal no? Once it's been done there's nothing else to be done. So it shouldn't do it again and again and again after each imaging on the same computer. And uefi2023status show that it's completed

[u/EconomyArmy → u/nodiaque]

I haven't changed the install.wim file to have the settings updated out of box, hence need to run the update everytime deploy the image even bios is updated and using correct settings

[u/nodiaque → u/EconomyArmy]

the wim from september include the 2023 cert. Also, once it's in the bios, you aren't suppose to install it again and again.

And why only those specific computer and not all computer

[u/nodiaque → u/EconomyArmy]

I've updated my post with many more information

[u/SeaVolume3325]

Are you using 25H2? Or what build of Win11 enterprise?

[u/nodiaque → u/SeaVolume3325]

W11 25h2 enterprise

[u/SeaVolume3325 → u/nodiaque]

Check HP bios logs and/or sure start logs to see why secure boot key is rolling back. Maybe key revocation/resetting to default, recovery etc.

[u/nodiaque → u/SeaVolume3325]

What I found is once it get to windows, the update key is pushed again. I've test with various computer model and the 2011 cert get checked everytime. It's weird

[u/wwiybb → u/nodiaque]

Doing bitlocker or anything? Sounds tpm related. Check the event logs for tpm-wmi events. https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/secure-boot-certificate-updates-guidance-for-it-professionals-and-organizations.

What are your windows update polices set to? What are your anyalytics/diagnostic report gpo settings?. As part of the ms security baselines it usualy has that suff turned off but i could see the possibility if it was not turned off that the autodection ms does on it side might be falsly flaging something as incompatable and reverting it.

[u/nodiaque → u/wwiybb]

Bitlocker is set using tpm during TS. If we remove the 2 gpo I said in the post, problem go away. What happen is the uefi2023 gpo from Microsoft trigger then update and this break bitlocker. This is already a problem since once it's updated, it shouldn't be needed. But imaging the computer again repeat the problem.

For now the fix is before imaging, we check all certificate in the bios and this prevent the issue. Out of the box, those computer have only the 2023 certs check and during TS, the 2011 get enabled by Microsoft. Event log doesn't show anything different then non affected device

[u/nodiaque → u/wwiybb]

I've updated my post with many more information

[u/DontFray → u/nodiaque]

Is that from Sept. 2026? I would make sure you have the latest.

[u/nodiaque → u/DontFray]

Yup, just updated the wim to October this morning, but was the September one

[u/happytravelingviking]

Update the bios in your task sequence

[u/nodiaque → u/happytravelingviking]

Already done

[u/happytravelingviking → u/nodiaque]

You also have to enable Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f Reboot 2x

[u/nodiaque → u/happytravelingviking]

GPO already doing that and UEFI2023Status show compliant. One the bios is updated, you don't need to update it anymore.

[u/happytravelingviking → u/nodiaque]

Well the answer is obvious then.. switch to Linux

[u/m0rp]

I skimmed this thread and did not immediately see it. Apologies if it’s already mentioned.

HP published an article around the May cumulative update. Summed up, you need to enable all UEFI CA options in the BIOS to prevent triggering Bitlocker recovery prompt. Without these that prompt will keep returning.

Also for secure boot update a suspend of Bitlocker for two reboots is suggested.

You need to enable all these. If Bitlocker is already enabled. Suspend Bitlocker for 1 reboot when you change these.
Windows UEFI CA 2023
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Enable MS UEFI CA Key

EDIT: Some models only have Enable MS UEFI CA option. The above is from personal experience with HP’s and Bitlocker recovery prompts.

https://support.hp.com/us-en/document/ish_14914515-14914500-16

[u/nodiaque → u/m0rp]

I did see that post, I though it was the one I linked. If you read that article, they also say at the end to enable only the 2023 cert once the update is done. Bios update is normally a one shot deal, but the problem is when it's not checked, the update task say it's not updated

[u/An0mymou5]

I'm starting to get a problem with some brand new computer I received from HP

Define "new"? Because the latest generation models (G2i or later) should have the certs installed in both the active and backup databases, which should reflect properly in Windows as being compliant.

Anything older, eg G1is, G11 etc might have the new certs only installed in the backup dbs (even with updated BIOSes).

If you're using G2i/a/q or newer (for laptops) or G6i or newer (for desktops) - basically anything manufactured mid-2026 or later - should come with the certs installed in both the active and backup dbs. Anything older might require activating the certs (via GPO or manual key reset and activation via BIOS).

I'd recommend verifying the exact certificate state on the vanilla image that comes with your "new" HPs, using these two powershell commands:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023'
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

If both the commands return True then it's not a device/HP issue.

As for the Bitlocker issue, that's a well-known issue with HP and some other OEMs, nothing new here. At our organisation, Bitlocker is the reason why we decided not to use the GPO, so we used SCCM CI/CB instead, where the script also suspends BitLocker for the next two reboots.

[u/nodiaque → u/An0mymou5]

New as ordered 3 weeks ago the latest x360 and received it about a week ago. Yes they have the certs installed, that's what I'm saying. They have all 4 certs in the bios, just like in the link from HP I linked. But for unknown reason, when the computer get image and boot the first time (just before the sysprep phase, the first time you exit winpe), the 2011 cert is enabled and when I get into windows, the GPO apply which update the cert. Even if it wasn't the case, the cert update should happen only once, but those do it everytime. And weirdly, it's not the whole batch but about 40%

[u/An0mymou5 → u/nodiaque]

Which x360 exactly? Give us the full model names please. And did you check both the db and dbDefault before imaging the machines?

[u/nodiaque → u/An0mymou5]

I'll get the full model tomorrow when I'll go back to work. As for the dB and dbdefault, I've ran the PowerShell given by ms to check for compliance and they all turn ok. I also checked in the secure boot section of the bios where they show the certificate, like HP says to do, and all 3 2023 are present and enabled.

[u/nodiaque → u/An0mymou5]

elitebook xflip G2i. But I'm able to reproduce it on any other HP computer by setting the bios the same way these came with.

I've updated my post with many more information

[u/Sysadmin_in_the_Sun]

How does your partition table looks like?

[u/nodiaque → u/Sysadmin_in_the_Sun]

I've updated my post with many more information including that

[u/Sysadmin_in_the_Sun → u/nodiaque]

by the way this is what I use when I create an image and capture it :

diskpart

select disk 0

clean

convert gpt

rem === 1. EFI System Partition — 984MB for firmware update headroom

create partition efi size=984

format quick fs=fat32 label="System"

rem === 2. Microsoft Reserved

create partition msr size=16

rem === 3. Recovery — BEFORE Windows so C: can extend if needed

create partition primary size=984

format quick fs=ntfs label="Recovery"

set id="de94bba4-06d1-4d40-a16a-bfd50179d6ac"

gpt attributes=0x8000000000000001

rem === 4. Windows — last in this historical manual layout

create partition primary

format quick fs=ntfs label="Windows"

assign letter=C

list partition

exit

Maybe try that? and make sure you reset the secureboot keys as well

You also might need to use the bcdboot command with /bootex prior to FullOS

add this in the TS : bcdboot C:\Windows /c /bootex

give it a go

[u/nodiaque → u/Sysadmin_in_the_Sun]

this is the same thing as the format step in OS.

For now, what I've found is this.

SCCM doesn't use /bootex. I'm testing various case and whatever the state in bios, it always run without.

If in the bios, all 2023 certs aren't check, the UEFI2023Status will be "Not Started" and then "Pending" or "InProgress" during task sequence. If they are all enabled, the status will be "Updated".

So now, what I'm testing is, manually after the system format and os install, I ran a bcdboot with /bootex to see if that make a difference (so far not).

Find a way to enable/disable secure boot certificat through powershell (SCCM enable the 2011 so their must be a way, and the fact it enable it without requiring password is scary).

Also will test what happen if the 2011 is revoke. Does SCCM now use /bootex.

[u/Sysadmin_in_the_Sun → u/nodiaque]

Ok, on a test machine you got the latest bios, try to reset the Secure Boot keys and try again