• TPM-WMI Errors

    From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Fri Apr 17 11:06:48 2026
    From Newsgroup: alt.comp.os.windows-11

    It appears I've been getting TPM-WMI errors for at least 6 months in the Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult
    Error code: 0x800700c1. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware. Review the published guidance to
    complete the update and maintain full protection. This device signature information is included here.
    DeviceAttributes: FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89 BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2.

    The laptop appears to be running fine so I have not really felt the need
    to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Sat Apr 18 03:32:36 2026
    From Newsgroup: alt.comp.os.windows-11

    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.
    DeviceAttributes: FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89 BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2.

    The laptop appears to be running fine so I have not really felt the need
    to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs
    listed against it, and there was also a BlackLotus fix being propagated
    by firmware updates (two of the three machines in the room are updated
    for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative
    and only the last one needs to be installed, check for any notes or warnings indicating otherwise. (You can change the ca-en to en-us if you want.)

    https://support.hp.com/ca-en/drivers/laptops

    I'm getting similar messages ("SBAT") on the Test Machine. The Test Machine has a BIOS which can attest when a TPM 1.x module is plugged in, but the
    BIOS code does not handle TPM 2.0 . I could not buy a module in any case,
    as the type needed is no longer made (LPM type versus SPI type). Yet,
    Microsoft seems to be puttering around with the keys (there is no point).
    I'm pretty sure some OS attempted to turn on Secure Boot by itself,
    because *I* know Secure Boot *cannot* work on the machine and why
    would I have taken the stupid machine off the "Other OS" setting
    which equals Secure Boot = OFF ? The machine has, as its main SSD pair,
    a Windows 7 OS (and a Win10 and a Win11), and that definitely
    takes "Other OS" setting or Win7 won't boot. I do my email on Win7.

    Since your machine is in support, flash up the BIOS first.
    That should give you an entirely different set of error
    messages because... well, you know the drill.

    This activity is a lot like buying a car and needing a
    copy of the ignition computer source code, to keep the
    car running.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Sat Apr 18 06:35:34 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 18 Apr 2026 03:32:36 -0400, Paul <nospam@needed.invalid> wrote:

    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the
    Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult
    Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware. Review the published guidance to
    complete the update and maintain full protection. This device signature
    information is included here.
    DeviceAttributes:
    FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2.

    The laptop appears to be running fine so I have not really felt the need
    to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs >listed against it, and there was also a BlackLotus fix being propagated
    by firmware updates (two of the three machines in the room are updated
    for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative
    and only the last one needs to be installed, check for any notes or warnings >indicating otherwise. (You can change the ca-en to en-us if you want.)

    https://support.hp.com/ca-en/drivers/laptops

    I tried my serial number and product number (B23HQAV), and still got
    page not found. I logged in with my HP id/pw. It listed my products
    (laptop and printer). When I clicked on my laptop I got a page not
    found.

    When I fire up HP Support Assistant it shows 3 updates available ... a
    LAN driver, connection optimizer, and Hardware Diagnostics UEFI. No BIOS update.

    I downloaded and installed the Hardware Diagnostics UEFI update. I then
    ran it and clicked the BIOS-System Firmware Update link. It gave me the spinning wheel and finally returned "Up to Date".

    I'm getting similar messages ("SBAT") on the Test Machine. The Test Machine has
    a BIOS which can attest when a TPM 1.x module is plugged in, but the
    BIOS code does not handle TPM 2.0 . I could not buy a module in any case,
    as the type needed is no longer made (LPM type versus SPI type). Yet, >Microsoft seems to be puttering around with the keys (there is no point).
    I'm pretty sure some OS attempted to turn on Secure Boot by itself,
    because *I* know Secure Boot *cannot* work on the machine and why
    would I have taken the stupid machine off the "Other OS" setting
    which equals Secure Boot = OFF ? The machine has, as its main SSD pair,
    a Windows 7 OS (and a Win10 and a Win11), and that definitely
    takes "Other OS" setting or Win7 won't boot. I do my email on Win7.

    Since your machine is in support, flash up the BIOS first.
    That should give you an entirely different set of error
    messages because... well, you know the drill.

    This activity is a lot like buying a car and needing a
    copy of the ignition computer source code, to keep the
    car running.

    Paul
    --

    Thanks,

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Sat Apr 18 10:20:08 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 4/18/2026 6:35 AM, Dennis wrote:
    On Sat, 18 Apr 2026 03:32:36 -0400, Paul <nospam@needed.invalid> wrote:

    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware. Review the published guidance to
    complete the update and maintain full protection. This device signature
    information is included here.
    DeviceAttributes:
    FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2. >>>
    The laptop appears to be running fine so I have not really felt the need >>> to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs
    listed against it, and there was also a BlackLotus fix being propagated
    by firmware updates (two of the three machines in the room are updated
    for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative
    and only the last one needs to be installed, check for any notes or warnings >> indicating otherwise. (You can change the ca-en to en-us if you want.)

    https://support.hp.com/ca-en/drivers/laptops

    I tried my serial number and product number (B23HQAV), and still got
    page not found. I logged in with my HP id/pw. It listed my products
    (laptop and printer). When I clicked on my laptop I got a page not
    found.

    When I fire up HP Support Assistant it shows 3 updates available ... a
    LAN driver, connection optimizer, and Hardware Diagnostics UEFI. No BIOS update.

    I downloaded and installed the Hardware Diagnostics UEFI update. I then
    ran it and clicked the BIOS-System Firmware Update link. It gave me the spinning wheel and finally returned "Up to Date".

    Since I can't even fix my own UEFI key issues (on the machine across from me), there's no evidence I know how to fix these :-) Let's ask CoPilot.

    ************* CoPilot Question ****************

    HP 17t-cn400 laptop

    Event ID 1796

    "The Secure Boot update failed to update SBAT"
    Error code: 0x800700c1

    Event ID 1801

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware"

    DeviceAttributes:
    FirmwareManufacturer: Insyde
    FirmwareVersion: F.09
    OEMModelBaseBoard: 8DBC
    OEMManufacturerName: HP
    OSArchitecture: amd64
    BucketId: ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:

    The HP support page is missing, and there is no obvious
    way to apply any BIOS update file to the machine. Even when
    the machine serial number is entered in the support page,
    there is no match.

    The machine currently boots, but the concern is that it
    may not boot later in the year 2026.

    What would be your recommended procedure be for correcting
    these secure boot observations ?

    ************* CoPilot Answer ****************

    **Short answer:** <=== Hah!
    Your HP 17trCacn400 is failing the Secure Boot certificate update because the firmware (Insyde F.09) is not yet accepting MicrosoftrCOs 2026 SBAT/DBX updates.

    HPrCOs own guidance indicates that many 2022rCo2023 platforms require a BIOS update
    *before* Windows can successfully apply the new Secure Boot certificates. Since HPrCOs support page for your exact model is missing, the safest and most reliable path is:

    **1. Confirm whether your model is in HPrCOs list of platforms requiring a BIOS update.**
    **2. If it is, obtain the correct BIOS SoftPaq from HP (even if not listed on the public page).**
    **3. Reset Secure Boot keys and temporarily disable HP Sure Start Secure Boot Keys Protection if needed.**
    **4. Allow Windows to retry the SBAT/DBX update after the firmware is updated.**

    Below is a structured, evidence-based breakdown.

    ---
    ## Why the errors are happening
    Two Windows events are key:

    - **Event 1796:** rCLSecure Boot update failed to update SBATrCY (0x800700c1)
    - **Event 1801:** rCLUpdated Secure Boot certificates are available but have not yet been applied to the firmwarerCY

    These exact symptoms are widely reported on HP systems where:

    - Windows has the new Secure Boot certificates ready
    - But the firmware **does not yet support** the new SBAT/DBX update path
    - Or HP Sure Start is blocking key updates

    This matches HPrCOs own support discussions, where users with similar HP firmware (InsyderCabased)
    see the same 0x800700c1 failure.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    Microsoft confirms that Secure Boot certificate servicing requires cooperation from the OEM firmware, and failures often occur when the firmware is not yet updated to accept the new certificate chain.

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    HP also confirms that **all Secure Boot-enabled HP PCs from 2018rCo2025
    require BIOS updates** to prepare for the 2026 certificate expiration.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your HP 17trCacn400 is a 2023rCaera consumer model, so it falls squarely in
    the group that *should* receive a BIOS update before September 30, 2025.

    ---
    ## Recommended procedure (practical and ordered)

    ### **1. Verify whether HP has assigned your model a required BIOS version**

    HP maintains a list of affected platforms and minimum BIOS versions for the 2026 certificate transition.

    HP states that 2022rCo2023 platforms are scheduled to receive BIOS updates by **September 30, 2025**.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Since your support page is missing, this strongly suggests HP has not yet published the SoftPaq for your model.

    **Action:**
    Contact HP support directly and request the BIOS SoftPaq for model
    baseboard **8DBC** (your board ID).

    HP support agents in similar cases request the serial number privately and provide the correct firmware.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    ---
    ### **2. Once the BIOS update is available, install it**

    HPrCOs own Secure Boot troubleshooting guidance emphasizes:

    - Install the latest BIOS
    - Then retry the Secure Boot certificate update
    - Because the firmware must accept the new SBAT/DBX entries before Windows
    can apply them

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ### **3. Temporarily disable HP Sure Start Secure Boot Keys Protection**
    HP Sure Start can block updates to Secure Boot keys.

    HPrCOs official steps for Secure Boot update failures include:
    - Enter BIOS (F10)
    - **Disable rCLSure Start Secure Boot Keys ProtectionrCY**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - RerCaenable Secure Boot

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    This is often required before Windows can apply the SBAT/DBX update.

    ---
    ### **4. Allow Windows to retry the SBAT/DBX update**
    After firmware is updated and Sure Start is temporarily disabled:

    - Windows will retry the Secure Boot update via its scheduled task
    - The registry value `AvailableUpdates` should drop from a nonrCazero value to **0**
    when successful
    - Microsoft documents this progression explicitly

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    ---
    ### **5. Confirm the DBX/SBAT update applied**
    Check:

    C:\Windows\System32\SecureBootUpdates\dbxupdate.bin

    HP notes that the file date should be July 11, 2025 or later for the
    new certificate set.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ## What happens if you do nothing?
    HP warns that **MicrosoftrCOs 2011 Secure Boot certificates expire between JunerCoOctober 2026**, and systems without updated firmware + updated certificates may:

    - Fail to boot
    - Lose Secure Boot protection
    - Fail Windows boot manager validation

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your concern about 2026 bootability is valid.

    ---
    ## Why your support page is missing
    This is happening to multiple HP models right now. HP is in the middle of publishing BIOS updates for the 2026 certificate transition. Several models temporarily have missing or incomplete support pages while HP updates their catalog.

    This is consistent with other HP users reporting missing pages and incomplete BIOS listings in 2025rCo2026.

    ---
    ## Final recommended path (clear and actionable)
    1. **Contact HP Support** with your serial number and baseboard ID (8DBC)
    and request the BIOS SoftPaq required for the 2026 Secure Boot certificate transition.

    2. **Install the BIOS update** once provided.

    3. In BIOS:
    - Disable **Sure Start Secure Boot Keys Protection**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - RerCaenable Secure Boot

    4. **Reboot and allow Windows to retry** the SBAT/DBX update.
    5. Confirm AvailableUpdates = 0 and that the DBX file is updated.

    This is the only reliable way to ensure your system will continue to boot securely in 2026.

    ************* End - CoPilot Answer ****************

    I would add a couple comments to this. As far as I'm concerned,
    the state of the HP Support page indicates this is an ODM-manufactured
    model where HP added zero value. The end result, is HP has no staff
    preparing support materials. The LLM-AI seems to have some sort of
    rosy picture of how manufacturing works in 2026.

    To give an example, a family member had a portable clothes washer with
    leaking hoses. The support page (from the "North America" manufacturer)
    had an "exploded diagram" where the hose interface (two hoses) were
    missing. There was no usable information as to how to access the hose
    clamps or get the thing apart. This happens, because a Chinese firm made
    the item, without any help at all, and the North America operation is
    a "box shifting" operation who could not get out of their own way.

    ODM stuff is fine, with the right helpful touches by somebody to make
    it look like some effort was put into it. When you see a "page missing" situation, "where is the love" ? :-/

    So I would take the naive world view the AI has, and ask HP Support directly and see what happens when their staff get Page Not Found. Should be
    good for a laugh. It's hard to say whether this identifier

    baseboard ID (8DBC)

    is going to show up on a Support computer script.

    The second comment, would be about

    Disable **Sure Start Secure Boot Keys Protection**

    I would be willing to go that far, except my own experience with
    "leaving the barn door open", is that it does not work. The status
    of my machine did not change when I neutralized MOK. I restored MOK
    and moved on. Don't delete the key store, unless the BIOS has a
    dialog to save the four files stored in NVRAM. Since this is an
    Insyde BIOS (I have one, it has a grand total of one setting inside),
    I would not be expecting to see anything Secure Boot related at
    any level of detail in there. There may not be a backup option in there. Perhaps the HP App side of things, has a backup capability ?

    Since the computer and OS seems to be actively pursuing this issue,
    maybe you will be successful three days after the Disable Sure Start thing.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Sat Apr 18 13:36:02 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 18 Apr 2026 10:20:08 -0400, Paul <nospam@needed.invalid> wrote:

    On Sat, 4/18/2026 6:35 AM, Dennis wrote:
    On Sat, 18 Apr 2026 03:32:36 -0400, Paul <nospam@needed.invalid> wrote:

    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have >>>> not yet been applied to the firmware. Review the published guidance to >>>> complete the update and maintain full protection. This device signature >>>> information is included here.
    DeviceAttributes:
    FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2. >>>>
    The laptop appears to be running fine so I have not really felt the need >>>> to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs
    listed against it, and there was also a BlackLotus fix being propagated
    by firmware updates (two of the three machines in the room are updated
    for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative
    and only the last one needs to be installed, check for any notes or warnings
    indicating otherwise. (You can change the ca-en to en-us if you want.)

    https://support.hp.com/ca-en/drivers/laptops

    I tried my serial number and product number (B23HQAV), and still got
    page not found. I logged in with my HP id/pw. It listed my products
    (laptop and printer). When I clicked on my laptop I got a page not
    found.

    When I fire up HP Support Assistant it shows 3 updates available ... a
    LAN driver, connection optimizer, and Hardware Diagnostics UEFI. No BIOS
    update.

    I downloaded and installed the Hardware Diagnostics UEFI update. I then
    ran it and clicked the BIOS-System Firmware Update link. It gave me the
    spinning wheel and finally returned "Up to Date".

    Since I can't even fix my own UEFI key issues (on the machine across from me), >there's no evidence I know how to fix these :-) Let's ask CoPilot.

    ************* CoPilot Question ****************

    HP 17t-cn400 laptop

    Event ID 1796

    "The Secure Boot update failed to update SBAT"
    Error code: 0x800700c1

    Event ID 1801

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware"

    DeviceAttributes:
    FirmwareManufacturer: Insyde
    FirmwareVersion: F.09
    OEMModelBaseBoard: 8DBC
    OEMManufacturerName: HP
    OSArchitecture: amd64
    BucketId: ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:

    The HP support page is missing, and there is no obvious
    way to apply any BIOS update file to the machine. Even when
    the machine serial number is entered in the support page,
    there is no match.

    The machine currently boots, but the concern is that it
    may not boot later in the year 2026.

    What would be your recommended procedure be for correcting
    these secure boot observations ?

    ************* CoPilot Answer ****************

    **Short answer:** <=== Hah!
    Your HP 17t?cn400 is failing the Secure Boot certificate update because the >firmware (Insyde F.09) is not yet accepting MicrosoftAs 2026 SBAT/DBX updates.

    HPAs own guidance indicates that many 2022u2023 platforms require a BIOS update
    *before* Windows can successfully apply the new Secure Boot certificates. Since
    HPAs support page for your exact model is missing, the safest and most reliable path is:

    **1. Confirm whether your model is in HPAs list of platforms requiring a BIOS update.**
    **2. If it is, obtain the correct BIOS SoftPaq from HP (even if not listed on the public page).**
    **3. Reset Secure Boot keys and temporarily disable HP Sure Start Secure Boot Keys Protection if needed.**
    **4. Allow Windows to retry the SBAT/DBX update after the firmware is updated.**

    Below is a structured, evidence-based breakdown.

    ---
    ## Why the errors are happening
    Two Windows events are key:

    - **Event 1796:** oSecure Boot update failed to update SBATo (0x800700c1)
    - **Event 1801:** oUpdated Secure Boot certificates are available but have not yet been applied to the firmwareo

    These exact symptoms are widely reported on HP systems where:

    - Windows has the new Secure Boot certificates ready
    - But the firmware **does not yet support** the new SBAT/DBX update path
    - Or HP Sure Start is blocking key updates

    This matches HPAs own support discussions, where users with similar HP firmware (Insyde?based)
    see the same 0x800700c1 failure.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    Microsoft confirms that Secure Boot certificate servicing requires cooperation >from the OEM firmware, and failures often occur when the firmware is not yet >updated to accept the new certificate chain.

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    HP also confirms that **all Secure Boot-enabled HP PCs from 2018u2025
    require BIOS updates** to prepare for the 2026 certificate expiration.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your HP 17t?cn400 is a 2023?era consumer model, so it falls squarely in
    the group that *should* receive a BIOS update before September 30, 2025.

    ---
    ## Recommended procedure (practical and ordered)

    ### **1. Verify whether HP has assigned your model a required BIOS version**

    HP maintains a list of affected platforms and minimum BIOS versions for the 2026 certificate transition.

    HP states that 2022u2023 platforms are scheduled to receive BIOS updates by **September 30, 2025**.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Since your support page is missing, this strongly suggests HP has not yet >published the SoftPaq for your model.

    **Action:**
    Contact HP support directly and request the BIOS SoftPaq for model
    baseboard **8DBC** (your board ID).

    HP support agents in similar cases request the serial number privately and >provide the correct firmware.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    ---
    ### **2. Once the BIOS update is available, install it**

    HPAs own Secure Boot troubleshooting guidance emphasizes:

    - Install the latest BIOS
    - Then retry the Secure Boot certificate update
    - Because the firmware must accept the new SBAT/DBX entries before Windows
    can apply them

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ### **3. Temporarily disable HP Sure Start Secure Boot Keys Protection**
    HP Sure Start can block updates to Secure Boot keys.

    HPAs official steps for Secure Boot update failures include:
    - Enter BIOS (F10)
    - **Disable oSure Start Secure Boot Keys Protectiono**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    This is often required before Windows can apply the SBAT/DBX update.

    ---
    ### **4. Allow Windows to retry the SBAT/DBX update**
    After firmware is updated and Sure Start is temporarily disabled:

    - Windows will retry the Secure Boot update via its scheduled task
    - The registry value `AvailableUpdates` should drop from a non?zero value to **0**
    when successful
    - Microsoft documents this progression explicitly

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    ---
    ### **5. Confirm the DBX/SBAT update applied**
    Check:

    C:\Windows\System32\SecureBootUpdates\dbxupdate.bin

    HP notes that the file date should be July 11, 2025 or later for the
    new certificate set.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ## What happens if you do nothing?
    HP warns that **MicrosoftAs 2011 Secure Boot certificates expire between >JuneuOctober 2026**, and systems without updated firmware + updated certificates may:

    - Fail to boot
    - Lose Secure Boot protection
    - Fail Windows boot manager validation

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your concern about 2026 bootability is valid.

    ---
    ## Why your support page is missing
    This is happening to multiple HP models right now. HP is in the middle of >publishing BIOS updates for the 2026 certificate transition. Several models >temporarily have missing or incomplete support pages while HP updates their catalog.

    This is consistent with other HP users reporting missing pages and incomplete BIOS listings in 2025u2026.

    ---
    ## Final recommended path (clear and actionable)
    1. **Contact HP Support** with your serial number and baseboard ID (8DBC)
    and request the BIOS SoftPaq required for the 2026 Secure Boot certificate transition.

    2. **Install the BIOS update** once provided.

    3. In BIOS:
    - Disable **Sure Start Secure Boot Keys Protection**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    4. **Reboot and allow Windows to retry** the SBAT/DBX update.
    5. Confirm AvailableUpdates = 0 and that the DBX file is updated.

    This is the only reliable way to ensure your system will continue to boot securely in 2026.

    ************* End - CoPilot Answer ****************

    I would add a couple comments to this. As far as I'm concerned,
    the state of the HP Support page indicates this is an ODM-manufactured
    model where HP added zero value. The end result, is HP has no staff
    preparing support materials. The LLM-AI seems to have some sort of
    rosy picture of how manufacturing works in 2026.

    To give an example, a family member had a portable clothes washer with >leaking hoses. The support page (from the "North America" manufacturer)
    had an "exploded diagram" where the hose interface (two hoses) were
    missing. There was no usable information as to how to access the hose
    clamps or get the thing apart. This happens, because a Chinese firm made
    the item, without any help at all, and the North America operation is
    a "box shifting" operation who could not get out of their own way.

    ODM stuff is fine, with the right helpful touches by somebody to make
    it look like some effort was put into it. When you see a "page missing" >situation, "where is the love" ? :-/

    So I would take the naive world view the AI has, and ask HP Support directly >and see what happens when their staff get Page Not Found. Should be
    good for a laugh. It's hard to say whether this identifier

    baseboard ID (8DBC)

    is going to show up on a Support computer script.

    The second comment, would be about

    Disable **Sure Start Secure Boot Keys Protection**

    I would be willing to go that far, except my own experience with
    "leaving the barn door open", is that it does not work. The status
    of my machine did not change when I neutralized MOK. I restored MOK
    and moved on. Don't delete the key store, unless the BIOS has a
    dialog to save the four files stored in NVRAM. Since this is an
    Insyde BIOS (I have one, it has a grand total of one setting inside),
    I would not be expecting to see anything Secure Boot related at
    any level of detail in there. There may not be a backup option in there. >Perhaps the HP App side of things, has a backup capability ?

    Since the computer and OS seems to be actively pursuing this issue,
    maybe you will be successful three days after the Disable Sure Start thing.

    We have lift off!

    I just went back to the HP driver download site and my product number is
    now listed. What timing. I was able to download a driver (sp168565.exe).
    The file is the same for 24H2 and 25H2, so I think I'll upgrade to 25H2
    before messing with the BIOS.

    This should take care of steps 1 & 2.

    I'm a little confused by the LLM's step 3 instructions and your
    concerns. I'll cross that bridge when I come to it. I'll play with 25H2
    today and the BIOS tomorrow or Monday.

    When I get the BIOS updated should I just let nature take its course and
    wait a day or two for windows to retry the SBAT/DBX update?

    Thanks Paul!
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Sat Apr 18 16:41:00 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 4/18/2026 1:36 PM, Dennis wrote:
    On Sat, 18 Apr 2026 10:20:08 -0400, Paul <nospam@needed.invalid> wrote:

    On Sat, 4/18/2026 6:35 AM, Dennis wrote:
    On Sat, 18 Apr 2026 03:32:36 -0400, Paul <nospam@needed.invalid> wrote:

    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>>>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>>>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other.

    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have >>>>> not yet been applied to the firmware. Review the published guidance to >>>>> complete the update and maintain full protection. This device signature >>>>> information is included here.
    DeviceAttributes:
    FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2. >>>>>
    The laptop appears to be running fine so I have not really felt the need >>>>> to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs >>>> listed against it, and there was also a BlackLotus fix being propagated >>>> by firmware updates (two of the three machines in the room are updated >>>> for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative >>>> and only the last one needs to be installed, check for any notes or warnings
    indicating otherwise. (You can change the ca-en to en-us if you want.) >>>>
    https://support.hp.com/ca-en/drivers/laptops

    I tried my serial number and product number (B23HQAV), and still got
    page not found. I logged in with my HP id/pw. It listed my products
    (laptop and printer). When I clicked on my laptop I got a page not
    found.

    When I fire up HP Support Assistant it shows 3 updates available ... a
    LAN driver, connection optimizer, and Hardware Diagnostics UEFI. No BIOS >>> update.

    I downloaded and installed the Hardware Diagnostics UEFI update. I then
    ran it and clicked the BIOS-System Firmware Update link. It gave me the
    spinning wheel and finally returned "Up to Date".

    Since I can't even fix my own UEFI key issues (on the machine across from me),
    there's no evidence I know how to fix these :-) Let's ask CoPilot.

    ************* CoPilot Question ****************

    HP 17t-cn400 laptop

    Event ID 1796

    "The Secure Boot update failed to update SBAT"
    Error code: 0x800700c1

    Event ID 1801

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware"

    DeviceAttributes:
    FirmwareManufacturer: Insyde
    FirmwareVersion: F.09
    OEMModelBaseBoard: 8DBC
    OEMManufacturerName: HP
    OSArchitecture: amd64
    BucketId: ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:

    The HP support page is missing, and there is no obvious
    way to apply any BIOS update file to the machine. Even when
    the machine serial number is entered in the support page,
    there is no match.

    The machine currently boots, but the concern is that it
    may not boot later in the year 2026.

    What would be your recommended procedure be for correcting
    these secure boot observations ?

    ************* CoPilot Answer ****************

    **Short answer:** <=== Hah!
    Your HP 17t?cn400 is failing the Secure Boot certificate update because the >> firmware (Insyde F.09) is not yet accepting MicrosoftrCOs 2026 SBAT/DBX updates.

    HPrCOs own guidance indicates that many 2022rCo2023 platforms require a BIOS update
    *before* Windows can successfully apply the new Secure Boot certificates. Since
    HPrCOs support page for your exact model is missing, the safest and most reliable path is:

    **1. Confirm whether your model is in HPrCOs list of platforms requiring a BIOS update.**
    **2. If it is, obtain the correct BIOS SoftPaq from HP (even if not listed on the public page).**
    **3. Reset Secure Boot keys and temporarily disable HP Sure Start Secure Boot Keys Protection if needed.**
    **4. Allow Windows to retry the SBAT/DBX update after the firmware is updated.**

    Below is a structured, evidence-based breakdown.

    ---
    ## Why the errors are happening
    Two Windows events are key:

    - **Event 1796:** rCLSecure Boot update failed to update SBATrCY (0x800700c1)
    - **Event 1801:** rCLUpdated Secure Boot certificates are available but have not yet been applied to the firmwarerCY

    These exact symptoms are widely reported on HP systems where:

    - Windows has the new Secure Boot certificates ready
    - But the firmware **does not yet support** the new SBAT/DBX update path
    - Or HP Sure Start is blocking key updates

    This matches HPrCOs own support discussions, where users with similar HP firmware (Insyde?based)
    see the same 0x800700c1 failure.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    Microsoft confirms that Secure Boot certificate servicing requires cooperation
    from the OEM firmware, and failures often occur when the firmware is not yet >> updated to accept the new certificate chain.

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    HP also confirms that **all Secure Boot-enabled HP PCs from 2018rCo2025
    require BIOS updates** to prepare for the 2026 certificate expiration.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your HP 17t?cn400 is a 2023?era consumer model, so it falls squarely in
    the group that *should* receive a BIOS update before September 30, 2025.

    ---
    ## Recommended procedure (practical and ordered)

    ### **1. Verify whether HP has assigned your model a required BIOS version** >>
    HP maintains a list of affected platforms and minimum BIOS versions for the 2026 certificate transition.

    HP states that 2022rCo2023 platforms are scheduled to receive BIOS updates by **September 30, 2025**.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Since your support page is missing, this strongly suggests HP has not yet
    published the SoftPaq for your model.

    **Action:**
    Contact HP support directly and request the BIOS SoftPaq for model
    baseboard **8DBC** (your board ID).

    HP support agents in similar cases request the serial number privately and >> provide the correct firmware.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    ---
    ### **2. Once the BIOS update is available, install it**

    HPrCOs own Secure Boot troubleshooting guidance emphasizes:

    - Install the latest BIOS
    - Then retry the Secure Boot certificate update
    - Because the firmware must accept the new SBAT/DBX entries before Windows >> can apply them

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ### **3. Temporarily disable HP Sure Start Secure Boot Keys Protection** >> HP Sure Start can block updates to Secure Boot keys.

    HPrCOs official steps for Secure Boot update failures include:
    - Enter BIOS (F10)
    - **Disable rCLSure Start Secure Boot Keys ProtectionrCY**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    This is often required before Windows can apply the SBAT/DBX update.

    ---
    ### **4. Allow Windows to retry the SBAT/DBX update**
    After firmware is updated and Sure Start is temporarily disabled:

    - Windows will retry the Secure Boot update via its scheduled task
    - The registry value `AvailableUpdates` should drop from a non?zero value to **0**
    when successful
    - Microsoft documents this progression explicitly

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    ---
    ### **5. Confirm the DBX/SBAT update applied**
    Check:

    C:\Windows\System32\SecureBootUpdates\dbxupdate.bin

    HP notes that the file date should be July 11, 2025 or later for the
    new certificate set.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ## What happens if you do nothing?
    HP warns that **MicrosoftrCOs 2011 Secure Boot certificates expire between >> JunerCoOctober 2026**, and systems without updated firmware + updated certificates may:

    - Fail to boot
    - Lose Secure Boot protection
    - Fail Windows boot manager validation

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your concern about 2026 bootability is valid.

    ---
    ## Why your support page is missing
    This is happening to multiple HP models right now. HP is in the middle of
    publishing BIOS updates for the 2026 certificate transition. Several models >> temporarily have missing or incomplete support pages while HP updates their catalog.

    This is consistent with other HP users reporting missing pages and incomplete BIOS listings in 2025rCo2026.

    ---
    ## Final recommended path (clear and actionable)
    1. **Contact HP Support** with your serial number and baseboard ID (8DBC)
    and request the BIOS SoftPaq required for the 2026 Secure Boot certificate transition.

    2. **Install the BIOS update** once provided.

    3. In BIOS:
    - Disable **Sure Start Secure Boot Keys Protection**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    4. **Reboot and allow Windows to retry** the SBAT/DBX update.
    5. Confirm AvailableUpdates = 0 and that the DBX file is updated.

    This is the only reliable way to ensure your system will continue to boot securely in 2026.

    ************* End - CoPilot Answer ****************

    I would add a couple comments to this. As far as I'm concerned,
    the state of the HP Support page indicates this is an ODM-manufactured
    model where HP added zero value. The end result, is HP has no staff
    preparing support materials. The LLM-AI seems to have some sort of
    rosy picture of how manufacturing works in 2026.

    To give an example, a family member had a portable clothes washer with
    leaking hoses. The support page (from the "North America" manufacturer)
    had an "exploded diagram" where the hose interface (two hoses) were
    missing. There was no usable information as to how to access the hose
    clamps or get the thing apart. This happens, because a Chinese firm made
    the item, without any help at all, and the North America operation is
    a "box shifting" operation who could not get out of their own way.

    ODM stuff is fine, with the right helpful touches by somebody to make
    it look like some effort was put into it. When you see a "page missing"
    situation, "where is the love" ? :-/

    So I would take the naive world view the AI has, and ask HP Support directly >> and see what happens when their staff get Page Not Found. Should be
    good for a laugh. It's hard to say whether this identifier

    baseboard ID (8DBC)

    is going to show up on a Support computer script.

    The second comment, would be about

    Disable **Sure Start Secure Boot Keys Protection**

    I would be willing to go that far, except my own experience with
    "leaving the barn door open", is that it does not work. The status
    of my machine did not change when I neutralized MOK. I restored MOK
    and moved on. Don't delete the key store, unless the BIOS has a
    dialog to save the four files stored in NVRAM. Since this is an
    Insyde BIOS (I have one, it has a grand total of one setting inside),
    I would not be expecting to see anything Secure Boot related at
    any level of detail in there. There may not be a backup option in there.
    Perhaps the HP App side of things, has a backup capability ?

    Since the computer and OS seems to be actively pursuing this issue,
    maybe you will be successful three days after the Disable Sure Start thing.

    We have lift off!

    I just went back to the HP driver download site and my product number is
    now listed. What timing. I was able to download a driver (sp168565.exe).
    The file is the same for 24H2 and 25H2, so I think I'll upgrade to 25H2 before messing with the BIOS.

    This should take care of steps 1 & 2.

    I'm a little confused by the LLM's step 3 instructions and your
    concerns. I'll cross that bridge when I come to it. I'll play with 25H2
    today and the BIOS tomorrow or Monday.

    When I get the BIOS updated should I just let nature take its course and
    wait a day or two for windows to retry the SBAT/DBX update?

    Thanks Paul!


    I don't think you have to be super-aggressive. Give it a couple days to work its magic and see if it needs additional help. Your plan sounds good.

    And that's one hell of a coincidence, the page coming back like that.
    Maybe they actually check their server logs ? :-)

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Sat Apr 18 17:38:59 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 18 Apr 2026 16:41:00 -0400, Paul <nospam@needed.invalid> wrote:

    And that's one hell of a coincidence, the page coming back like that.
    Maybe they actually check their server logs ? :-)

    Exactly what I was thinking. Look for the 404s and bring them to
    someone's attention.

    I'll let you know next week if the BIOS update was enough to solve
    things.

    Thanks,
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Sun Apr 19 16:48:31 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sat, 18 Apr 2026 16:41:00 -0400, Paul <nospam@needed.invalid> wrote:

    On Sat, 4/18/2026 1:36 PM, Dennis wrote:
    On Sat, 18 Apr 2026 10:20:08 -0400, Paul <nospam@needed.invalid> wrote:

    On Sat, 4/18/2026 6:35 AM, Dennis wrote:
    On Sat, 18 Apr 2026 03:32:36 -0400, Paul <nospam@needed.invalid> wrote: >>>>
    On Fri, 4/17/2026 11:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>>>>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>>>>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I get the above twice daily, usually within seconds of each other. >>>>>>
    But I do get an occasional (every few days):

    "Updated Secure Boot certificates are available on this device but have >>>>>> not yet been applied to the firmware. Review the published guidance to >>>>>> complete the update and maintain full protection. This device signature >>>>>> information is included here.
    DeviceAttributes:
    FirmwareManufacturer:Insyde;FirmwareVersion:F.09;OEMModelBaseBoard:8DBC;OEMManufacturerName:HP;OSArchitecture:amd64;
    BucketId:
    ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:
    For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2301018."

    Event ID 1801.

    Laptop is an HP 17t-cn400 that I bought new last year. Win 11 Home 24H2. >>>>>>
    The laptop appears to be running fine so I have not really felt the need >>>>>> to pursue a fix. If it ain't broke, don't fix it.

    But should I be doing something to fix this?


    Start by making sure the BIOS is updated. The Insyde BIOS has some bugs >>>>> listed against it, and there was also a BlackLotus fix being propagated >>>>> by firmware updates (two of the three machines in the room are updated >>>>> for that).

    I tried typing your machine model info this page, but am getting
    page not found. If you use the serial number, that may coax
    this page to work. While most of the time, BIOS updates are cumulative >>>>> and only the last one needs to be installed, check for any notes or warnings
    indicating otherwise. (You can change the ca-en to en-us if you want.) >>>>>
    https://support.hp.com/ca-en/drivers/laptops

    I tried my serial number and product number (B23HQAV), and still got
    page not found. I logged in with my HP id/pw. It listed my products
    (laptop and printer). When I clicked on my laptop I got a page not
    found.

    When I fire up HP Support Assistant it shows 3 updates available ... a >>>> LAN driver, connection optimizer, and Hardware Diagnostics UEFI. No BIOS >>>> update.

    I downloaded and installed the Hardware Diagnostics UEFI update. I then >>>> ran it and clicked the BIOS-System Firmware Update link. It gave me the >>>> spinning wheel and finally returned "Up to Date".

    Since I can't even fix my own UEFI key issues (on the machine across from me),
    there's no evidence I know how to fix these :-) Let's ask CoPilot.

    ************* CoPilot Question ****************

    HP 17t-cn400 laptop

    Event ID 1796

    "The Secure Boot update failed to update SBAT"
    Error code: 0x800700c1

    Event ID 1801

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware"

    DeviceAttributes:
    FirmwareManufacturer: Insyde
    FirmwareVersion: F.09
    OEMModelBaseBoard: 8DBC
    OEMManufacturerName: HP
    OSArchitecture: amd64
    BucketId: ab2d867cad4d48a4bf96b8b06e9bbc2c5b6eb307038992e2ded7d5ee8ce79a89
    BucketConfidenceLevel: Under Observation - More Data Needed
    UpdateType:

    The HP support page is missing, and there is no obvious
    way to apply any BIOS update file to the machine. Even when
    the machine serial number is entered in the support page,
    there is no match.

    The machine currently boots, but the concern is that it
    may not boot later in the year 2026.

    What would be your recommended procedure be for correcting
    these secure boot observations ?

    ************* CoPilot Answer ****************

    **Short answer:** <=== Hah!
    Your HP 17t?cn400 is failing the Secure Boot certificate update because the >>> firmware (Insyde F.09) is not yet accepting MicrosoftAs 2026 SBAT/DBX updates.

    HPAs own guidance indicates that many 2022u2023 platforms require a BIOS update
    *before* Windows can successfully apply the new Secure Boot certificates. Since
    HPAs support page for your exact model is missing, the safest and most reliable path is:

    **1. Confirm whether your model is in HPAs list of platforms requiring a BIOS update.**
    **2. If it is, obtain the correct BIOS SoftPaq from HP (even if not listed on the public page).**
    **3. Reset Secure Boot keys and temporarily disable HP Sure Start Secure Boot Keys Protection if needed.**
    **4. Allow Windows to retry the SBAT/DBX update after the firmware is updated.**

    Below is a structured, evidence-based breakdown.

    ---
    ## Why the errors are happening
    Two Windows events are key:

    - **Event 1796:** oSecure Boot update failed to update SBATo (0x800700c1) >>> - **Event 1801:** oUpdated Secure Boot certificates are available but have not yet been applied to the firmwareo

    These exact symptoms are widely reported on HP systems where:

    - Windows has the new Secure Boot certificates ready
    - But the firmware **does not yet support** the new SBAT/DBX update path >>> - Or HP Sure Start is blocking key updates

    This matches HPAs own support discussions, where users with similar HP firmware (Insyde?based)
    see the same 0x800700c1 failure.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    Microsoft confirms that Secure Boot certificate servicing requires cooperation
    from the OEM firmware, and failures often occur when the firmware is not yet >>> updated to accept the new certificate chain.

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    HP also confirms that **all Secure Boot-enabled HP PCs from 2018u2025
    require BIOS updates** to prepare for the 2026 certificate expiration.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Your HP 17t?cn400 is a 2023?era consumer model, so it falls squarely in
    the group that *should* receive a BIOS update before September 30, 2025. >>>
    ---
    ## Recommended procedure (practical and ordered)

    ### **1. Verify whether HP has assigned your model a required BIOS version**

    HP maintains a list of affected platforms and minimum BIOS versions for the 2026 certificate transition.

    HP states that 2022u2023 platforms are scheduled to receive BIOS updates by **September 30, 2025**.

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16

    Since your support page is missing, this strongly suggests HP has not yet >>> published the SoftPaq for your model.

    **Action:**
    Contact HP support directly and request the BIOS SoftPaq for model
    baseboard **8DBC** (your board ID).

    HP support agents in similar cases request the serial number privately and >>> provide the correct firmware.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Secure-boot-cerificates-not-applied-to-firmware/td-p/9618589

    ---
    ### **2. Once the BIOS update is available, install it**

    HPAs own Secure Boot troubleshooting guidance emphasizes:

    - Install the latest BIOS
    - Then retry the Secure Boot certificate update
    - Because the firmware must accept the new SBAT/DBX entries before Windows >>> can apply them

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ### **3. Temporarily disable HP Sure Start Secure Boot Keys Protection** >>> HP Sure Start can block updates to Secure Boot keys.

    HPAs official steps for Secure Boot update failures include:
    - Enter BIOS (F10)
    - **Disable oSure Start Secure Boot Keys Protectiono**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    This is often required before Windows can apply the SBAT/DBX update.

    ---
    ### **4. Allow Windows to retry the SBAT/DBX update**
    After firmware is updated and Sure Start is temporarily disabled:

    - Windows will retry the Secure Boot update via its scheduled task
    - The registry value `AvailableUpdates` should drop from a non?zero value to **0**
    when successful
    - Microsoft documents this progression explicitly

    [Microsoft Support]

    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    ---
    ### **5. Confirm the DBX/SBAT update applied**
    Check:

    C:\Windows\System32\SecureBootUpdates\dbxupdate.bin

    HP notes that the file date should be July 11, 2025 or later for the
    new certificate set.

    [HP Support Community]

    https://h30434.www3.hp.com/t5/Desktop-Knowledge-Base/Secure-Boot-Violation-Error-on-HP-Commercial-Products/ta-p/9618247

    ---
    ## What happens if you do nothing?
    HP warns that **MicrosoftAs 2011 Secure Boot certificates expire between >>> JuneuOctober 2026**, and systems without updated firmware + updated certificates may:

    - Fail to boot
    - Lose Secure Boot protection
    - Fail Windows boot manager validation

    [HP Support] https://support.hp.com/document/ish_13070353-13070429-16 >>>
    Your concern about 2026 bootability is valid.

    ---
    ## Why your support page is missing
    This is happening to multiple HP models right now. HP is in the middle of >>> publishing BIOS updates for the 2026 certificate transition. Several models >>> temporarily have missing or incomplete support pages while HP updates their catalog.

    This is consistent with other HP users reporting missing pages and incomplete BIOS listings in 2025u2026.

    ---
    ## Final recommended path (clear and actionable)
    1. **Contact HP Support** with your serial number and baseboard ID (8DBC) >>> and request the BIOS SoftPaq required for the 2026 Secure Boot certificate transition.

    2. **Install the BIOS update** once provided.

    3. In BIOS:
    - Disable **Sure Start Secure Boot Keys Protection**
    - Disable Secure Boot
    - Reset Secure Boot keys to factory defaults
    - Re?enable Secure Boot

    4. **Reboot and allow Windows to retry** the SBAT/DBX update.
    5. Confirm AvailableUpdates = 0 and that the DBX file is updated.

    This is the only reliable way to ensure your system will continue to boot securely in 2026.

    ************* End - CoPilot Answer ****************

    I would add a couple comments to this. As far as I'm concerned,
    the state of the HP Support page indicates this is an ODM-manufactured
    model where HP added zero value. The end result, is HP has no staff
    preparing support materials. The LLM-AI seems to have some sort of
    rosy picture of how manufacturing works in 2026.

    To give an example, a family member had a portable clothes washer with
    leaking hoses. The support page (from the "North America" manufacturer)
    had an "exploded diagram" where the hose interface (two hoses) were
    missing. There was no usable information as to how to access the hose
    clamps or get the thing apart. This happens, because a Chinese firm made >>> the item, without any help at all, and the North America operation is
    a "box shifting" operation who could not get out of their own way.

    ODM stuff is fine, with the right helpful touches by somebody to make
    it look like some effort was put into it. When you see a "page missing"
    situation, "where is the love" ? :-/

    So I would take the naive world view the AI has, and ask HP Support directly
    and see what happens when their staff get Page Not Found. Should be
    good for a laugh. It's hard to say whether this identifier

    baseboard ID (8DBC)

    is going to show up on a Support computer script.

    The second comment, would be about

    Disable **Sure Start Secure Boot Keys Protection**

    I would be willing to go that far, except my own experience with
    "leaving the barn door open", is that it does not work. The status
    of my machine did not change when I neutralized MOK. I restored MOK
    and moved on. Don't delete the key store, unless the BIOS has a
    dialog to save the four files stored in NVRAM. Since this is an
    Insyde BIOS (I have one, it has a grand total of one setting inside),
    I would not be expecting to see anything Secure Boot related at
    any level of detail in there. There may not be a backup option in there. >>> Perhaps the HP App side of things, has a backup capability ?

    Since the computer and OS seems to be actively pursuing this issue,
    maybe you will be successful three days after the Disable Sure Start thing. >>
    We have lift off!

    I just went back to the HP driver download site and my product number is
    now listed. What timing. I was able to download a driver (sp168565.exe).
    The file is the same for 24H2 and 25H2, so I think I'll upgrade to 25H2
    before messing with the BIOS.

    This should take care of steps 1 & 2.

    I'm a little confused by the LLM's step 3 instructions and your
    concerns. I'll cross that bridge when I come to it. I'll play with 25H2
    today and the BIOS tomorrow or Monday.

    When I get the BIOS updated should I just let nature take its course and
    wait a day or two for windows to retry the SBAT/DBX update?

    Thanks Paul!


    I don't think you have to be super-aggressive. Give it a couple days to work >its magic and see if it needs additional help. Your plan sounds good.

    And that's one hell of a coincidence, the page coming back like that.
    Maybe they actually check their server logs ? :-)

    Hi Paul,

    I upgraded to 25H2 and I flashed the BIOS to F.13 (dated Dec 2025)
    without problem.

    Afterwards I ran Windows Update. I looked at the Event log and still got
    a 1796 and 1801. The 1801 listed FirmwareVersion:F.13 this time.

    So I reviewed all the info you sent as well and looked at the links you
    sent.

    In https://support.hp.com/us-en/document/ish_13070353-13070429-16 I
    found:

    "HP PCs released 2024 and later already ship with the Windows UEFI CA
    2023 certificate installed in the Secure Boot UEFI DB and do not require
    a BIOS update related to this change."

    So I opened Powershell as admin. And sure enough, running...

    [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
    db).bytes) -match 'Windows UEFI CA 2023'

    ... returns 'True'.

    So it appears the answer to CoPilot's recommendation **1 is that my
    notebook is good to go as far as the certificate transition is
    concerned? If so, than what else could be causing the 1796/1801 events?

    Thoughts?

    I'm beginning to think that, since the system is stable, I should just
    ignore these for now.
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Sun Apr 19 20:29:50 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/17/2026 10:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I have been following your thread as I have been getting the exact same
    error message since I bought this HP box. I have updated the bios
    today. I am unsure now if I just leave it alone to try and see if it
    can update successfully now on its own, or if I need to reset the secure
    boot keys to factory defaults. I suppose I can wait a day or two before
    doing that and see if I get an information log in event viewer saying it
    was successful?
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Mon Apr 20 03:41:37 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sun, 4/19/2026 4:48 PM, Dennis wrote:

    Hi Paul,

    I upgraded to 25H2 and I flashed the BIOS to F.13 (dated Dec 2025)
    without problem.

    Afterwards I ran Windows Update. I looked at the Event log and still got
    a 1796 and 1801. The 1801 listed FirmwareVersion:F.13 this time.

    So I reviewed all the info you sent as well and looked at the links you
    sent.

    In https://support.hp.com/us-en/document/ish_13070353-13070429-16 I
    found:

    "HP PCs released 2024 and later already ship with the Windows UEFI CA
    2023 certificate installed in the Secure Boot UEFI DB and do not require
    a BIOS update related to this change."

    So I opened Powershell as admin. And sure enough, running...

    [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI
    db).bytes) -match 'Windows UEFI CA 2023'

    ... returns 'True'.

    So it appears the answer to CoPilot's recommendation **1 is that my
    notebook is good to go as far as the certificate transition is
    concerned? If so, than what else could be causing the 1796/1801 events?

    Thoughts?

    I'm beginning to think that, since the system is stable, I should just
    ignore these for now.


    "Event ID 1796 occurs when an unexpected error is encountered.
    The event log entry will include the error code for the unexpected error.
    In this event, <event type> can be one of the following:

    "DB"
    "DBX"
    "SBAT" <=== "Secure Boot Advanced Targeting"
    "Policy Update (SKU)"
    "Windows UEFI CA 2023 (DB)"
    "Option ROM CA 2023 (DB)"
    "3P UEFI CA 2023 (DB)"
    "KEK 2023"
    "DBX SVN" <=== GRUB generation policy perhaps (integer number)
    System must be secured against using GRUB-install as a "lever"
    You don't have to be a Linux user, to get "Linux-attacked" !
    "Revoke UEFI CA 2011 (DBX)"
    "

    *******

    I'm beginning to wonder if this SBAT issue is related to using
    Ubuntu and Windows on the same machine. When I saw a couple of Canonical entries
    while using Get-SecureBootUEFIdb, I thought Ubuntu had been messing around.

    https://askubuntu.com/questions/1523438/verifying-shim-sbat-data-failed-security-policy-violation
    ( via https://askubuntu.com/questions/1523438/verifying-shim-sbat-data-failed-security-policy-violation )
    ( via https://askubuntu.com/questions/1525452/windows-does-not-boot-after-deleting-sbat-policy )

    "In particular, the SBAT list was updated by Microsoft on 20th August 2024
    to block Shim version 15.7 because of the CVE-2023-40547 remote code execution vulnerability.

    The shim SBAT data failed error means that Shim has blocked itself from executing because
    it found its own version on the SBAT block list. The SBAT block list is essentially a list
    of software versions that have security vulnerabilities and hence shouldn't be run (for details,
    see "What is SBAT and why does everyone suddenly care?").
    "

    So that claims Microsoft is modifying this "SBAT" thing as part of CVE-2023-40547.

    "Recommendations [from CVE-land]

    Do not boot a network image over HTTP from an untrusted host until this vulnerability is patched.

    Install the patched version of Shim (v15.8) from the vendor as soon as it is available.

    Linux users must also revoke the vulnerable versions of Shim <=== Microsoft is doing this too
    by running fwupdmgr update (requires fwupd).
    "

    When I see a suggestion to "disable Secure Boot" to allow some Windows thing
    to update, I'm immediately suspicious. In the case of your laptop, the HP feature
    Sure Start in the BIOS is probably also interfering with being in Setup Mode
    so a change can be entered. Sure Start is supposed to be for BIOS update analysis, but
    it might also be part of making this work (SBAT Update).

    *******

    At one time, you could look in the Windows Update and the History item, for entries with "Fail" next to them, as that would give you some idea what
    wasn't working. But I don't think anything "Fails" there any more.

    *******

    This article shows the PCA 2023 and revocation of PCA 2011 stuff.
    This is not the SBAT one I'd hoped GOogle would give me. They
    should really make these links longer...

    <https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d>
    https://support.microsoft.com/en-us/topic/secure-boot-troubleshooting-guide-5d1bf6b4-7972-455a-a421-0184f1e1ed7d

    *******

    OK, I'm still not getting a strong enough signal from online
    help, so will have to punt to CoPilot again. Apologies for
    the ridiculous length of the question and the output that results.
    The answer seems to suggest CoPilot is using the HP Support forum
    content to draw conclusions, but we'll have to watch the cites
    closely to see if it is "cheating" on an answer. There is no way
    of knowing when exactly the support forum was scraped for content.

    Available info should be located as:

    C:\Windows\System32\SecureBootUpdates\ sbatlevel.bin <=== We expect to find at least this one
    dbxupdate.bin <=== That's a certificate revocation

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD 0x0400 <=== if only the SBAT was pending, that bit is
    not included in 0x5944.
    Each bit means something (0x5944 is a mess...)

    My opinion on the quality of the answer, is the answer is still "thin".
    I can change the tone of the answer, by adding a
    "think slowly and carefully, giving a precise answer"
    directive, but I'm not sure that will help us in getting
    an answer that is any better than the fishing line we've
    reeled out so far.

    As for whether you could ignore this error in Event Viewer,
    a comparative answer would be "how many more of these holes
    are present in the back yard?". On the surface, malware
    would have to be in the box and building a persistent state
    solution for itself (perhaps), to be using a GRUB-attack
    via a signed shim. Anyway, on with the question...

    *********** CoPilot Question *************

    The errors on this laptop, continue to happen, indicating
    SBAT still isn't installed. The PCA 2023 checks now indicate True
    so that part seems to be done.

    HP 17t-cn400 laptop

    Event ID 1796

    "The Secure Boot update failed to update SBAT"
    Error code: 0x800700c1

    Event ID 1801

    "Updated Secure Boot certificates are available on this device but have
    not yet been applied to the firmware"

    DeviceAttributes:
    FirmwareManufacturer: Insyde
    FirmwareVersion: F.13 (dated Dec 2025)
    OEMModelBaseBoard: 8DBC
    OEMManufacturerName: HP
    OSArchitecture: amd64

    The first question is, for an SBAT update to work, does Secure Boot
    need to be disabled (to enter Setup Mode), or does HP Sure Start
    need to be disabled. I thought Sure Start was mostly about allowing
    the BIOS update (already done) to enter the machine.

    The advice for PCA 2023 update is like this. Presumably the SBAT update would be expected to use a different REG_DWORD than 0x5944 if just the SBAT
    was outstanding in terms of UEFI updates. Which bit in the bitfields
    would be asserted for the SBAT update ?

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

    Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

    I need your guidance on the most-likely set of conditions to finish this, seeing as the Scheduled Task seems to have made an attempt at the update
    since the F.13 BIOS was flashed in.

    *********** CoPilot Answer *************

    Here is the clearest, evidencerCabased picture of what is happening on your HP 17trCacn400
    with Insyde F.13 (DecrC>2025), why SBAT still fails with **0x800700c1**, and what
    conditions *actually* matter for the SBAT update to succeed.

    IrCOll answer your two core questions first, then walk through the registry bitfields
    and the most likely path to resolution.

    ---
    # **1. Does SBAT require Secure Boot to be disabled or Setup Mode?**
    **No rCo SBAT updates are *not* applied in Setup Mode and do *not* require Secure Boot to be disabled.**

    Across all HP cases reported in 2025rCo2026, including those with Insyde and AMI firmware, users attempted:

    - Disabling Secure Boot
    - Entering Setup Mode
    - Clearing keys
    - RerCaenabling Secure Boot
    - Resetting to factory keys

    None of these resolved SBAT failures. HP support agents repeatedly confirm that these
    steps **do not fix SBAT update failures** and that the underlying issue is firmwarerCaside incompatibility, not Secure Boot state.

    [HP Support Community]
    https://h30434.www3.hp.com/t5/AI-PCs/Event-1796-The-Secure-Boot-update-failed-to-update-SBAT/m-p/9582746)
    [HP Support Community]
    https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/The-Secure-Boot-update-failed-to-update-SBAT-with-error/m-p/9583281

    ### **So what about HP Sure Start?**
    HP Sure Start *can* block updates to Secure Boot variables **if it is enforcing key protection**, but:

    - HP support does **not** list disabling Sure Start as a required step for SBAT.
    - Users who disabled Sure Start still saw 0x800700c1.

    [HP Support Community]
    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    **Conclusion:**
    - SBAT updates do *not* require Secure Boot to be disabled.
    - SBAT updates do *not* require Setup Mode.
    - HP Sure Start is *not* the root cause of 0x800700c1.

    The failure is almost certainly firmwarerCaside.

    ---
    # **2. Which bit in `AvailableUpdates` corresponds to SBAT?**
    Microsoft has **not** published a public bitfield map for `AvailableUpdates`. HP support threads show:

    - PCA 2023 uses **0x5944** (as you already know).
    - SBATrCaonly pending updates show values like **1024 (0x400)**.

    [HP Support Community]
    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    Across multiple HP systems, when PCA 2023 is already installed but SBAT is still pending, the registry commonly shows:

    AvailableUpdates = 0x400

    This strongly suggests:

    - **Bit 0x400 = SBAT pending**
    - **Bit 0x5944 = PCA 2023 bundle (multiple bits set)**

    This is consistent with your observation: PCA 2023 now reports **True**, but SBAT still fails.

    ---
    # **3. Why SBAT still fails even after BIOS F.13 (DecrC>2025)?**
    This is the key point.

    Across HP systems from 2025rCo2026, including Insyde and AMI firmware, the **exact same SBAT failure** persists even after:

    - Updating BIOS to the latest version
    - Resetting Secure Boot keys
    - Disabling Secure Boot
    - Clearing TPM
    - Reinstalling BIOS
    - Running the scheduled task manually

    HP support agents repeatedly state:

    rCLThis error indicates a problem in the update process, potentially related to a corrupted file
    or an invalid configurationrCa monitor for a future BIOS or firmware update.rCY

    [HP Support Community]
    https://h30434.www3.hp.com/t5/AI-PCs/Event-1796-The-Secure-Boot-update-failed-to-update-SBAT/m-p/9582746
    [HP Support Community]
    https://h30434.www3.hp.com/t5/Desktop-Hardware-and-Upgrade-Questions/How-are-you-supposed-to-update-to-the-new-Secure-Boot/td-p/9592204

    In other words:

    ### **HPrCOs firmware is not yet accepting MicrosoftrCOs SBAT update on certain models rCo even with the latest BIOS.**

    This matches your symptoms exactly:

    - PCA 2023 = installed
    - SBAT = still pending
    - Scheduled task runs but fails
    - Event 1796 + 1801 continue
    - Firmware is Insyde (many affected systems are InsyderCabased)

    This is not a configuration issue on your side.

    ---
    # **4. What conditions *actually* must be met for SBAT to install?**
    Based on Microsoft + HP documentation + all known cases:

    ### **Required**
    1. BIOS/UEFI must include SBATrCacapable Secure Boot variable handling
    2. HP Sure Start must not block variable updates
    3. Windows must detect SBAT pending (`AvailableUpdates` bit set)
    4. The scheduled task must run successfully

    ### **Your system meets #2rCo4.
    It does *not* meet #1.**

    Your Insyde F.13 firmware (DecrC>2025) is **not yet SBATrCacapable**, even though it is PCArCacapable.

    This is exactly what HP support agents tell users with the same symptoms: **wait for a future BIOS update that explicitly includes SBAT support.**

    [HP Support Community]
    https://h30434.www3.hp.com/t5/AI-PCs/Event-1796-The-Secure-Boot-update-failed-to-update-SBAT/m-p/9582746

    ---
    # **5. MostrCalikely path to resolution**
    Based on all available evidence:

    ### **1. Leave Secure Boot enabled**
    HP explicitly says it is safe to leave Secure Boot enabled even when SBAT update fails.

    [HP Support Community]
    https://h30434.www3.hp.com/t5/AI-PCs/Event-1796-The-Secure-Boot-update-failed-to-update-SBAT/m-p/9582746

    ### **2. Do *not* disable Sure Start unless HP explicitly instructs you**
    It does not fix SBAT failures.

    ### **3. Monitor HP for a BIOS update newer than F.13**
    HP support repeatedly states that SBAT failures require a future firmware update.

    ### **4. You can safely ignore the SBAT failure for now**
    HP agents confirm that if the system boots normally and PCA 2023 is installed, the SBAT failure is not currently harmful.

    HP Support Community]
    https://h30434.www3.hp.com/t5/AI-PCs/Event-1796-The-Secure-Boot-update-failed-to-update-SBAT/m-p/9582746

    ### **5. The scheduled task will not succeed until HP releases SBATrCacapable firmware**
    Your system is behaving identically to other HP systems with incomplete SBAT support.

    ---
    # **6. What you can do right now**
    Here is the practical checklist:

    ### **A. Confirm your registry state**
    If AvailableUpdates = 0x400 then SBAT is the only remaining update.

    ### **B. Confirm PCA 2023 is installed**
    You already did rCo good.

    ### **C. Confirm your DBX/SBAT files**
    Check:

    C:\Windows\System32\SecureBootUpdates\

    If sbatlevel.bin or dbxupdate.bin are present but not applied,
    this matches the known HP firmwarerCarejection pattern.

    ### **D. Do NOT reset keys again**
    It does not help and can cause unnecessary wear on NVRAM.

    ### **E. Wait for HP to release an SBATrCacapable BIOS**
    This is the only known fix.

    ---
    # **7. If you want, I can help you:**
    - Decode your exact AvailableUpdates value
    - Check your DBX/SBAT file versions
    - Draft a precise message to HP support referencing your baseboard ID (8DBC)
    - Compare your F.13 firmware against known SBATrCacapable HP firmware releases

    Just tell me what you want to do next.

    *********** CoPilot Answer *************

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Mon Apr 20 05:42:06 2026
    From Newsgroup: alt.comp.os.windows-11

    On Sun, 19 Apr 2026 20:29:50 -0500, sticks <wolverine01@charter.net>
    wrote:

    On 4/17/2026 10:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the
    Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult
    Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I have been following your thread as I have been getting the exact same >error message since I bought this HP box. I have updated the bios
    today. I am unsure now if I just leave it alone to try and see if it
    can update successfully now on its own, or if I need to reset the secure >boot keys to factory defaults. I suppose I can wait a day or two before >doing that and see if I get an information log in event viewer saying it
    was successful?

    Try running Windows Update. That (I think) should trigger the event.

    How old is your PC?
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Mon Apr 20 06:14:21 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 20 Apr 2026 03:41:37 -0400, Paul <nospam@needed.invalid> wrote:

    [...]

    Hi Paul,

    Looks like I'll add yet another monthly item to my calendar (to check HP
    for updated BIOS).

    Thanks for your help on this.
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Mon Apr 20 07:22:49 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 4:42 AM, Dennis wrote:
    On Sun, 19 Apr 2026 20:29:50 -0500, sticks <wolverine01@charter.net>
    wrote:

    On 4/17/2026 10:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I have been following your thread as I have been getting the exact same
    error message since I bought this HP box. I have updated the bios
    today. I am unsure now if I just leave it alone to try and see if it
    can update successfully now on its own, or if I need to reset the secure
    boot keys to factory defaults. I suppose I can wait a day or two before
    doing that and see if I get an information log in event viewer saying it
    was successful?

    Try running Windows Update. That (I think) should trigger the event.

    Nothing yet

    How old is your PC?

    11/2025

    It looks like it tries 2-3 times every day to do this update with the
    first happening between 6 and 9 AM. I'll check later and see if it has
    failed again.
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Mon Apr 20 09:35:01 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 4/20/2026 8:22 AM, sticks wrote:
    On 4/20/2026 4:42 AM, Dennis wrote:
    On Sun, 19 Apr 2026 20:29:50 -0500, sticks <wolverine01@charter.net>
    wrote:

    On 4/17/2026 10:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I have been following your thread as I have been getting the exact same
    error message since I bought this HP box.-a I have updated the bios
    today.-a I am unsure now if I just leave it alone to try and see if it
    can update successfully now on its own, or if I need to reset the secure >>> boot keys to factory defaults.-a I suppose I can wait a day or two before >>> doing that and see if I get an information log in event viewer saying it >>> was successful?

    Try running Windows Update. That (I think) should trigger the event.

    Nothing yet

    How old is your PC?

    11/2025

    It looks like it tries 2-3 times every day to do this update with the first happening between 6 and 9 AM.-a I'll check later and see if it has failed again.

    It's every 12 hours.

    Being a scheduled task, you may be able to find it in there.

    Materials in-queue might look like this.

    C:\Windows\System32\SecureBootUpdates\ sbatlevel.bin <=== We expect to find at least this one
    dbxupdate.bin <=== That's a certificate revocation

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD 0x0400 <=== if only the SBAT was pending...
    That bit position is not set in 0x5944.
    Each bit means something (0x5944 is a mess...)

    Presumably there is some sort of ordering mechanism to take care
    of these, and perhaps the 12 hour interval is there to empty the
    queue of them, if more than one shows up.

    The AI claims that Setup Mode is not required, but (somehow)
    the BIOS interface plays a part. However, checking the links
    the AI used, they're not exactly detailed webpages. In one case,
    the answerer was likely an AI.

    I guess we'll know the truth of what CoPilot posits
    for an answer, when one of you gets this stuff to work :-)

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Mon Apr 20 09:18:39 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 8:35 AM, Paul wrote:
    On Mon, 4/20/2026 8:22 AM, sticks wrote:
    On 4/20/2026 4:42 AM, Dennis wrote:
    On Sun, 19 Apr 2026 20:29:50 -0500, sticks <wolverine01@charter.net>
    wrote:

    On 4/17/2026 10:06 AM, Dennis wrote:
    It appears I've been getting TPM-WMI errors for at least 6 months in the >>>>> Windows System Event Log.

    Most of the recent ones look like:

    "The Secure Boot update failed to update SBAT with error Unknown HResult >>>>> Error code: 0x800700c1. For more information, please see
    https://go.microsoft.com/fwlink/?linkid=2169931"

    Event ID 1796.

    I have been following your thread as I have been getting the exact same >>>> error message since I bought this HP box.-a I have updated the bios
    today.-a I am unsure now if I just leave it alone to try and see if it >>>> can update successfully now on its own, or if I need to reset the secure >>>> boot keys to factory defaults.-a I suppose I can wait a day or two before >>>> doing that and see if I get an information log in event viewer saying it >>>> was successful?

    Try running Windows Update. That (I think) should trigger the event.

    Nothing yet

    How old is your PC?

    11/2025

    It looks like it tries 2-3 times every day to do this update with the first happening between 6 and 9 AM.-a I'll check later and see if it has failed again.

    It's every 12 hours.

    Being a scheduled task, you may be able to find it in there.

    Nothing there


    Materials in-queue might look like this.

    C:\Windows\System32\SecureBootUpdates\ sbatlevel.bin <=== We expect to find at least this one

    quite a bit there, but no sbatlevel.bin. There is a sbatlevel.txt from 9/2025.

    dbxupdate.bin <=== That's a certificate revocation

    several of these in there



    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD 0x0400 <=== if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a
    data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of 0x00000001.

    Still nothing in event viewer on this and I'll check back on it later

    That bit position is not set in 0x5944.
    Each bit means something (0x5944 is a mess...)

    Presumably there is some sort of ordering mechanism to take care
    of these, and perhaps the 12 hour interval is there to empty the
    queue of them, if more than one shows up.

    The AI claims that Setup Mode is not required, but (somehow)
    the BIOS interface plays a part. However, checking the links
    the AI used, they're not exactly detailed webpages. In one case,
    the answerer was likely an AI.

    I guess we'll know the truth of what CoPilot posits
    for an answer, when one of you gets this stuff to work :-)

    Paul
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Dennis@nobody@nowhere.invalid to alt.comp.os.windows-11 on Mon Apr 20 10:25:08 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 20 Apr 2026 09:35:01 -0400, Paul <nospam@needed.invalid> wrote:

    Materials in-queue might look like this.

    C:\Windows\System32\SecureBootUpdates\ sbatlevel.bin <=== We expect to find at least this one
    dbxupdate.bin <=== That's a certificate revocation

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD 0x0400 <=== if only the SBAT was pending...
    That bit position is not set in 0x5944.
    Each bit means something (0x5944 is a mess...)


    On mine I get:

    Directory of C:\Windows\System32\SecureBootUpdates

    04/14/2026 01:29 PM <DIR> .
    04/19/2026 03:40 PM <DIR> ..
    04/11/2026 12:22 PM 91,041,426 BucketConfidenceData.cab
    04/01/2024 03:22 AM 3 dbupdate.bin
    04/01/2024 03:22 AM 4,832 dbupdate2024.bin
    05/13/2025 01:32 PM 4,829 DBUpdate3P2023.bin
    05/13/2025 01:32 PM 4,840 DBUpdateOROM2023.bin
    04/14/2026 01:14 PM 16,632 dbxupdate.bin
    04/14/2026 01:14 PM 5,017 DBXUpdate2024.bin
    04/14/2026 01:14 PM 5,094 DBXUpdate2024Legacy.bin
    04/14/2026 01:14 PM 16,709 dbxupdateLegacy.bin
    04/14/2026 01:14 PM 3,432 DBXUpdateSVN.bin
    04/14/2026 01:14 PM 3,509 DBXUpdateSVNLegacy.bin
    04/14/2026 01:14 PM 891,611 KEKUpdateCombined.bin
    04/19/2025 06:36 AM 45 SbatLevel.txt
    04/14/2026 01:14 PM 6,776 SKUSiPolicy.P7b
    14 File(s) 92,004,755 bytes
    2 Dir(s) 759,804,465,152 bytes free

    sbatlevel.bin not present.

    ***

    Contents of SbatLevel.txt:

    sbat,1,2024010900
    shim,4
    grub,3
    grub.debian,4

    ***

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD is 0x0400
    --

    Dennis in Cincinnati
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Mon Apr 20 11:00:29 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 9:18 AM, sticks wrote:
    ---snip---
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    -a-a-a-a AvailableUpdates REG_DWORD-a 0x0400-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a <===
    if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a
    data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of
    0x00000001.

    Still nothing in event viewer on this and I'll check back on it later

    The same error came back at 10:20 this morning.
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Mon Apr 20 13:05:13 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 4/20/2026 10:25 AM, Dennis wrote:
    On Mon, 20 Apr 2026 09:35:01 -0400, Paul <nospam@needed.invalid> wrote:

    Materials in-queue might look like this.

    C:\Windows\System32\SecureBootUpdates\ sbatlevel.bin <=== We expect to find at least this one
    dbxupdate.bin <=== That's a certificate revocation

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD 0x0400 <=== if only the SBAT was pending...
    That bit position is not set in 0x5944.
    Each bit means something (0x5944 is a mess...)


    On mine I get:

    Directory of C:\Windows\System32\SecureBootUpdates

    04/14/2026 01:29 PM <DIR> .
    04/19/2026 03:40 PM <DIR> ..
    04/11/2026 12:22 PM 91,041,426 BucketConfidenceData.cab
    04/01/2024 03:22 AM 3 dbupdate.bin
    04/01/2024 03:22 AM 4,832 dbupdate2024.bin
    05/13/2025 01:32 PM 4,829 DBUpdate3P2023.bin
    05/13/2025 01:32 PM 4,840 DBUpdateOROM2023.bin
    04/14/2026 01:14 PM 16,632 dbxupdate.bin
    04/14/2026 01:14 PM 5,017 DBXUpdate2024.bin
    04/14/2026 01:14 PM 5,094 DBXUpdate2024Legacy.bin
    04/14/2026 01:14 PM 16,709 dbxupdateLegacy.bin
    04/14/2026 01:14 PM 3,432 DBXUpdateSVN.bin
    04/14/2026 01:14 PM 3,509 DBXUpdateSVNLegacy.bin
    04/14/2026 01:14 PM 891,611 KEKUpdateCombined.bin
    04/19/2025 06:36 AM 45 SbatLevel.txt
    04/14/2026 01:14 PM 6,776 SKUSiPolicy.P7b
    14 File(s) 92,004,755 bytes
    2 Dir(s) 759,804,465,152 bytes free

    sbatlevel.bin not present.

    ***

    Contents of SbatLevel.txt:

    sbat,1,2024010900
    shim,4
    grub,3
    grub.debian,4

    ***

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    AvailableUpdates REG_DWORD is 0x0400


    OK, those four lines in the SbatLevel.txt are the correct ones
    for advanced targeting. One of the grub entries, is supposed
    to be +1 of the other one. The integer number is a "generation number"
    handled by the distro team for each distro. The shim would be the
    Linux shim which relies on a signing from Microsoft, so it will be
    accepted by UEFI.

    The first line sbat,1,2024010900 relates to the identity
    of the sbat item itself.

    On Linux, they have a mokutil option in the command line,
    that deletes the sbat Microsoft placed there. All we have to
    worry about (if anything), is fooling the Microsoft activity
    into thinking the process is working, so it will leave us
    alone. For the Linux people (who happened to have Secure Boot
    turned on), that Microsoft sbat would prevent Linux from
    booting (especially if GRUB2 was 15.7 (vulnerable) instead of
    15.8 (fixed). Distros like Ubuntu, would also be fiddling
    with certificates and maybe even SBAT, as owners of the thing.

    The reason Microsoft blocks it, is to prevent a "GRUB-attack"
    from using the exploit. Whereas for a Ubuntu, they would be
    preventing it because of a "direct" attack, as they rely on
    GRUB and the vulnerable GRUB needs to be replaced (and the
    old one blocked in case the 15.7 one is put back).

    The LLM-AI insists that disabling Secure Boot or HP Sure Start
    is not necessary for the SBAT. But the cites are not strong
    proof of such a thing.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Mon Apr 20 17:35:02 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 11:00 AM, sticks wrote:
    On 4/20/2026 9:18 AM, sticks wrote:
    ---snip---
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    -a-a-a-a AvailableUpdates REG_DWORD-a 0x0400-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a <===
    if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a
    data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of
    0x00000001.

    Still nothing in event viewer on this and I'll check back on it later

    The same error came back at 10:20 this morning.

    Just checked on my office desktop, also a HP about a 1.5 years old, and
    it has the same damn errors.
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Mon Apr 20 21:42:54 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 4/20/2026 6:35 PM, sticks wrote:
    On 4/20/2026 11:00 AM, sticks wrote:
    On 4/20/2026 9:18 AM, sticks wrote:
    ---snip---
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    -a-a-a-a AvailableUpdates REG_DWORD-a 0x0400-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a <=== if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of 0x00000001.

    Still nothing in event viewer on this and I'll check back on it later

    The same error came back at 10:20 this morning.

    Just checked on my office desktop, also a HP about a 1.5 years old, and it has the same damn errors.

    What are the odds that everyone has this error :-)

    I just checked the Big Machine (which is my Secure Boot test case),
    and it shows AvailableUpdates 0x0000, so it has nothing pending.
    That's an Asus motherboard and an Award BIOS.

    Paul


    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From sticks@wolverine01@charter.net to alt.comp.os.windows-11 on Mon Apr 20 21:09:10 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 8:42 PM, Paul wrote:
    On Mon, 4/20/2026 6:35 PM, sticks wrote:
    On 4/20/2026 11:00 AM, sticks wrote:
    On 4/20/2026 9:18 AM, sticks wrote:
    ---snip---
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    -a-a-a-a AvailableUpdates REG_DWORD-a 0x0400-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a <=== if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of 0x00000001.

    Still nothing in event viewer on this and I'll check back on it later

    The same error came back at 10:20 this morning.

    Just checked on my office desktop, also a HP about a 1.5 years old, and it has the same damn errors.

    What are the odds that everyone has this error :-)

    I just checked the Big Machine (which is my Secure Boot test case),
    and it shows AvailableUpdates 0x0000, so it has nothing pending.
    That's an Asus motherboard and an Award BIOS.

    So am I correct in thinking the only thing people like myself and Dennis
    can do is wait for HP to come up with the proper Bios, and right now
    they're probably claiming MS has not gotten them the proper information,
    even though miraculously Asus has somehow managed to get it right?
    --
    Science DoesnrCOt Support Darwin. Scientists Do

    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Daniel70@daniel47@nomail.afraid.org to alt.comp.os.windows-11 on Tue Apr 21 18:52:19 2026
    From Newsgroup: alt.comp.os.windows-11

    On 20/04/2026 11:35 pm, Paul wrote:

    <Snip>

    "In one case, the answerer was likely an AI."
    We're doomed, I tell you. AI quoting AI. We're doomed!!
    --
    Daniel70
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Tue Apr 21 08:28:06 2026
    From Newsgroup: alt.comp.os.windows-11

    On Mon, 4/20/2026 10:09 PM, sticks wrote:
    On 4/20/2026 8:42 PM, Paul wrote:
    On Mon, 4/20/2026 6:35 PM, sticks wrote:
    On 4/20/2026 11:00 AM, sticks wrote:
    On 4/20/2026 9:18 AM, sticks wrote:
    ---snip---
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
    -a-a-a-a-a AvailableUpdates REG_DWORD-a 0x0400-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a-a <=== if only the SBAT was pending...

    OK, so mine does have the 0x0400 value.
    Under the Servicing folder it has under has a UEFICA2023 Status with a data value as updated.
    In the State folder it has UEFISecureBootEnabled with a value of 0x00000001.

    Still nothing in event viewer on this and I'll check back on it later >>>>
    The same error came back at 10:20 this morning.

    Just checked on my office desktop, also a HP about a 1.5 years old, and it has the same damn errors.

    What are the odds that everyone has this error :-)

    I just checked the Big Machine (which is my Secure Boot test case),
    and it shows AvailableUpdates 0x0000, so it has nothing pending.
    That's an Asus motherboard and an Award BIOS.

    So am I correct in thinking the only thing people like myself and Dennis can do is
    wait for HP to come up with the proper Bios, and right now they're probably claiming
    MS has not gotten them the proper information, even though miraculously Asus has
    somehow managed to get it right?

    It stretches credulity that this is the case (that the BIOS file isn't
    actually ready for this). Your BIOS file is Dec2025,
    which is pretty damn close to the current date. But maybe that is the answer, that the job has been flubbed, multiple times.

    In any case, the primary consideration at this time, is that PCA 2023
    be completed. The SBAT thing is still an exploit waiting to happen,
    but it won't be a primary attack mechanism, it might be used if malware
    gets on board and attempts to make itself "persistent". The malware
    would be installing an exploitable version of GRUB that it could lean on.
    The SBAT is a simple integer number, indicating which generation of
    Linux shim related files are allowed. And as I understand it, an
    SBAT can even rule out an attempt to install an older (exploitable)
    version of SBAT.

    For the amount of time that has elapsed since staff at Microsoft
    woke up in 2023 and started doing a security analysis of the
    situation, it's 2026 and "the job still isn't done" :-/ A
    primary concern, is not getting sued for breaking the
    computers of people, while you fix this. A botched SBAT is
    not going to prevent Windows from booting (and Ubuntu is
    armed with a mokutil option to remove SBAT!).

    And I know the manufacturers just hate this shit, as in many cases
    they would have to fork out money to have Insyde fix this. Not
    every computing device runs an "open tab" for BIOS versions.
    A few computing devices only get the one BIOS version, as
    the seller is not interested in paying the maintenance fee
    with the BIOS maker to do more than that.

    Responsibility for the BIOS is split. The bringup code for
    a chipset, is closed source, and a binary blob is on offer.
    There are modules, similar to "driver files" in the BIOS.
    (The BIOS is like a "file system" inside.)

    The BIOS development environment does have tune-able things,
    it does have things with source, but the evidence is, this
    is not enough to cover all situations. It's hard to say
    whether the UEFI is tianocore or the like (or derived from
    it), or is a binary blob from Insyde. There aren't
    many discussions about BIOS by knowledgeable people any
    more, for me to pick up a signal. Enthusiast sites I would
    expect in a Google search, no longer show up.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Paul@nospam@needed.invalid to alt.comp.os.windows-11 on Tue Apr 21 08:59:39 2026
    From Newsgroup: alt.comp.os.windows-11

    On Tue, 4/21/2026 4:52 AM, Daniel70 wrote:
    On 20/04/2026 11:35 pm, Paul wrote:

    <Snip>

    "In one case, the answerer was likely an AI."
    We're doomed, I tell you. AI quoting AI. We're doomed!!


    That's why you have to look at the HTTP links
    the AI gives you, to see whether they are the
    real McCoy or merely "hot fluff".

    Once I see...

    "Let's dig in!"

    the game is up :-) I think they've
    mostly removed those from Harmony now.
    There are still tell-tale expressions
    indicating slop is involved.

    I cannot sit here every day, adding guard
    expressions to every AI question, on the off
    chance the AI will cheat :-) That would be
    like a low-paying baby sitting job.

    "Think slowly and carefully, giving a precise answer."

    *******

    The reason we discuss "AI things", it's not for fun.
    It's preparing you for a day, when technology gets
    in your way, and your job is to outsmart the technology.

    I was at the Mall one day, using the information display
    there. I was looking for some clothing store. While
    interacting with that piece of crap, "the floor map got rotated"
    at some weird angle. There was no "reset" on the interface,
    to tell it to go back to cartesian alignment. Well, I
    can't stand there all day long playing with the thing.
    I'm not a SmartPhone user, but I recollected there is a
    "pinch and rotate" gesture for situations like this.
    And when I tried that, the panel was multitouch, the
    gesture registered and the map rotated.

    Some day, you'll be in a dark parking lot. You'll
    say to your car "Hal, open the door". The car will
    respond "I'm afraid I can't do that, Dave". You will
    have to remember all you have learned about AI, to get
    the door open so you can be driven home. This is why
    we socialize what we learn about AI, for future purposes.

    Even the elevator at the mall, now has a personality.
    The buttons don't register reliably. You can press "5"
    and "2" lights up. This requires all of your cunning
    to overcome. One day I got on the elevator, and the
    door wouldn't close. Without even blinking, the lady
    next to me, leans down and reaches for the rubber
    covering on the door sensor (the one near the bottom
    of the door part) and she "gives it a pinch". And
    when the door goes to close this time, the cycle
    completes and off we go. You can see from examples
    like this, it's all we can do to keep up with this shit.
    Like knowing the diagnostic for the door close sensor
    is a "pinch". You never know who you're riding with
    on the elevator, it could be ElevatorEinstein.

    Paul
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From =?UTF-8?B?Li4ud8Khw7HCp8KxwqTDsQ==?=@winstonmvp@gmail.com to alt.comp.os.windows-11 on Tue Apr 21 09:19:23 2026
    From Newsgroup: alt.comp.os.windows-11

    On 4/20/2026 6:42 PM, Paul wrote:


    What are the odds that everyone has this error :-)

    I just checked the Big Machine (which is my Secure Boot test case),
    and it shows AvailableUpdates 0x0000, so it has nothing pending.
    That's an Asus motherboard and an Award BIOS.

    Paul



    Normal, and expected for most devices.
    --
    ...w-i|#-o-#-n|#
    --- Synchronet 3.21f-Linux NewsLink 1.2
  • From Daniel70@daniel47@nomail.afraid.org to alt.comp.os.windows-11 on Wed Apr 22 20:54:43 2026
    From Newsgroup: alt.comp.os.windows-11

    On 21/04/2026 10:59 pm, Paul wrote:
    On Tue, 4/21/2026 4:52 AM, Daniel70 wrote:
    On 20/04/2026 11:35 pm, Paul wrote:

    <Snip>

    "In one case, the answerer was likely an AI."
    We're doomed, I tell you. AI quoting AI. We're doomed!!

    That's why you have to look at the HTTP links the AI gives you, to
    see whether they are the real McCoy or merely "hot fluff".

    Once I see...

    "Let's dig in!"

    the game is up :-) I think they've mostly removed those from Harmony
    now. There are still tell-tale expressions indicating slop is
    involved.

    I cannot sit here every day, adding guard expressions to every AI
    question, on the off chance the AI will cheat :-) That would be like
    a low-paying baby sitting job.

    "Think slowly and carefully, giving a precise answer."

    *******

    The reason we discuss "AI things", it's not for fun. It's preparing
    you for a day, when technology gets in your way, and your job is to
    outsmart the technology.

    I was at the Mall one day, using the information display there. I was
    looking for some clothing store. While interacting with that piece of
    crap, "the floor map got rotated" at some weird angle. There was no
    "reset" on the interface, to tell it to go back to cartesian
    alignment. Well, I can't stand there all day long playing with the
    thing. I'm not a SmartPhone user, but I recollected there is a "pinch
    and rotate" gesture for situations like this. And when I tried that,
    the panel was multitouch, the gesture registered and the map
    rotated.

    Some day, you'll be in a dark parking lot. You'll say to your car
    "Hal, open the door".

    NO!! NO!! *NEVER* interact with ANY computer system called 'HAL'!!

    You do recall the (supposed) story behind calling *THAT* computer system
    'HAL', don't you, Paul??

    The car will respond "I'm afraid I can't do that, Dave". You will
    have to remember all you have learned about AI, to get the door open
    so you can be driven home.

    Sledgehammer through the Window should get you in the Car. ;-P

    This is why we socialize what we learn about AI, for future
    purposes.

    Even the elevator at the mall, now has a personality. The buttons
    don't register reliably. You can press "5" and "2" lights up. This
    requires all of your cunning to overcome. One day I got on the
    elevator, and the door wouldn't close. Without even blinking, the
    lady next to me, leans down and reaches for the rubber covering on
    the door sensor (the one near the bottom of the door part) and she
    "gives it a pinch". And when the door goes to close this time, the
    cycle completes and off we go. You can see from examples like this,
    it's all we can do to keep up with this shit.

    What's the bet that the building that that Elevator Company is in
    DOESN'T have their brand Elevators in it??

    Like knowing the diagnostic for the door close sensor is a "pinch".
    You never know who you're riding with on the elevator, it could be ElevatorEinstein.

    One can live in Hope, can't one??

    Paul

    --
    Daniel70
    --- Synchronet 3.21f-Linux NewsLink 1.2