UEFICA2023Status stuck at InProgress and Secure Boot DB update not applying (TPM-WMI 1796/1801)

Question

I’m trying to apply the Secure Boot 2023 certificate update (UEFI CA 2023) on my system, but it does not complete.

System details:

• Device: HP EliteBook 840 G8
• BIOS Version: 01.23.00 (Nov 2025)
• OS: Windows 11 (fully updated)

Current state:

• Secure Boot: Enabled
• TPM: “Ready for use”
• UEFICA2023Status: InProgress

What I have tried:

Ran the scheduled task manually:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

1. Restarted the system multiple times (including double reboot cycle)
2. Waited after running the task before rebooting
3. Ensured BIOS is updated to the latest version
4. Verified Secure Boot is enabled and system is in standard mode

Verification result: The following check returns False, indicating the update is not applied:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

Event Viewer logs: I consistently see TPM-WMI errors when running the task:

• Event ID 1796
• Event ID 1801

These appear during attempts to apply the Secure Boot update.

Issue: It seems Windows is scheduling and attempting the update, but the firmware is not committing it. The status remains stuck at InProgress, and the UEFI CA 2023 certificate is not present.

Question:

• Is this expected behavior on certain firmware (e.g., HP Sure Start systems)?
• Does Event ID 1796 indicate firmware rejection of the Secure Boot update?
• Is there any way to force the update, or is this dependent on a future BIOS/firmware update?

Any clarification would be appreciated.I’m trying to apply the Secure Boot 2023 certificate update (UEFI CA 2023) on my system, but it does not complete.

Answer 1

Hi,

In this case, you usually have to wait for the BIOS updates to come with the updated keys. I had something similar with HP versions where, after updating the BIOS...

https://support.hp.com/br-pt/drivers/swdetails/hp-elitebook-840-g8-notebook-pc/38216725/swItemId/ob-357381-1

Your laptop model version indicates that the key update is done through the BIOS update, version 01.22 and after updating, you just have to wait for it to complete the process automatically.

Before you update the BIOS, you have to disable BitLocker.

https://support.hp.com/br-pt/drivers/hp-elitebook-840-g8-notebook-pc/38216725

To disable BitLocker, open the command prompt (admin) and run the command: manage-bde -off C:, and wait for the decryption process.

While this is not a Microsoft website, it is the official site of [HP/ EliteBook 840 G8].

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Thank

Answer 2

Event IDs 1796 and 1801, together with UEFICA2023Status staying at InProgress, indicate that Windows is attempting to apply the Secure Boot update but is encountering errors when updating the Secure Boot variables in firmware.

From the documented behavior:

• When a Secure Boot update is applied and an unexpected error occurs that is not covered by other events, Event ID 1796 is logged. The message is:

  The Secure Boot update failed to update <event type> with error <error code>. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

  Windows will then try to apply the Secure Boot update again on the next system restart.
• This confirms that the update is not successfully committed and that Windows is repeatedly retrying the operation, which matches the observed InProgress status.
• The documentation does not state that Event ID 1796 itself proves a firmware “rejection,” only that an unexpected error occurred during the attempt to update one of the Secure Boot variables (such as DB, DBX, SBAT, KEK, or the 2023 CA entries). The specific error code in the event details is required to determine the exact cause.
• For cases where BitLocker configuration would block the Secure Boot update, Event ID 1032 is logged instead, and the documented resolution is to temporarily suspend BitLocker using:

    Manage-bde –Protectors –Disable %systemdrive% -RebootCount 2
  

  then reboot twice and re‑enable with:

    Manage-bde –Protectors –enable %systemdrive%
  

For troubleshooting and next steps, the documented guidance is:

1. If UEFICA2023Status remains InProgress for an extended period, restart the device and check again after about 15 minutes.
2. If the issue persists, review the System event log entries for TPM-WMI (including Event ID 1796) and follow the guidance in the Secure Boot DB and DBX variable update events article for further troubleshooting.
3. If Event ID 1032 appears, suspend BitLocker as described above, allow two restart cycles for the update to apply, then re‑enable BitLocker.

The available documentation does not state that the behavior is expected or specific to HP Sure Start systems, nor does it provide a method to “force” the update beyond the standard mechanisms (Windows Update, scheduled Secure-Boot-Update task, restarts, and resolving any BitLocker-related blocking conditions). If the firmware continues to return errors (as indicated by repeated Event ID 1796), resolution may depend on addressing the specific error code shown in the event details or on future firmware/BIOS updates from the device manufacturer.

---

References:

• Secure Boot Certificate Updates for Windows 365
• Secure Boot Certificate Updates for Azure Virtual Desktop
• Secure Boot DB and DBX variable update events