Install-Module -Name PSWindowsUpdate -Force

Get-WindowsUpdate -AcceptAll -Install -AutoReboot

HP G2
Download the TPM 2.0 installer find link, just run it
Might need to disable secure boot first

When running the Bios update Go directly to the folder and run the 64 bit installer.

Find link or zip installers

HP Generation 2 (G2) Lifecycle Guide: TPM 2.0 & Secure Boot 2023 Migration

Target Hardware Support

• All-in-One Units: HP EliteOne 800 G2 AIO

• Desktop Units: HP EliteDesk / ProDesk 600 & 800 G2 (Mini, SFF, Tower)

The Architectural Problem

HP G2 machines manufactured around 2016 ship hardcoded with TPM 1.2 and a stale 2011 cryptographic certificate matrix in their NVRAM database.

Updating the system BIOS to the latest versions (such as N11 Ver. 02.60 or similar) prepares the motherboard architecture for modern security standards, but it does not automatically upgrade the hardware chip or inject the mandatory WINDOWS_UEFI_CA_2023 certificate keys. If left unconfigured, these systems remain exposed to legacy exploits and will fail modern deployment compliance audits.

Phase 1: Motherboard Firmware Preparation

To upgrade the security chip, the BIOS must first expose the device interfaces to the underlying operating system.

1. Restart the computer and tap F10 repeatedly to enter the HP Computer Setup Utility.

2. Navigate to Security $\rightarrow$ Device Security.

3. Locate Embedded Security Device and change its status from Hidden to Available.

4. Go to the Main tab, select Save Changes and Exit, and let the machine reboot completely.

5. Re-enter the BIOS (Tap F10) as the computer restarts.

6. Navigate to Security $\rightarrow$ Embedded Security.

7. Ensure Embedded Security Device is configured to Device Enabled.

8. Ensure TPM State is configured to Enable and Activate.

9. Verify that TPM Activation Policy is set to Allow user to reject (or No Prompts if available). Do not alter the "Clear TPM" setting yet.

10. Go to the Main tab, select Save Changes and Exit, and log completely back into your Windows desktop environment.

Phase 2: Clearing the Chip Ownership Constraint

Crucial Warning: Windows aggressively attempts to claim and initialize any unmanaged security devices it finds upon desktop load. If Windows re-provisions the TPM chip before the flash tool is executed, the chip firmware will lock, causing the update utility to fail with an access-denied error.

1. Right-click the Windows Start Button and open PowerShell (Admin) or Terminal (Admin).

2. Freeze the Windows automated background configuration module by executing the following command:
   
   

Powershell Disable-TpmAutoProvisioning

Purge the active cryptographic keys and ownership locks directly from the system architecture by executing:
Clear-Tpm

1. Windows will present a dialog box requesting a system restart. Confirm the prompt and let the machine reboot.

2. Watch the monitor closely during startup. Before loading Windows, a dark HP hardware screen will display a security warning stating that a request has been made to clear the TPM chip.

3. Press the required physical key immediately (typically F1 or F2) to authorize the deletion. The computer will automatically finish booting back to your desktop.

Phase 3: Flashing the Physical TPM Microcode

With the chip cleared and Windows auto-provisioning temporarily frozen, the physical silicon layer is unprotected and ready to receive the modern 2.0 configuration image.

1. Download the official HP TPM transformation firmware tool directly from the verified HP storage repository:

   • Direct Link: HP SoftPaq SP87753 Utility

2. Run the downloaded executable file. This will automatically extract the update payloads to the default local directory: C:\SWSetup\SP87753

3. Open an elevated PowerShell (Admin) window.

4. Change your execution directory path straight to the extracted folder location by running:

cd C:\SWSetup\SP87753 

Initiate the hardware upgrade process using the targeted silent argument flags to convert the engine directly to version 2.0: 

.\TPMConfig64.exe -s -a2.0

1. The computer will instantly force a hard system reset. Do not disturb the device during this cycle. The display panel will remain black, and the internal cooling fans may spin at maximum velocity for 20 to 30 seconds while the flash chip writes the new microcode to the motherboard surface.

Phase 4: Validating Security & Loading 2023 Certs

Once the machine boots back into Windows, follow these final validation steps to complete the upgrade and apply the modern certificate hierarchy:

Hardware Validation

1. Press Windows Key + R, type tpm.msc, and hit Enter.

2. The TPM Management console will open. Verify that the Specification Version now proudly reads 2.0.

Cryptographic Key Ingestion

1. Restart the computer and tap F10 to enter the BIOS configuration utility for the final time.

2. Navigate to Advanced $\rightarrow$ Secure Boot Configuration.

3. Select the option that states Reset Secure Boot keys to factory defaults or change ownership parameters to HP Factory Keys.

4. Save your changes and exit to the desktop.

The updated G2 motherboard will now cleanly flush its obsolete 2011 certificate tracking tables and sign its NVRAM validation databases with the fresh, secure WINDOWS_UEFI_CA_2023 certification matrix, ensuring full system compliance.

If the cursor is still just blinking on a blank new line without giving any error or returning control to the prompt, the application has officially locked up.

On an EliteOne 800 G2 AIO, this exact freezing behavior happens because Windows Device Guard or Virtualization-Based Security (VBS) is silently isolating the kernel. The 2016-era HP flashing driver (CpqOemIf.sys or similar) is trying to touch the motherboard's physical security layers, but Windows is trapping the driver in a virtual sandbox, causing it to freeze infinitely.

We need to temporarily drop the virtualization shield so the HP utility can actually see the hardware.

Step 1: Force Kill the Frozen Process

First, let's stop the frozen background tool so we can reset.

1. In your PowerShell window, press Ctrl + C to force-break the execution.

2. If the prompt doesn't return, close that PowerShell window entirely, open a fresh PowerShell (Admin) window, and run this command to kill any stuck instances:

3. PowerShell

Stop-Process -Name TPMConfig64, HpFirmwareUpdRec64 -ErrorAction SilentlyContinue

Step 2: Disable Windows Kernel Shields

We must temporarily disable the security architectures blocking legacy hardware drivers.

1. Open your Start Menu, type Core Isolation, and open the system settings panel.

2. Toggle Memory Integrity to OFF (if it isn't already).

3. Open your Start Menu again, type Turn Windows features on or off, and open it.

4. Scroll all the way to the bottom and locate these two items:

   • Virtual Machine Platform

   • Windows Hypervisor Platform

5. Uncheck both boxes if they are checked.

6. Click OK and restart your computer.

Step 3: Use the Native Command Prompt Alternate

Sometimes PowerShell's internal security wrappers add an extra layer of interference. We will bypass PowerShell entirely and use the standard Windows Command Prompt.

1. Right-click the Start Button and select Command Prompt (Admin) or Terminal (Admin). (Ensure the window title says "Command Prompt", not PowerShell).

2. Change into the HP update directory:

3. DOS

cd C:\SWSetup\SP87753

4. 
   
5. 
   

6. Instead of using the automatic utility, let's look at the actual .bin update payload files stored inside your folder. Run this command to see them:

7. DOS

dir *.bin

8. 
   
9. 
   

10. You will see a file listed named something like TPM12_to_TPM20_v5.62.3126.0.bin. Execute the raw firmware utility manually by explicitly naming that bin file:

11. DOS

HpFirmwareUpdRec64.exe -b -p -f TPM12_to_TPM20_v5.62.3126.0.bin

12. 
    

13. (Note: Adjust the numbers at the end of the filename if yours says a slightly different version number like 5.62.x.x).

Because the virtualization shield is down and we are running through the raw command console, the HP flashing wrapper will immediately step out of the way, read the chip, and initiate the automatic 20-second hardware reboot cycle!

Here is the clean breakdown formatted explicitly for a Google Sites page. It uses clean, standard text formatting with zero structural boxes or borders, allowing you to copy and paste it seamlessly into any web text block layout.

HP EliteOne 800 G2 AIO: TPM 2.0 Override & Flash Execution

Phase 1: Overriding the Windows Security Hypervisor

Because older builds of Windows 10 and 11 run Virtualization-Based Security (VBS) in the background, the system kernel blocks legacy HP flashing drivers from accessing motherboard registers. This causes the update tools to freeze infinitely without throwing errors. The hypervisor shield must be dropped from the boot configuration database before flashing.

1. Right-click the Windows Start Button and open Command Prompt (Admin). Do not use PowerShell for this phase.

2. Execute the following command to completely disable the hypervisor engine for the next boot cycle: bcdedit /set hypervisorlaunchtype off

3. Confirm the console displays the response: The operation completed successfully.

4. Restart the computer immediately to apply the configuration bypass.

Phase 2: Terminating Stuck Background Processes

If previous flash attempts have been executed, the dead tasks may still reside in system memory blocks, preventing the utility from establishing a clean connection to the security hardware interface.

1. Log back onto the desktop and open a fresh instance of Command Prompt (Admin).

2. Run the following string task to clear out any frozen microcode wrappers: taskkill /F /IM TPMConfig64.exe /IM HpFirmwareUpdRec64.exe 2>nul

Phase 3: Executing the Raw Firmware Flash

With the virtualization layers disengaged and memory loops cleared, the raw update binary payload can be pushed directly down to the physical chip layer.

1. In your Command Prompt window, point the directory navigation directly to the extracted HP software folder path: cd C:\SWSetup\SP87753

2. Verify the exact name of your local firmware payload by listing the folder contents: dir *.bin

3. Run the low-level flashing tool by calling the file name explicitly, incorporating the batch and policy-bypass parameters. Adjust the file name if your version extension numbers differ slightly: HpFirmwareUpdRec64.exe -b -p -f TPM12_to_TPM20_v5.62.3126.0.bin

4. The system will process the block and immediately force a hard restart. Leave the computer undisturbed while the monitor is blank and the internal cooling fans run at high speed. The motherboard will complete the hardware transition within 20 to 30 seconds.

Phase 4: Re-enabling the Hypervisor Shield

Once the computer successfully boots back to the desktop, the firmware conversion is complete. The system hypervisor should be restored to keep standard Windows virtualization and security defenses fully functional.

1. Open Command Prompt (Admin) one last time.

2. Execute the following string to return the boot configuration to its normal automation rules: bcdedit /set hypervisorlaunchtype auto

3. Restart the computer to complete the operational cycle. You are now running a certified, compliant native TPM 2.0 system.

Troubleshooting: "Command Not Recognized" Error

If the console returns an error stating that HpFirmwareUpdRec64.exe is not recognized as an internal or external command, the Command Prompt instance has defaulted back to the root system directory and is looking in the wrong folder. You must manually point the path back to the unpacked HP tools.

1. Redirect the active command directory path to the SoftPaq deployment folder: cd C:\SWSetup\SP87753

2. Re-execute the hardware information probe once the directory path reads C:\SWSetup\SP87753>: HpFirmwareUpdRec64.exe -i

Troubleshooting: Forced SoftPaq Extraction via Command Line

If graphical extraction utilities fail to change the folder contents or reveal the hidden flashing tools, the HP installer package can be forced to unpack its core payload layout using native execution switches via the Windows command line.

Step 1: Navigating to the Download Source

1. Open a standard Command Prompt terminal window.

2. Change the directory path to target your default user profile Downloads folder: cd %userprofile%\Downloads

Step 2: Executing the Extraction Switch Parameters

1. Run the downloaded SoftPaq executable using the silent allocation and targeted path override switches. This bypasses the installation wizard and dumps the raw files into a clean directory: sp87753.exe /s /f "C:\SWSetup\SP87753"

2. If you prefer to extract the files directly onto your desktop for easy viewing, utilize this alternative path format instead: sp87753.exe /s /f "%userprofile%\Desktop\HPFiles"

Step 3: Verification

Open the targeted output folder. The directory contents will now successfully display the low-level flashing engine (HpFirmwareUpdRec64.exe) alongside the complete array of security chip upgrade microcode files (*.bin).

Troubleshooting: Automated cURL Download Bypass

If running the SoftPaq installer or command-line extraction tools results in a total system freeze with zero output, the file package may be corrupted or blocked by OS-level execution guards. You can use the built-in Windows cURL engine to stream the raw utility components directly into a fresh root directory, bypassing the broken installer framework entirely.

Step 1: Provisioning a Clean Directory

1. Open Command Prompt (Admin).

2. Generate an isolated folder directory directly on the root of the local disk: mkdir C:\HPFlash

Step 2: Stream the Binary Directly via cURL

1. Execute the native Windows download tool to fetch the file binary cleanly from the official HP asset repository: curl -o C:\HPFlash\HpFirmwareUpdRec64.exe https://ftp.hp.com/pub/softpaq/sp87501-88000/sp87753.exe

2. Wait for the transfer percentage block in the terminal window to reach 100%.

Step 3: Accessing the Target Files

1. Pivot the active terminal window path into the newly created folder: cd C:\HPFlash

2. List the directory contents to verify the deployment engine is present: dir

The low-level firmware engine will now be fully visible and ready for execution, completely unencumbered by installer blocks.

Now that you have the file natively downloaded into C:\HPFlash, we are in the home stretch.

Because curl pulled the raw binary package down for us, we just need to use the tool itself to unpack the rest of the missing .bin files right into that same folder. Then, we can finally run the flash command.

Here are the final execution steps to complete the upgrade, followed by a clean copy-and-paste section for your Google Site.

Clean Google Sites Format (No Boxes)

You can copy and paste this final phase sequence straight into your Google Site to show users how to complete the flash sequence once the file is successfully downloaded.

Phase 3: Unpacking and Executing the Final Flash

Once the raw executable payload is securely located inside the localized C:\HPFlash directory, the utility can be used to unpack its own internal component arrays natively, bypassing the broken Windows installer subroutines completely.

Step 1: Extracting the Internal Firmware Binaries

1. Open Command Prompt (Admin) and ensure the path reads C:\HPFlash>. If needed, navigate back to the folder using:

2. cd C:\HPFlash

3. Run the tool using the internal extraction switches to dump the underlying microcode files directly into the active folder block:

4. HpFirmwareUpdRec64.exe -s -p"C:\HPFlash"

5. Verify the binary extraction loop completed successfully by listing all available firmware files:

6. dir *.bin

Step 2: Probing the Motherboard Security Chip

1. Execute the system interrogation flag to force the motherboard to report the exact microcode version currently running on the physical security silicon:

2. HpFirmwareUpdRec64.exe -i

3. Locate the line reading Current TPM Firmware Version on your screen and note the version string family (such as 5.51 or 5.61).

Step 3: Executing the Final 2.0 Flash

1. Review your file list from Step 1 and identify the specific file that contains the prefix TPM12_to_TPM20 and matches your current version number.

2. Run the low-level flashing utility, appending the explicit file name parameters to complete the hardware transition. Change the filename at the end of this command to match your target file exactly:

3. HpFirmwareUpdRec64.exe -b -p -f TPM12_to_TPM20_v5.62.3126.0.bin

4. The system will process the instruction set and immediately execute a hard hardware reset. The monitor screen will remain completely dark and the internal machine cooling fans will spin at maximum capacity for 20 to 30 seconds while the new microcode layer is physically written to the chip surface. Do not disrupt power to the system during this operational phase. When the machine boots back to the desktop, the unit will be natively running a fully compliant TPM 2.0 architecture.

Troubleshooting: Resolving the Command Usage Switch Menu

If executing the downloaded SoftPaq file displays a usage helper menu explaining the definitions of the /s, /e, and /f switches rather than processing the files, the utility is requiring an explicit target path structure to dump its archive contents.

Step 1: Applying the Target Path Switches

1. Open Command Prompt (Admin) inside the C:\HPFlash directory path.

2. Execute the extraction payload command utilizing the exact switch combinations requested by the utility menu: HpFirmwareUpdRec64.exe /s /e /f C:\HPFlash

(Note: If your downloaded file retains its original naming convention from the download block, substitute the file name in the string to match: sp87753.exe /s /e /f C:\HPFlash).

Step 2: Verifying Payload Extraction

1. Query the folder contents to verify that the raw binary files have been successfully unpacked into the workspace directory: dir *.bin

2. The directory will now cleanly display the true low-level firmware flashing engine alongside the update configuration files.

Step 3: Executing the Final Flash Routine

1. Query the physical motherboard security registers to read the active chip revision version: HpFirmwareUpdRec64.exe -i

2. Deploy the final upgrade sequence by calling the explicit binary payload name that matches your active chip version family: HpFirmwareUpdRec64.exe -b -p -f TPM12_to_TPM20_v5.62.3126.0.bin

Troubleshooting: Manual Directory Structure for UEFI Flashing

If the extraction routine unpacks the raw firmware payloads directly into the workspace directory without automatically creating the standard Hewlett-Packard folder hierarchy, the directory path must be constructed manually on the USB media. HP motherboards expect a specific folder architecture to read files at the boot layer.

Step 1: Formatting and Path Generation

1. Insert a standard USB flash drive into the system, right-click the drive in File Explorer, and format it explicitly to FAT32. Note the assigned drive letter (e.g., E:).

2. Open Command Prompt (Admin) and switch the active drive partition to target your USB drive letter (replace E: with your drive letter): E:

3. Execute the directory generation command to build the exact layout required by the native UEFI firmware manager: mkdir "E:\Hewlett-Packard\BIOS\New"

Step 2: Transferring the Firmware Assets

1. Execute a copy string to push all extracted assets from the local repository directly into the newly generated USB destination path: copy C:\HPFlash*.* "G:\Hewlett-Packard\BIOS\New"

Step 3: Launching the UEFI Flash Routine

1. Keep the USB drive connected to the hardware interface and restart the machine.

2. Tap the Escape key continuously during the initial power cycle to load the HP Startup Menu.

3. Press F10 to enter the BIOS Setup utility configuration interface.

4. Navigate to the Main or Security menu tab and select Update System BIOS or Firmware Management.

5. Choose the option to check for updates via attached storage media. The motherboard will automatically crawl the Hewlett-Packard\BIOS\New directory structure on the USB drive, detect the valid firmware payloads, and execute the hardware flash. The system fans will ramp up to maximum speed for roughly 20 seconds while the chip completes its physical transition to native TPM 2.0.

Phase 4: Executing From an Extracted USB Environment (Drive G)

If the installation files have already been successfully unpacked and reside exclusively on an external USB device designated as Drive G, the firmware modification utility can be triggered natively via the Windows command line targeting the storage media partition.

Step 1: Targeting the Media Partition

1. Insert the USB drive containing the extracted payloads into the target machine.

2. Launch an administrative instance of the Command Prompt console.

3. Switch the terminal directory focus directly to your target storage letter: G:

4. Navigate into the specific repository folder where your update payloads reside: cd Hewlett-Packard\BIOS\New

Step 2: Identifying the Target Configuration

1. Query the folder matrix to list the exact firmware binary payload name matching your hardware group: dir *.bin

2. Highlight or copy the full filename designated with the prefix TPM12_to_TPM20.

Step 3: Launching the Silicon Override

To prevent background application freezing during hardware handshake routines, deploy the flash processing strings using silent allocation parameters. This forces the processing engine to run directly as a background kernel task:

HpFirmwareUpdRec64.exe -s -f TPM12_to_TPM20_v5.62.3126.0.bin

Note: Verify that the .bin filename parameters match the explicit string listed on your storage media.

Step 4: Staging and Installation Routine

The command utility terminal line will pause quietly for roughly 15 to 30 seconds while staging the installation framework to the system pre-boot cache. The computer will automatically trigger a hard hardware restart environment. The display panel will turn completely black and internal cooling fans will ramp to maximum operational speed for 20 seconds while the chip completes its microcode rewrite. Re-enable default Secure Boot protections inside the F10 configuration options menu upon final boot to finish the deployment.