I had the same problem on a Lenovo ThinkPad P52.

In the BIOS, Secure Boot was enabled, but Windows 11 showed "Secure Boot State" as "Off".

The cause was, that the Secure Boot Mode in my BIOS was set to "Setup Mode".

To change it to "User Mode", I had to select "Restore Factory Keys" on the Security Page in the BIOS.

After that, I could start the computer and Windows 11 displayed that the Secure Boot State is "On".

Maybe this helps someone.

the Secure Boot mode was Enabled and forced to the Active state by following steps from this amazing video: https://www.youtube.com/watch?v=0eC9gT8mDPY

many thanks to the author of that short youtube tutorial!

The steps are as follows:

1. Enter BIOS by pressing the DEL keyboard key during the initial boot of the device.
2. navigate to the BOOT section in the BIOS management GUI
3. make sure, that the CSM Support is disabled, if not - change it to DISABLED!
4. Secure Boot Mode change to Custom
5. Secure Boot Mode change to Standart
6. Install factory defaults - click YES
7. Reset Without Saving - NO
8. Secure Boot - set to ENABLED if it's not enabled yet
9. Secure Boot Mode - make sure that the STANDART option is selected

save & exit the BIOS tool, the restart procedure of your PC should start automatically. Voila! It works! Now, the Secure Boot State is ON

Use the following steps to re-enable Secure Boot on the HP notebook without a clean OS install and recover from the boot issue.

1. First, get Windows booting again If enabling Secure Boot makes Windows unable to start, follow this recovery sequence:
   1. Turn on the notebook and immediately press the HP BIOS key repeatedly (often Esc or F10) to enter the UEFI/BIOS menu.
   2. In the BIOS, locate Secure Boot (usually under Security, Boot, or Authentication) and set it to Disabled so the system can boot again.
   3. Save changes and exit; confirm that Windows now starts normally.
2. Reset Secure Boot keys to factory defaults (if available)
   1. Re-enter the BIOS/UEFI menu.
   2. Go to the Secure Boot section.
   3. If there is an option like Reset to factory defaults or Reset Secure Boot keys, choose that (do not choose Clear; use Reset if both exist).
   4. Save and exit, then let Windows boot once with Secure Boot still disabled.
3. Ensure the system is configured for UEFI boot In Windows 11:
   1. Go to Settings > System > Recovery.
   2. Under Advanced startup, select Restart now.
   3. On the blue screen, select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart to return to BIOS.
   4. In BIOS, make sure the boot mode is UEFI (not Legacy/CSM). If both are available, ensure UEFI is first or only.
   5. Save changes and exit, confirm Windows still boots.
4. Re-enable Secure Boot
   1. Boot again into the BIOS/UEFI menu.
   2. Find the Secure Boot setting and set it to Enabled.
   3. If the BIOS offers a choice like Standard or Custom, select the default/standard option, or if required, load the built‑in Secure Boot keys.
   4. Save changes and exit.
5. If the PC still cannot boot with Secure Boot enabled
   1. Go back into BIOS and disable Secure Boot again so Windows can start.
   2. From Windows, open an elevated Command Prompt and repair EFI boot files as described in the recovery procedure (only if boot files are damaged):
      • Boot to Windows (with Secure Boot disabled).
      • Open Command Prompt as Administrator and run, one by one:

                mountvol s: /s
                del s:\*.\* /f /s /q
                bcdboot %systemroot% /s S:
        

      • After “Boot files successfully created.”, restart the device.
   3. Re-enter BIOS and try enabling Secure Boot again.
6. If none of the above works Contact HP support for device‑specific BIOS guidance. As a last resort, reinstalling Windows from recovery media with UEFI mode and then enabling Secure Boot may be required, but that is only after the above steps and vendor assistance.

References:

• Windows 11 and Secure Boot
• Disabling Secure Boot
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932