Event details
In a vmware 8.x environment we can see null PKs and empty DBX from guest VMs with secure boot enabled. KEK and DB contain 2011 MS CA certificates.
What should I expect in this scenario?
Is the empty DBX correct?
Will this VMs automatically update the certificates?
With a null PK, the certificates cannot be automatically updated by the guest OS. If TPM is used, the certificates cannot be automatically updated by the firmware / virtualization solution.
For the empty DBX, you can push the DBX update via AvailableUpdates 0x0002 and check event log if it sticks.
In general, ask VmWare not Microsoft :)
