Event details
MicrosoftHello G0B1IN5486
Hyper-V VMs should be able to update the certs to new 2023 certificates when you set the registry key AvailableUpdates value to 0x5944. Are you observing failure to apply certs via this method?
I found if the Hyper-V host does not support secure boot, then the VM's won't support it either. Also if the Hyper-V VM is an older format, and does not include secure boot, then it will not be able to be updated, I have server VM that was running server 2016 and is now on Server 2022 but has never had Secure boot enabled or available since it was an old Gen 1 VM. As far as I know, you need to have a secure boot enable Host, and you will need to rebuild the VM to support Secure Boot. Unless there is an easier way, I would love to know!
- Prabhakar_MSFT
Hello Cliff_Hughes All Generation 2 VMs support Secure Boot. Have you observed that you cannot have Secure Boot enabled on a Generation 2 VM if Hyper-V Host have Secure Boot disabled?
No it's not a gen 2 VM. I was previously on a system without secure boot on the hyperv host, and this vm was created and migrated from there, so it is a Gen 1 VM, that has no support for Secure boot. All my gen 2 VM's updated fine, once I had the host patched with current monthly updates and updated the secure boot certs there. My gen 1 VM is the only one that I can't update, since it does not support secure boot at all. My understanding is if the VM was not created as a gen 2 from the start, it will have to be replaced or rebuilt. I have been putting this off because it is the domain controller for my lab.
- Prabhakar_MSFT
Generation1 VMs does not support UEFI secure boot. So the new certificates are not applicable for GEN1 VMs. What is the issue you are observing with updates on GEN1 VMs?