r/HyperV • u/Evening_Link4360 • 13d ago

Secure Boot Sometimes Doesn't Work After Migration?

Server 2022 VM's, UEFI, from vSphere, using Veeam instant recovery. Most of the VM's will not boot with Secure Boot enabled under Security, but some do. I cannot tell a rhyme or reason. I'd obviously like to be able to turn on Secure Boot for all of them.

Has anyone experienced this before?

5 Upvotes

86% Upvoted

7 comments sorted by

1

u/headcrap 13d ago

I rolled instant recovery in 2025, well before the new certificate was rolling out. Does sound like some interplay with the new cert. Have you tried changing the template to MS UEFI Cert Authority by chance? I've needed that for some Linux VMs as of late..

1

u/Evening_Link4360 5d ago

Yup, tried both templates. Host is completely patched as well.

2

u/Onoitsu2 13d ago

Probably has to do with their actual image booted into that kickstarts the restore process for instant recovery being signed only with the older secure boot keys that have expired recently enough. I believe most of those "instant recovery" paths that these backup solutions do have to inject something into that bootloader process so it can handle the potential underlying storage volume changes from such a migration. I know that's how Acronis does it, almost a PXE-like network path injection is required.

1

u/jmittermueller 13d ago

BIOS / UEFI?

1

u/BlackV 13d ago

I'd be checking what versions of the secure boot databases are installed and enabled

what is the host supplying that is the guest supplying

1

u/Main_Ambassador_4985 13d ago

When I migrated from VMware to Hyper-V I disabled secure boot.

I turned it back on after a testing on Hyper-V

We had TPM issues on our hosts also and had to leave it disabled. We just refreshed and will be testing before Hyper-V to Hyper-V migration.

We never got TPM working under ESXi 7.

1

u/BlackV 13d ago

TPM is separate form secure boot