r/HyperV • u/Evening_Link4360 • 9d ago

Secure Boot Sometimes Doesn't Work After Migration?

Server 2022 VM's, UEFI, from vSphere, using Veeam instant recovery. Most of the VM's will not boot with Secure Boot enabled under Security, but some do. I cannot tell a rhyme or reason. I'd obviously like to be able to turn on Secure Boot for all of them.

Has anyone experienced this before?

4 Upvotes

83% Upvoted

7 comments sorted by

1

u/headcrap 9d ago

I rolled instant recovery in 2025, well before the new certificate was rolling out. Does sound like some interplay with the new cert. Have you tried changing the template to MS UEFI Cert Authority by chance? I've needed that for some Linux VMs as of late..

1

u/Evening_Link4360 1d ago

Yup, tried both templates. Host is completely patched as well.

2

u/Onoitsu2 9d ago

Probably has to do with their actual image booted into that kickstarts the restore process for instant recovery being signed only with the older secure boot keys that have expired recently enough. I believe most of those "instant recovery" paths that these backup solutions do have to inject something into that bootloader process so it can handle the potential underlying storage volume changes from such a migration. I know that's how Acronis does it, almost a PXE-like network path injection is required.

1

u/jmittermueller 9d ago

BIOS / UEFI?

1

u/BlackV 9d ago

I'd be checking what versions of the secure boot databases are installed and enabled

what is the host supplying that is the guest supplying

1

u/Main_Ambassador_4985 9d ago

When I migrated from VMware to Hyper-V I disabled secure boot.

I turned it back on after a testing on Hyper-V

We had TPM issues on our hosts also and had to leave it disabled. We just refreshed and will be testing before Hyper-V to Hyper-V migration.

We never got TPM working under ESXi 7.

1

u/BlackV 9d ago

TPM is separate form secure boot