Warning message when you enable Virtualization Based Security

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:
When you enable Virtualization Based Security check box in the VM options tab of Edit settings of the VM, it shows the following warning :
"Requires EFI, which might make the guest OS unbootable.  EFI, Secure Boot, IOMMU and Hardware Virtualization will be enabled on reboot."

Environment

VMware vSphere ESXi 6.7

Cause

The virtual machine is created using the guest OS image that does not have EFI firmware enabled and hence cannot have Virtualization Based Security (VBS) enabled. 

When you enable VBS at the vSphere level that one checkbox is turning on a number of features.

• Nested virtualization
• IOMMU
• EFI firmware
• Secure Boot

What this will NOT do is enable VBS within the VM’s Guest OS. For that you would follow Microsoft guidance. This can be done with PowerShell scripts, Group Policies, etc.

Resolution

Option 1:

• Deploy the VM with EFI firmware enabled during the initial OS installation.

Option 2:

• If the OS is already installed, enable EFI support within the guest OS by updating the appropriate Group Policy settings before switching the VM firmware to EFI.