Windows Device Guard is silently disabled on virtual machines on AMD ESXi hosts

Products

• VMware vSphere ESXi

Issue/Introduction

Enabling Secure Boot with DMA Protection for a virtual machine on an ESXi Host using AMD processors will be silently disabled in the Windows guest operating system.

Environment

VMware vSphere ESXi 6.7
VMware vSphere ESXi 7.0

Resolution

This is a known issue affecting ESXi 6.7.
The issue is resolved in ESXi 7.0 Update 2. Please see Enable Virtualization-based Security on a Virtual Machine

Workaround:
To work around this issue, select "Secure boot" Platform Security Level in a Guest OS on AMD systems.