Enable or Disable UEFI Secure Boot for a Virtual Machine

Products

• VMware vSphere ESXi

Issue/Introduction

This article explains how to enable or disable UEFI Secure Boot for a Virtual Machine.

Environment

• VMware vSphere ESXi 6.x
• VMware vSphere ESXi 7.x
• VMware vSphere ESXi 8.x 

Cause

Switching a virtual machine's boot type from Legacy BIOS to UEFI without first converting the disk from Master Boot Record (MBR) to GUID Partition Table (GPT) will cause the VM to fail to boot. The firmware mode must match the partition scheme of the boot disk.

Resolution

Prerequisites :

You can enable secure boot only if all prerequisites are met. If prerequisites are not met, the check box is not visible in the vSphere Client.

• Verify that the virtual machine operating system and firmware support UEFI boot.
• EFI firmware
• Virtual hardware version 13 or later
• Operating system that supports UEFI secure boot

• Turn off the virtual machine. If the virtual machine is running, the check box is dimmed.

 

Resolution Steps to boot VM without using Secure boot :

1. Browse to the virtual machine in the vSphere Client inventory.
2. Right-click the virtual machine and select Edit Settings.
3. Click the VM Options tab, and expand Boot Options.
4. Under Boot Options, ensure that firmware is set to EFI.
5. Select your task.
   • Select the Secure Boot check box to enable secure boot.
   • Deselect the Secure Boot check box to disable secure boot.
6. Click OK.
   
   Note: Some guest operating systems do not support changing from BIOS boot to UEFI boot without guest OS modifications. Consult your guest OS documentation before changing to UEFI boot. If you upgrade a virtual machine that already uses UEFI boot to an operating system that supports UEFI secure boot, you can enable Secure Boot for that virtual machine.
   
   
   For Windows VMs, you can use the "MBR2GPT.EXE" tool from the below link to convert the disks from Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. After this conversion, you can use UEFI secure boot on the VMs.
   https://learn.microsoft.com/en-us/windows/deployment/mbr-to-gpt
   
   For an assistance with using the tool, please contact Microsoft.

 

Additional Information

Japanese Version:
仮想マシンの UEFI セキュアブートを有効または無効にする