VM's with vTPM enabled (Boot Option- EFI) is not booting.

Products

• VMware vCenter Server

Issue/Introduction

• TPM was not enabled on the VM's when it was running on vCenter 6.7, and no key providers were configured.
• Trying to enable vTPM on the cross vCenter migrated VM's from vCenter 6.7 to vCenter 8.0 U2 with the boot option changed from BIOS to EFI.
• VM's fail to boot after switching the boot option from BIOS to EFI.

Environment

• VMware vCenter Server 6.x
• VMware vCenter Server 8.x

Cause

• Switching from BIOS to EFI is a significant change to the boot method, and the operating system needs to be compatible with this new boot mode. EFI boot requires the system to use the GPT (GUID Partition Table) instead of MBR (Master Boot Record).
• VMware VM Encryption happens at the hypervisor level and is managed via vCenter or ESXi. It does not directly show up within the guest OS unless OS-level encryption tools (e.g., BitLocker for Windows or LUKS for Linux) are in use.

Resolution

Guest OS vendor needs to verify if the OS disk is using the GPT partition scheme, as this is crucial for enabling EFI boot with TPM.

Note : Enabling Secure Boot in conjunction with EFI may introduce complications, and it is generally recommended to enable Secure Boot only for new installations.

 

Additional Information

Refer :

• Activate or Deactivate UEFI Secure Boot for a Virtual Machine on vCenter 6.7 version.
• MBR2GPT.EXE converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk.