Citrix VDI Clones Fail to Boot with Security Violation After Windows Updates

Products

• VMware vSphere ESXi

Issue/Introduction

• After applying Microsoft Windows security updates (specifically April 2026 patches or those addressing CVE-2023-24932) to a golden image and pushing it to Citrix VDI clones, the virtual machines (VMs) fail to boot.

 

• The Windows Boot Manager may list entries similar to the following:

  Windows Boot Manager... Security Violation
  
  Windows Boot Manager... Unsuccessful

• The "vmware.log" file for the affected VM will contain entries similar to the following:

  SECUREBOOT: Signature: 0 in db, 0 in dbx, 1 unrecognized, 0 unsupported alg.
  SECUREBOOT: Image DENIED.

    

 

Environment

• VMware vSphere ESXi

Cause

• Recent Microsoft Windows updates or previous updates which address **CVE-2023-24932** may implement revocations for the Windows Boot Manager.  When **Secure Boot** is enabled on virtual machines, the UEFI firmware may deny the boot image because the signature is unrecognized or revoked.

Resolution

An exact cause of the secure boot failure will require the OS vendor to troubleshoot the issue further.

Reach out to Microsoft support to assist with troubleshooting the issue that is causing secure boot to prevent booting the VM.

You can also try implementing the two workaround steps below:

1. Power Off the affected Virtual Machine, or the target Virtual Machine should be on Power off Status
2. In the vSphere Client, navigate to the Storage view, select the datastore where the VM resides, and click Files (Datastore Browser)-> Locate the Virtual Machine
3. Rename the NVRAM File-> Open the folder belonging to the affected Virtual Machine-> Locate the <VM-Name>.nvram file, right-click it, and select Rename. Rename it to <VM-Name>.nvram.old.
4. Power the VM back on. vSphere will automatically detect the missing file and generate a fresh .nvram file containing the host's most up-to-date Secure Boot certificates. The VM should now boot normally.

If you need to restore access immediately and cannot immediately perform the NVRAM reset, you can temporarily disable Secure Boot.

Note: This reduces the security posture of the Virtual Machine and should only be used as a stopgap.

1. Power Off the VM-> Ensure the target Virtual Machine is completely powered down.
2. Edit VM Settings-> Right-click the Virtual Machine in the vSphere Client and select Edit Settings.
3. Navigate to Boot Options->Click on the VM Options tab at the top of the window, then expand the Boot Options menu.
4. Disable Secure Boot->Under the "Secure Boot" section, uncheck the box for Enable Secure Boot. Click OK to save the changes.
5. Boot the VM->Power on the Virtual Machine. It will now bypass the UEFI certificate check and boot into Windows.

 

Additional Information

• As a temporary option, disabling secure boot for the VM should allow the VM to boot.  Steps on disabling or enabling secure boot are detailed in KB article 377377:
• Enable or Disable UEFI Secure Boot for a Virtual Machine