Last updated:
Citrix Provisioning 2507.1 LTSR CU2 is here.
Among the usual fixes is a change that I find much more interesting for PVS environments than the version number suggests:
👉 Support for Microsoft Windows UEFI CA 2023
Why is this important?
Microsoft is currently renewing the certificate chain behind UEFI Secure Boot. Some existing Secure Boot certificates date back to 2011, and Microsoft is gradually migrating Windows to the new 2023 certificates.
This is exactly where it becomes interesting for Citrix PVS.
PVS must understand the new Secure Boot world
With PVS 2507.1 LTSR CU2, Citrix now supports Secure Boot with images signed using the new Windows UEFI CA 2023 certificate.
Initially, this sounds like a small compatibility fix.
But it is not necessarily.
Anyone familiar with PVS knows:
💥 If the boot chain is wrong, there is no Citrix session.
We are no longer discussing logon duration, profiles or HDX performance.
The target simply does not boot.
Another interesting change
When a target device starts, PVS now automatically detects whether the system booted using:
BIOS or UEFI
.
This information is saved in the device record and is also available through farm telemetry.
I find this particularly useful in larger or long-established PVS farms.
Different firmware and boot configurations are surprisingly common there.
What would I check now?
Anyone using PVS + Windows 11 or Windows Server 2025 + Secure Boot should definitely keep CU2 on their radar.
Before a rollout, I would test in particular:
👉 Secure Boot + Windows UEFI CA 2023
👉 Target device boot
👉 PXE / BDM
👉 Existing vDisks
👉 Hypervisor firmware / UEFI configuration
👉 Boot after promoting a vDisk version
👉 Failover to a second PVS server
With changes like these:
The vDisk has worked for years is no guarantee that the future Secure Boot chain will also work.
My takeaway
For me, PVS 2507.1 CU2 is therefore more than just:
Another cumulative update with a few bug fixes.
Support for Windows UEFI CA 2023 is a classic future-readiness topic.
Microsoft is changing the Secure Boot trust chain.
Citrix is following suit with PVS.
And once a target fails to start after a Windows/Secure Boot update, an inconspicuous release-note entry suddenly becomes an important feature. 😎
