Microsoft continues preparing the transition away from expiring Secure Boot certificates.
This is already relevant for conventional clients, but virtualized environments add another layer.
Especially with Windows 11 and Windows Server 2025, I would therefore incorporate this topic into image and provisioning processes now.
A few basic checks:
|
1 2 3 4 5 |
Confirm-SecureBootUEFI Get-Tpm Get-BitLockerVolume Get-CimInstance Win32_DeviceGuard |
In VDI environments, also check:
🔹 UEFI configuration
🔹 vTPM and hypervisor
🔹 Firmware level
🔹 BitLocker and recovery process
🔹 Master image and templates
🔹 MCS and PVS provisioning
The crucial point: with non-persistent and provisioned systems, examining only individual VMs is not enough.
When Secure Boot changes are required, it must be clear how those changes propagate through the master image, hypervisor and provisioning to the actual VDAs.
For new Windows 11 VDI and Windows Server 2025 environments in particular, I would therefore include this topic directly in the technical baseline.