PSA: Microsoft's KB5022842 breaks Windows Server 2022 VMs with Secure Boot

<-- note -->

VMware has released a fix for this problem in the form of ESXi 7.0 Update 3k [1]:

> If you already face the issue, after patching the host to ESXi 7.0 Update 3k, just power on the affected Windows Server 2022 VMs. After you patch a host to ESXi 7.0 Update 3k, you can migrate a running Windows Server 2022 VM from a host of version earlier than ESXi 7.0 Update 3k, install KB5022842, and the VM boots properly without any additional steps required.

<-- /note -->

[1] ESXi 7.0 Update 3k

Microsoft released a patch [2] this week for Windows Server 2022 that might cause some big problems [3] in VMware environments. Per VMware's KB90947 [4]:

> After installing Windows Server 2022 update KB5022842 (OS Build 20348.1547), guest OS can not boot up when virtual machine(s) configured with secure boot enabled running on vSphere ESXi 6.7 U2/U3 or vSphere ESXi 7.0.x.

> Currently there is no resolution for virtual machines running on vSphere ESXi 6.7 U2/U3 and vSphere ESXi 7.0.x. However the issue doesn't exist with virtual machines running on vSphere ESXi 8.0.x.

[2] a patch

[3] big problems

[4] VMware's KB90947

So yeah. That's, uh, *not great.*

If you've got any **Windows Server 2022** VMs with **Secure Boot [5]** enabled on **ESXi 6.7/7.x**, you'll want to make sure they *do not* get **KB5022842** until this problem is resolved.

[5] Secure Boot

I put together a quick PowerCLI query to help identify impacted VMs in my environment:

$secureBoot2022VMs = foreach($datacenter in (Get-Datacenter)) {
  $datacenter | Get-VM |
    Where-Object {$_.Guest.OsFullName -Match 'Microsoft Windows Server 2022' -And $_.ExtensionData.Config.BootOptions.EfiSecureBootEnabled} |
      Select-Object @{N="Datacenter";E={$datacenter.Name}},
        Name,
        @{N="Running OS";E={$_.Guest.OsFullName}},
        @{N="Secure Boot";E={$_.ExtensionData.Config.BootOptions.EfiSecureBootEnabled}},
        PowerState
}
$secureBoot2022VMs | Export-Csv -NoTypeInformation -Path ./secureBoot2022VMs.csv

Be careful out there!

---

📧 Reply by email

Enabling FIPS Compliance Fixes Aria Lifecycle 8.14

I Ditched vSphere for Proxmox VE

Tailscale on VMware Photon OS

---

Home

This page on the big web

-- Response ended

-- Page fetched on Fri May 10 11:10:00 2024

PSA: Microsoft's KB5022842 breaks Windows Server 2022 VMs with Secure Boot

Related articles