Hey Folks, there is a known issue with PVS and CU2604, SecureBoot doesn't work after, it's related to MS certs. Citrix support says to upgrade to PVS 2601, I am on PVS 2402 LTSR. 1. With PVS, is there really a security benefit to use it? VBS can run without it. Still it was working, it's a pity to lose it. 2. Being told to upgrade to CR 2601 when supposedly LTSR is in support (I run a LTSR env so I am losing my entitlement by updating PVS), it sounds like limited support and if there is a bug they can't fix, you're told to upgrade, pretty bad if you ask me. It doesn't sound right to me in the way LTSR is supposed to be supported. Do I expect too much? I want to push back but I want the community opinion first. Cheers !

@Yuhua Lu do you have thoughts on this?

OMG, we just going to onboard all these wonderful and not so really needed for VMs features like secure boot to our environment to find that we will have some real fun every now and then. Dealing with MS certs for our laptop fleet atm.

Yes, we are aware of this cert issue, PVS is a bit complicated with multiple things involved: guest OS, boot program and hypervisor. Loop in @Simon Graham @Jeff Qiu to help

Case got escalated and the fix is in PVS 2402CU4 at the end, still need to try it. Also, as I use BDM, I could have just generated the iso from PVS 2601. So I just got the wrong info. I'll confirm when tested !

Am I reading this right in that for everyone with VMs that have Secure Boot enabled (S25 multisession for us) not only have to have a hypervisor upgrade completed, but will also require a PVS upgrade to a yet-unreleased build? And if on vSphere 8, like us, we have to reprovision all target devices? That seems insane.

PVS is released, 2402 CU4 has the fix, still needs to test it. That's my understanding also re-the VMs recreation on VMWare and patching. I'm a Hyper-V shop, will confirm the full process once tested.

That's where I'm confused because I see no release notes in PVS 2507 on this issue, unless I completely missed it.

@Nick Panaccio 2507 has only the old certificates in the efi boot manager. So the images still work after June. After June there will be a new release for 2507 and newer with the update boot manager which includes the new certificates. According to the table.

If you are using BDM, you can create a new ISO using PVS2601. If not you have to wait 😕

Yes, but you don't have to panic. It will still work

I think I'm going to push for disabling Secure Boot, honestly. I see no value in it for a non-persistent environment, and there is zero chance our platform team will upgrade all of our hypervisors in time.

The 2402 CU4 + updating the BDM fixed the secure boot. No need to update Hyper-V. Nor recreating the VMs. Simple for us.

"Hi @jvitech, thanks for confirming! Regarding the BDM update, I have a similar setup with 1,000+ VMs using BDM disks attached to templates. Since you mentioned 'updating the BDM', did you just replace the BDM disk file at the template level and let the VMs pick it up upon reboot, or did you have to perform any specific action to push that update to the 1,000 individual VMs? Thanks again for the clarification!"

The way I update it for my Hyper-V VMs is via a script. It copies the new ISO to the hypervisor local path, e.g. d:\iso and then for each VM it set the new ISO. Overwriting the iso doesn't work as locked by the VM usually.