I'm patching one of my Citrix images and I'm getting the following secure boot error after installing the June msoft patches. Has anyone seen this? it only happens on machines cloned from the image and disabling secure boot resolves it.

https://knowledge.broadcom.com/external/article/439022/citrix-vdi-clones-fail-to-boot-with-secu.html https://docs.citrix.com/en-us/provisioning/current-release/advanced-concepts/secure-boot-cert-expiration-ca-updates.html https://support.citrix.com/external/article/CTX696455/vmware-and-xenserver-based-pvs-targets-u.html Either upgrade Hypervisor to supported version or disable SB, if you can. I worked around a VMware 8 env by changing gold image to disable secure boot, update image, snapshot and redeploy to new MC. I could not deploy to existing MC/VMs, had to be net new, but it worked for both Win11/Server 2022 via MCS.

Gotcha, we are on EXSi 8.0 3j so I thought we were good on that but I'll look into it. And that makes sense, I was wondering if I could work around it by deploying to a new MC. Infosec will love me for disabling secureboot I'm sure lol.

We’ve just run into this little glitch — perfect timing for an emergency login in the middle of the evening…

Yeah I'm not having an issue with an image that only has KB5093998 installed, we are still on 23h2 enterprise. So I'm wondering if vmtools was actually causing the issue or something else. Still doing some testing.

Starting to be a bigger deal for our clients as patching schedules start coming up. We are testing a temporary deletion of the secure boot keys to see if we can get this months images out - otherwise its looking very much like catalog rebuilds which may require a bit more planning.

Citrix mentions PVS, but what about MCS - anyone know what to expect with SB-enabled MCS pools once those certs expire (on a non-updated hypervisor)?

as long as you don't update your master images (non-persistent) you should be fine. Once you update your images, you'll need to disable secure boot on the master, take a new snapshot and create new machine catalogs/machines. I've found updated images with the cert won't boot on non-updated hypervisors.

Yeah I ran into this at a couple Nutanix customers - you an intercept the preparation disk to get the update out. Updated to AOS 7.3.x and problem went away. So I understand that behavior prior to those certs expiring. When the certs expire (today onward), what then is the behavior - on VDAs not updated with June CU.