Can't install Win 11 guest via virt-manager (suspect secure boot issue)

Hi all,

I’m trying to install Windows 11 in a VM so I can finally drop dual boot, but unfortunately I’m having some issues.

I installed edk2-ovmf and swtpm as per this guide, but even though I followed the instructions and selected the correct secure boot firmware:

I get this installation failure message:

My guess is that this is being caused by secure boot not working because if I check the settings in the tiancore BIOS of the VM, it shows that secure boot is disabled:

Does anyone know what the problem is here?

Did you add the TPM device to the VM?

Hi, yes I did. That seems to be enabled, according to the BIOS in the VM.

TPM setting in BIOS image

Is the TPM device configured as “emulated” or “passthrough”? I could never get “passthrough” to work. Your TPM device is listed as disabled, by the way.

I used 'Emulated".

Sorry, where is it listed as disabled? It looks to be enabled to me.

Sorry, I read the BIOS screen wrong. Tbh, I don’t remember having to select the secure_boot firmware, just used UEFI and it installed just fine. However, on trying it again just now I get the same errors that you are. I haven’t had a need for a Windows VM since switching to a dual-boot (since gone, as well), so I’m a little fuzzy on this. Maybe a solution would be to install Windows 10 then upgrade to 11?

No worries, thanks for trying anyway. :+1:

Going the Windows 10 > 11 route is plan B if I can’t get this working.

One thing I do remember is that I needed to have multiple CPU cores enabled.

oh yeah?

I’m using 8 virtual cores by default - is there some specific number of sockets/cores/threads that you’d suggest?

I usually run 1/4/2 (sockets/cores/threads) for my VMs, which is half my host’s total. I just followed a couple of guides and they’re all failing at the same spot, so maybe something has changed with QEMU.

Yeah, I tried 1/4/2 and it didn’t work either.

I’ve also tried to follow this guide, which contains a few extra steps (such as loading the virtio.iso alongside) but alas, I can’t seem to find any combination of settings that passes Windows 11’s sysreq check.

Bummer.

I’ll play a round a bit more but might have to go down the Win 10 > 11 route after all.

Yeah, I added the virtio.iso as well (used VirtIO SCSI for the disk so I could use SSD trimming). I only had Windows around for Diablo IV, first on a VM w/GPU pass-through and then a dual-boot. With that abomination removed, I’m back to EOS only again. Could not be happier. Actually just installed Baldur’s Gate 3, runs just fine with Steam/Proton.

Nice. Gaming on Linux is so good these days - Thanks be to Gabe! I still need Windows for work, unfortunately.

Anyway, I just found a trick to install Windows 11 via KVM.

It seems the thing to do is to edit the registry in the Windows installation media to disable the TPM and Secure Boot checks, which bypasses the problem entirely.

Whoop!

Got it working.jpg

I just installed it on vmware no problem.

Yes, this hack has been around for awhile now. But do you trust MS not to reinstate it at some point?

1 Like

Hmm…I had just installed W11 on QEMU about a month ago to check out the Insider Builds; wish I could find my old xml files. If VMware would have had GPU passthrough I would have stayed with it.

@ricklinux - hmm, I tried vmware-workstation (v.17.0.2) yesterday but couldn’t see any settings to configure TPM or Secure Boot. Is that the version you used?

@ajgringo619 - I hadn’t thought about that…

I’ve never used passthrough. I always used virtual box but it just hasn’t kept up in Linux and always has issues. I tried virtmanager and same for me. Vmware just seems to work for me and is easier to use.

1 Like

Yes. It’s very simple to configure. You’re probably trying to make it more complicated than it is. Open vmware workstation, create new virtual machine, use typical, don’t select custom (advanced) click next and browse to the Win 11 ISO, click next and the settings should be Windows and 64 bit version, click next which is just naming and the file location of the virtual disc you are going to be creating. Then when you click next that is where you put the password for files only needed to support TPM. Next is the disk size, store as single file. Next uncheck automatically start after, click customize hardware and set 4 GB ram and 1 processor and 6 cores depending on your cpu. Then click close and finish. Then under edit virtual machine settings click options and set under vmware tools to syncronize guest time and update automatically. Then under advanced enable secure boot and save. Now you are ready to launch it! Simple!

1 Like

success

Well, bless my soul…

You were right, for some reason I thought it was going to a lot more complicated than that :smiley:. Even with no secure boot settings, it worked just fine. Much appreciated for your assistance @ricklinux !