Create a Secure Boot Windows virtual machine

To improve the security of your virtualization host, you can create Windows virtual machines (VMs) that use the Secure Boot feature. Secure Boot ensures that the VM is running a cryptographically signed operating system (OS).

Before you begin

  • The VM uses the Q35 machine type.
  • Your host system uses the AMD64 or Intel 64 architecture.
  • The packages required for Secure Boot configuration have been installed on your host: 
    # dnf install swtpm swtpm-tools edk2-ovmf
  • An installation source for the guest operating system is available locally or on a network. This can be one of the following formats:
    • An ISO image of an installation medium
    • A disk image of an existing VM Warning

      Installing from a host CD-ROM or DVD-ROM device is not possible in RHEL 10. If you select a CD-ROM or DVD-ROM as the installation source when using any VM installation method available in RHEL 10, the installation fails. For more information, see RHEL 7 or higher can’t install guest OS from CD/DVD-ROM (Red Hat Knowledgebase).

  • Optional: A Kickstart file can be provided for faster and easier configuration of the installation.

About this task

Secure Boot can prevent certain types of attacks against the guest OS. Secure Boot also acts as an additional layer of protection for the host OS, on top of the isolation already provided by virtualization. If the guest OS supports it, Red Hat recommends enabling Secure Boot.

Procedure

  1. Use the virt-install command to create a VM as detailed in Creating virtual machines by using the command line. For the --boot option, use the uefi,firmware.feature0.name=enrolled-keys,firmware.feature0.enabled=yes value.

    For example:

    # virt-install \
   --name Win11SecBoot --memory 4096 \
   --vcpus 4 --os-variant win11 \
   --boot uefi,firmware.feature0.name=enrolled-keys,firmware.feature0.enabled=yes \
   --tpm model=tpm-tis,backend.version=2.0 \
   --disk boot_order=2,size=10 \
   --disk boot_order=1,device=cdrom,bus=scsi,path=/images/Win11-installation.iso
  2. Follow the OS installation procedure according to the instructions on the screen.

Results

  1. In the Windows guest operating system, open the System Information tool (msinfo32).
  2. Under the System Summary tab, check that the Secure Boot State parameter is listed as On.