Secure Boot with vTPM for Windows 11 Virtual Machines on Proxmox

How to install Windows 11 on Proxmox VE 7.0-13 with Secure Boot enabled using a Virtual Trusted Platform Module (vTPM).

Note: Any and all comments/improvements are welcomed.

What is Secure Boot?

Secure Boot is a security standard that helps make sure that a device boots using trusted software. This feature and the underling hardware Trusted Platform Module (TPM) is also required by Windows to enable certain features such as Bit Locker disk encryption.

Secure Boot and Windows 11

Whist this feature has been around since Microsoft Windows 8, it has gained a lot of coverage in the press because initially Microsoft stated that Microsoft Windows 11 would only install on machines that supported and had Secure Boot enabled. Currently it is unknown if Microsoft will eventually require Secure Boot for Windows 11.

It could be said that using Secure Boot with a Virtual Machines is pointless, however, certain corporate environments require features like Bit Locker to be enabled for a machine to be “compliant” and join their corporate network.

Proxmox and Secure Boot / vTPM

Proxmox 7.0-13 now natively supports Secure Boot by using a Virtual Trusted Platform Module (vTPM) service.

This walkthrough details the correct configuration for Windows 11 virtual machines to report all green ticks in the Windows 11 health check.

Verifying Proxmox Version

Make sure you are running at least PVE 7.0-13

Virtual Machine Settings

When you create the virtual machine, on the System page make sure you selected “Add TPM” and that you are using Version “v2.0

Enabling the TPM

After the machine creation wizard has completed, so you will see an entry for TPM State in the Hardware settings.

Hardware Settings

Verifying vTPM in Windows

After Windows is booted, opening the MMC and add the TPM Snapin. Microsoft Management Console shows that Windows recognizes a valid TPM!

TPM Management MMC

Installing Windows 11

The Windows 11 PC Health Check may report that you have an unsupported processor and upgrade is not possible from Windows 10 to Windows 11.

Installation directly from a Windows 11 ISO downloaded to the Proxmox host, works correctly and Windows 11 functions normally.

Job done.

Leave a Reply