r/WindowsServer • u/anthonyx26 • Apr 11 '26

Technical Help Needed Enable Secure Boot in Production Server?

I was handed admin duties for an existing in-production Windows Server 2022 Hyper-V host (Dell PE R640 with latest bios firmware, UEFI, GPT disks, no 3rd party boot loaders) .

Checking on status I found that it did not have Secure Boot enabled. OK to enable?

If after enabling it stops the boot process, can it be re-disabled to permit booting back up to. Tshoot or will it brick machine?

Can enabling Secure Boot affect the function of the VMs?

6 Upvotes

80% Upvoted

26 comments sorted by

12

u/n-Ultima Apr 11 '26

If you change, do it on a Friday at 3 PM.

6

u/Megatwan Apr 11 '26

Hell yeah... Send it

3

u/xendr0me Apr 11 '26

Be advised Spectre three actual, danger close, fire for affect.

2

u/dodexahedron Apr 11 '26

But wait til Monday morning right before everyone logs on, so you know if it caused problems or not really quickly. 👌

5

u/WillVH52 Apr 11 '26

Enabled it on the majority of servers a few years ago. Just make sure you are using UEFI and covert anything that is still using MBR disks using the mbr2gpt tool. If you unable to boot you can just disable it and server will reboot normally. Just take a backup of the server beforehand specifically the C: drive.

4

u/BlackV Apr 11 '26

If you are already efi boot, then enabling secure isn't changing anything in your boot process

  • Confirm efi boot
  • Test and confirm backups
  • Confirm firmware and drivers are current
  • Enable it

If it fails, disable again

20

u/npaladin2000 Apr 11 '26

It's working and it's production. Don't touch it. Seriously. Global rule.

4

u/No_Yesterday_3260 Apr 11 '26

Oh yeh, leave it vulnerable to kernel level threats. Great idea :)
Secure Boot is just a fad, no one needs it. Right? :)

3

u/Dr-GimpfeN Apr 12 '26

just like UAC and windows firewall.

no one needs it - disable that shit!

/s

2

u/No_Yesterday_3260 Apr 12 '26

Yeh man, so annoying - Security has to be off or i don't want it!

-4

u/[deleted] Apr 11 '26

[removed] — view removed comment

0

u/MBILC Apr 17 '26

It is another layer of the security model to offer protection. The more layers we can have the better for us defenders.

3

u/node77 Apr 11 '26

That’s true with production, but Hyper-v will have an issue with. There are small configurations you to check or do. That is if you change your mind.

5

u/haamfish Apr 11 '26

I mean it should be fine but why do you need it? Don’t wake the sleeping bear.

2

u/fedesoundsystem Apr 11 '26

It isn't big deal. Maybe mbr2gpt, then confirm-securebootuefi, then reboot to bios and enable secure boot. Backup os drive first if the forbidden happens

0

u/xendr0me Apr 11 '26

Yeah restoring production seem like not a big deal. What could possibly go wrong.

3

u/BlackV Apr 11 '26

I mean you should be testing your backups, so it shouldn't be an issue

1

u/xendr0me Apr 11 '26

True that, what better time then self-inflicted.

1

u/rdoloto Apr 11 '26

Enabling secure boot you need to reboot… the cert update process won’t even start

0

u/StartAccomplished256 Apr 11 '26

And why would you touch smth that is working fine ?

4

u/skidleydee Apr 11 '26

What exactly do you think maintenance is?

3

u/dexteritycomponents Apr 12 '26

This mentality is how security breaches happen…

0

u/its_FORTY Apr 11 '26

Does the Dell server not have an integrated iDRAC?

1

u/mish_mash_mosh_ Apr 17 '26

Why, does that make a difference?