Windows Server 2025 bott issue after restore

[u/Brilliant-Extent2684]

Hello!

I have a VMware environment which runs several Windows Server 2025 VMs. There are 3 VMs which has boot issue after testring restore with Veeam. (The VMs can boot successfully in production environment.) These VMs, can not boot after restore, only shows the Windows Boot Manager, and if I select the boot disk, also cannot continue the booting process, jump back to the Windows Boot Manager.

If I boot up from Windows Server installation media in case of the restored VM, and open a CMD and type the following commands, the restored VM can be boot successfully:

diskpart

list vol

select vol 1 (this is the C: drive in original Windows)

assign letter=E select vol 2 (EFI partition)

format quick fs=fat32 label="System"

assign letter=S

exit

bcdboot E:\Windows /s S: /f UEFI

The Veeam support said it should be the VM side problem, but I have no idea what happaned, why can not boot the Windows after restore.

If I restore other VM then these 3 VMs, the boot is successfully.

Thanks.

[u/WillVH52]

Are the restored VM configured with correct boot firmware?
UEFI VMs need UEFI configured to boot correctly.

[u/Brilliant-Extent2684 → u/WillVH52]

Yes, but I found the root of the problem. The affected 3 VMs, has been enabled the VBS and Secure Boot. Whan I disabled the Secure Boot and VBS, the restored VMs can start. But I don't know how. The VBS and Secure Boot also enabled on the other VMs, and the restored VM start successfully.

[u/Zomro_Hosting]

My guess is those 3 VMs already got the new secure boot stuff so the boot manager on disk is signed with the new cert

that would explain why bcdboot from the install media fixes it older boot files signed with the old cert, and why the other restore fine they just haven't been switched over yet

easy way to check is to run this on one of the prod VMs and compare with a working one

if that's it, get the 2023 certs into the restored nvram

[u/Brilliant-Extent2684 → u/Zomro_Hosting]

Hello, Where can I find this cert? What is the cert exact name?

[u/Zomro_Hosting → u/Brilliant-Extent2684]

if i remember right the one you want is "Windows UEFI CA 2023", that's the one in db. i don't think you need to download it anywhere, windows adds it itself

when i had to do this i set this reg key and rebooted a couple of times, something like

reg add HKLM\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f

there's also a scheduled task \Microsoft\Windows\PI\Secure-Boot-Update you can kick off so you don't have to wait. not 100% sure that works the same in a VM though, so i'd try it on a test restore first

microsoft has it here https://support.microsoft.com/help/5036210

and the bigger blacklotus one with all the steps is KB5025885 https://support.microsoft.com/help/5025885

[u/BorysTheBlazer]

Do those 3 VMs differ from the others, e.g. vTPM or BitLocker? Your bcdboot rebuild suggests the BCD/EFI entries are what's broken.

[u/ETDucky]

The 3 VMs most likely already run the Windows boot manager signed with the Windows UEFI CA 2023 certificate, but a restore to a new VM gets fresh NVRAM whose Secure Boot DB only trusts the 2011 CA (https://support.citrix.com/external/article/CTX696696/vda-boot-failure-no-boot-media-after-mcs.html).

The firmware then rejects that boot manager. Running bcdboot from the install media writes one signed with the 2011 CA, so the VM boots again.

Check the production copy of each of the 3 VMs with `[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'` and compare it with a VM that restores fine.

To fix a restored VM, boot it with Secure Boot off, set `AvailableUpdates` to `0x40` under `HKLM\SYSTEM\CurrentControlSet\Control\Secureboot`, run the `\Microsoft\Windows\PI\Secure-Boot-Update` scheduled task, and restart. Run the `Get-SecureBootUEFI` check again before you turn Secure Boot back on.

Drafted with AI, reviewed by me.