How to Configure Hyper-V Virtual Machine Secure Boot Templates in Windows 11 Using PowerShell

Generation 2 virtual machines in Windows 11 Hyper-V rely on Unified Extensible Firmware Interface (UEFI) architecture rather than legacy BIOS emulation. A fundamental security pillar of UEFI is Secure Boot, which cryptographically validates firmware drivers, bootloaders, and OS kernel binaries against embedded digital certificates before handing over system execution. However, because Hyper-V provisions new virtual machines with the proprietary MicrosoftWindows certificate template by default, administrators who install Linux distributions (such as Ubuntu, Debian, Red Hat Enterprise Linux, or SUSE) frequently encounter startup failures stating “The image’s hash and certificate are not allowed (DB)”. Rather than disabling Secure Boot entirely and exposing the guest to bootkits, system administrators can configure granular Secure Boot certificate templates using PowerShell and Set-VMFirmware.

Understanding Hyper-V Secure Boot Certificate Templates

Hyper-V provides pre-configured UEFI Secure Boot templates containing trusted digital signatures maintained by Microsoft:

• MicrosoftWindows: The default template for all newly created Generation 2 VMs. Contains the Microsoft Windows Production PCA certificate. It verifies official Windows boot components and Windows boot managers, but rejects non-Microsoft Linux shim bootloaders.
• MicrosoftUEFICertificateAuthority: Essential for enterprise Linux guest operating systems. Includes both the Microsoft Windows certificate and the Microsoft Corporation UEFI CA 2011/2023 certificates. These certificates sign the third-party shim.efi bootloader utilized by Canonical Ubuntu, Fedora, RHEL, openSUSE, and Debian to bootstrap the Linux kernel securely.
• OpenSourceSecureBoot: A specialized template designed for custom community distributions or developer kernels signed with community or test keys.

Auditing Existing Virtual Machine Firmware and Templates

To inspect the current firmware configuration and Secure Boot status of your Hyper-V virtual machines, open an elevated PowerShell window on Windows 11.

To query firmware settings for a target virtual machine:

Get-VMFirmware -VMName "UbuntuServer" |
    Select-Object VMName, SecureBoot, SecureBootTemplate, PreferredNetworkBootProtocol, ConsoleMode |
    Format-List

To query all available Secure Boot templates supported by the Windows 11 Hyper-V hypervisor:

Get-VMHost | Select-Object -ExpandProperty SecureBootTemplates

The host lists MicrosoftWindows, MicrosoftUEFICertificateAuthority, and OpenSourceSecureBoot.

Configuring the Microsoft UEFI CA Template for Linux Guests

When provisioning a Linux virtual machine, ensure the virtual machine is powered off before altering UEFI firmware settings.

To assign the Microsoft UEFI Certificate Authority template to allow Linux bootloader verification:

# Stop the virtual machine if currently running
Stop-VM -Name "UbuntuServer" -Force

# Enable Secure Boot and assign the Linux-compatible UEFI CA template
Set-VMFirmware -VMName "UbuntuServer" `
    -EnableSecureBoot On `
    -SecureBootTemplate "MicrosoftUEFICertificateAuthority"

# Start the virtual machine
Start-VM -Name "UbuntuServer"

Upon booting, Hyper-V’s virtual firmware checks the signature of shimx64.efi against the Microsoft UEFI CA stored in the guest’s virtual NVRAM. The bootloader successfully verifies and chains to GRUB without throwing signature validation errors.

Verifying Secure Boot Operational Status Inside the Linux Guest

Once the Linux guest operating system powers on, you can verify that Secure Boot is actively enforced inside the Linux kernel:

# Check Secure Boot status via mokutil
mokutil --sb-state

# Check kernel ring buffer validation
dmesg | grep -i "secureboot"

The command outputs SecureBoot enabled, confirming that kernel module signing and lockdown mode are active.

Automating Secure Boot Template Configuration for New Deployments

To streamline automated VM provisioning scripts (such as DevOps or lab deployment routines), configure the template immediately after VM creation:

# Script: Provision-LinuxVM.ps1
param (
    [string]$VMName = "DebianLab",
    [string]$SwitchName = "Default Switch",
    [int64]$MemoryBytes = 4GB
)

Write-Host "Creating Generation 2 Virtual Machine: $VMName..." -ForegroundColor Cyan
New-VM -Name $VMName -Generation 2 -MemoryStartupBytes $MemoryBytes -SwitchName $SwitchName

Write-Host "Applying Microsoft UEFI CA Secure Boot Template..." -ForegroundColor Yellow
Set-VMFirmware -VMName $VMName -EnableSecureBoot On -SecureBootTemplate "MicrosoftUEFICertificateAuthority"

Write-Host "VM provisioning completed securely." -ForegroundColor Green

Disabling and Re-enabling Secure Boot for Legacy Workloads

If you are testing experimental operating system kernels or custom boot loaders that lack valid digital signatures, you can temporarily suspend Secure Boot without rebuilding the virtual machine:

# Temporarily disable Secure Boot
Set-VMFirmware -VMName "UbuntuServer" -EnableSecureBoot Off

# Re-enable Secure Boot and restore the Linux template
Set-VMFirmware -VMName "UbuntuServer" -EnableSecureBoot On -SecureBootTemplate "MicrosoftUEFICertificateAuthority"

Configuring appropriate Secure Boot templates in Windows 11 Hyper-V ensures complete boot-level cryptographic protection for both Windows and Linux workloads, eliminating boot errors without compromising virtual machine security.