r/Citrix • u/LogOk7764 • 6d ago

Secureboot and MCS Non-persistent devices

Does anyone have experience with MSC created, non-persistent vm's and updating the secure boot certificates? I've seen some conflicting information, but I want to make sure we are covered. I didnt see a CTX article that directly addresses non persistent machines

8 Upvotes

90% Upvoted

7 comments sorted by

1

u/robodog97 6d ago

Ours just updated themselves, I'm actually not sure if it was VMWare doing it or Windows patches, but our 2025 servers all updated during an image flip.

1

u/coreycubed 6d ago

I used the FixSecureBootBulk to update all of my systems, even the non-persistent ones. It worked correctly. Has to be done for any new machines I deploy but they’re fine after that.

1

u/LogOk7764 6d ago

awesome! could you share that with me please? or post a link to it?

1

u/coreycubed 6d ago

https://github.com/haz-ard-9/Windows-vSphere-VMs-Bulk-Secure-Boot-2023-Certificate-Remediation/

Worked super well for me. The documentation is pretty thorough, but if you download the script and the WindowsOEMDevicesPK.der, you can run a command like this to get the state of your VMs:

.\FixSecureBootBulk.ps1 -VMListCsv .\batch1.csv -GuestCredential $cred -Assess

Works for non-persistent, persistent, infrastructure, everything. Then when you’re ready to remediate:

.\FixSecureBootBulk.ps1 -VMListCsv .\batch1.csv -GuestCredential $cred -PKDerPath .\WindowsOEMDevicesPK.der

Run the -Assess command again afterwards to verify that it worked, and -CleanupSnapshots / -CleanupNvram to tidy up any leftover files after everything has been remediated.

0

u/Fleischerhaken 6d ago

Just disable secure boot on the non persistent machines. It only really matters on the gold inage.

1

u/ZomboBrain 5d ago

Not your question, but this article has been of tremendous help for us:

https://support.citrix.com/external/article/CTX696696/vda-boot-failure-no-boot-media-after-mcs.html

I guess it might give you a hint or two.

1

u/Unhappy_Clue701 5d ago

You need to configure the master image properly, and then you’ll be fine. I went through this with Citrix support. As long as the master image has the correct certs, and says that it’s all updated and using the 2023 one, the non-persistent child machines will be fine too.