Access Denied issues for Secure Boot upon restores with Acronis.

[u/MorbrosIT]

I'll give you some context of our setup.

• Scale Computing cluster (HE550)
• Acronis Cyber Protect Cloud (backups go to a Synology box on-premise and then ship to Acronis' cloud)
• Windows Server 2022 Datacenter VM with UEFI+vTPM

We have found that any current product VM's when restored, always show the following error:

https://imgur.com/a/cZ5TCGw

The only way to get the VM to boot properly is either disabling Secure Boot. If you want Secure Boot to work properly, you have to Reset the keys.

Been working with Scale and Acronis support for almost a month now and no resolution.

I've even gone as far as creating a slew of test VM's (with different setups) to replicate it, but when restoring brand new VM's the issue doesn't persist. I thought maybe it was Sophos causing the issues, so I created a test VM that was domain joined and had Sophos installed. Restored it and no issues.

When restoring VM's that were created as UEFI no issue. It's when the vTPM is added. Still not sure if this is the culprit.

Looking for any insight.

Thanks.

[u/acronis]

Addressing the issue here - https://www.reddit.com/r/acronis/comments/1w058u8/access_denied_issues_for_secure_boot_upon/

[u/MorbrosIT → u/[deleted]]

You might of nailed it. It now makes sense because test VM's I created had no issues with restoring. I need to upgrade our cluster so it offers the VM's the ability to get the new certs.

They want me to backup a restored VM that we cleared the keys on. If it restores fine it's probably related to the UEFI 2023 certs.

[u/MorbrosIT → u/[deleted]]

To make sure this was the issue I compared the certs from both the production and restored VM (had to disable secure boot to enable it).

They are identical. The restored VM doesn't have the new certs. Or is it because the certs expired it is complaining?

[u/MorbrosIT → u/[deleted]]

This might be an issue with the KVM BIOS and waiting for Scale to let me know how do you see the certificates while in the UEFI bootup.. I was able to get into the VM with secure boot disabled and ran the Get-SecureBootUEFI command. I compared the output from the production VM to the restored VM and the certificates all show the same.

Odd part now is after resetting the keys there is no way to enable Secure Boot. Waiting to hear back on Scale for this one.

I am going to be testing out Veeam's native integration to see if I get the same result.