Windows Server 2022 — Gen2 VM creation fails because secure boot template mismatch — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Generation 2 VM deployment fails on Windows Server 2022, delaying service onboarding and test environment delivery.

Environment & Reproduction

Occurs when VM firmware settings use an incompatible secure boot template for the guest OS image.

New-VM -Name TestGen2 -Generation 2 -MemoryStartupBytes 2GB
Set-VMFirmware -VMName TestGen2 -EnableSecureBoot On

Root Cause Analysis

Guest boot chain validation fails because the secure boot template does not match the installed OS distribution.

Quick Triage

Inspect firmware configuration and boot diagnostics.

Get-VMFirmware -VMName TestGen2 | Format-List
Get-WinEvent -LogName Microsoft-Windows-Hyper-V-VMMS-Admin -MaxEvents 20

Step-by-Step Diagnosis

Validate secure boot template and attached installation media.

Get-VMHardDiskDrive -VMName TestGen2
Get-VMDvdDrive -VMName TestGen2

Solution — Primary Fix

Set the correct secure boot template or disable secure boot for unsupported media.

Set-VMFirmware -VMName TestGen2 -SecureBootTemplate MicrosoftWindows
# or
Set-VMFirmware -VMName TestGen2 -EnableSecureBoot Off

Solution — Alternative Approaches

Recreate VM with validated template defaults and fresh VHDX.

Remove-VM TestGen2 -Force
New-VM -Name TestGen2 -Generation 2 -NewVHDPath D:VMTestGen2.vhdx -NewVHDSizeBytes 64GB

Verification & Acceptance Criteria

VM boots installer successfully and no firmware errors are logged.

Start-VM TestGen2
Get-VM TestGen2 | Select State,Status

Rollback Plan

Revert firmware changes and restore VM export baseline if required.

Set-VMFirmware -VMName TestGen2 -EnableSecureBoot On

Prevention & Hardening

Maintain approved templates for guest OS families and enforce provisioning standards.

Get-VMFirmware -VMName * | Select VMName,SecureBoot,SecureBootTemplate

Related Errors & Cross-Refs

Related: PXE boot loops, virtual TPM policy errors, and shielded VM provisioning constraints.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn guidance for Gen2 VMs, secure boot templates, and Hyper-V firmware configuration.