To enable Secure Boot and vTPM on a Nutanix AHV cluster, specific VM configuration requirements must be met. According to the Nutanix AHV Administration and Security guides, Secure Boot prevents malicious code from loading during the boot process by ensuring that only signed drivers and OS loaders are used.
When configuring a VM for Secure Boot, the machine type must be set to q35. The standard legacy machine type (i440fx) does not support the necessary features for Secure Boot and vTPM operations in this context. Documentation for creating or updating a VM with these features via the Acropolis CLI (aCLI) explicitly includes the parameter machine_type=q35 in the command string (e.g., vm.create vm-name machine_type=q35 uefi_boot=true secure_boot=true virtual_tpm=true). Furthermore, if an administrator attempts to update an existing VM to enable Secure Boot without this machine type, the operation will fail or require the conversion, as Secure Boot and vTPM are supported specifically on the Q35 virtual hardware platform combined with UEFI boot mode.
Legacy BIOS (Option C) is explicitly unsupported for Secure Boot, as UEFI is a strict prerequisite. Hardware TPM pass-through (Option D) is not used; instead, AHV utilizes a software-based vTPM that keeps the crypto keys independent of the underlying hardware to allow for VM mobility.
Relevance of the video: The video provides a step-by-step visual guide on enabling Credential Guard and Secure Boot for Windows VMs on Nutanix AHV, which directly illustrates the configuration steps and requirements discussed in the question, including the necessary VM settings.
Enabling Credential Guard for AHV Windows VMs
