Windows 2025 UEFI/TPM Clone

[lancewicz]

Hi Support,

Windows 2025, q35, UEFI, TPM - pure installation. Machine full shutdown. Then clone. After booting clone error.
How to deal with this?
Is this possible to clone machine, have golden image/templates of machines with TPM/UEFI?

br,

Piotr

 

[fireon]

• Was the VM encrypted using TPM?
• Bitlocker?
• Was sysprep also performed before shutdown? (Please take a VM snapshot beforehand).

 

[lancewicz]

• Was the VM encrypted using TPM?
• Bitlocker?
• Was sysprep also performed before shutdown? (Please take a VM snapshot beforehand).

Bitlocker = no
What you mean by VM encrypted using TPM/
Before doing template sysprep was one with generlize and shutdown and then make template was done.

 

[uzumo]

If you encounter a TPM copy failure on a virtual machine where you implemented the mitigation for CVE-2023-24932 and cannot determine how to revert it, it is advisable to recreate the image.

This likely pertains to an image where that mitigation was applied. However, this question should be directed to Microsoft, not the Proxmox forum.

STATUS_SECUREBOOT_POLICY_NOT_SIGNED

 

[fireon]

Bitlocker = no
What you mean by VM encrypted using TPM/
Before doing template sysprep was one with generlize and shutdown and then make template was done.

I recently created a golden image of Server 2025 with TPM and Secureboot. It worked as it should after Sysprep. Could you please show us your VM configuration?

qm config <vmid>

If you encounter a TPM copy failure on a virtual machine where you implemented the mitigation for CVE-2023-24932 and cannot determine how to revert it, it is advisable to recreate the image.

Do you mean just recreating the TPM or the TPM and EFI image? Since nothing is encrypted by default, you can do this safely.

 

[lancewicz]

I recently created a golden image of Server 2025 with TPM and Secureboot. It worked as it should after Sysprep. Could you please show us your VM configuration?

qm config <vmid>

Do you mean just recreating the TPM or the TPM and EFI image? Since nothing is encrypted by default, you can do this safely.

Config of the template

root@proxmox2:~# qm config 111
agent: 1
balloon: 4096
bios: ovmf
boot: order=sata0;net0
cores: 16
cpu: host
efidisk0: macierz:base-111-disk-0,efitype=4m,ms-cert=2023,pre-enrolled-keys=1,size=4M
machine: pc-q35-10.1
memory: 16384
meta: creation-qemu=10.1.2,ctime=1766747831
name: Win2025Temp
net0: virtio=BC:24:114:C39,bridge=vmbr0,firewall=1
numa: 0
ostype: win11
sata0: macierz:base-111-disk-1,cache=unsafe,size=150G
smbios1: uuid=276f55eb-5608-4275-80e4-105dfc87fca4
sockets: 2
template: 1
tpmstate0: macierz:base-111-disk-2,size=4M,version=v2.0
vmgenid: 01fc456c-8ee7-4427-8180-69873023c51a

 

[fireon]

Config of the template

Thanks for output. Looks ok. There are two things I would like to optimize:

• Change virtual harddrivebus from SATA to SCSI
• Add an RNG Device. A VirtIO RNG device can also improve to better performance.

For your issue, I would test @uzumo recommendation and recreate the TPM device.

Edit: Please use the “Code” feature for configurations, terminal outputs, and similar items. This makes things easier for us to read