KB5012170 fails to install on Win11 host

[C.G.B. Spender]

Hi,
as the title says, this update gets to 20% and then fails with error 0x800f0922. The update itself does something UEFI related (https://support.microsoft.com/en-us...t-9-2022-72ff5eed-25b4-47c7-be28-c42bd211bb15). Update installs without issues on physical W11 hosts.

Is there any setting I need to change or is it just a symptom of it being a vm? Functionality doesn't seem affected, I'd just like the error go away. Been fully updating this windows vm since Win7, don't wanna lose my streak now

pve: PVE 7.2-7,
vm: pc-q35-6.2 Win11 x64 pro 21H2, OS Build 22000.856, Windows Feature Experience Pack 1000.22000.586.0

 

[jonathan.young]

I am running into the same problem as well but with WIndows 10. Just another day as a Microsoft user...

 

[mikey242]

Running into the same issue. Seems to be related to secure boot but not sure what to do to fix it:
https://answers.microsoft.com/en-us...boot-dbx/699b8c9b-6b97-4216-acd4-b86d91bb9cf9

 

[jonathan.young]

I think we just have to wait. I think MS are aware of an issue but whether it is to do with our VM Bios or not we wll have to see.

 

[C.G.B. Spender]

I would think it has to do with the vm bios. The same update installed ok on 10th of August on 2 desktops and 1 laptop with win11.

 

[nullify]

Having the same issue on one of my Win10 VMs. It uses SeaBIOS though, not UEFI.

Interestingly, I have two other VMs on a different host where the update installs without problem. Not sure which part of the setup could be the culprit and haven't had time to test yet.

Correction: The affected VM uses UEFI, the unaffected VMs use SeaBIOS.

 

[LDS_Cyber]

I can add to the list of someone having the same exact problem as well on Windows 10. I am booting UEFI

 

[ITT]

Your EFI-Disk must have "Pre-Enrolled Keys" enabled.

 

[LDS_Cyber]

Your EFI-Disk must have "Pre-Enrolled Keys" enabled.

What if you imported a disk from VMWare? That is my current situation.

 

[ITT]

What if you imported a disk from VMWare? That is my current situation.

Same Situation, change the EFI-Disk (without the Pre-enrolled Keys) to a new EFI-Disk with the Keys.
Done in Proxmox, it does not matter if the VM is imported or not.

 

[nullify]

Your EFI-Disk must have "Pre-Enrolled Keys" enabled.

Thank you. That seems to have done the trick. I deleted my EFI disk and re-added it with pre-enrolled keys enabled.
The update installed immediately.

I don't think Secure Boot was enabled before this change, but it certainly is now.

 

[LDS_Cyber]

Thank you. That seems to have done the trick. I deleted my EFI disk and re-added it with pre-enrolled keys enabled.
The update installed immediately.

I don't think Secure Boot was enabled before this change, but it certainly is now.

How exactly do you enable that option. I added the disk and there was no option to have pre-enrolled keys. In addition, I only saw this when creating a new VM.

 

[nullify]

How exactly do you enable that option. I added the disk and there was no option to have pre-enrolled keys. In addition, I only saw this when creating a new VM.

It's right in the interface, when you go to Add->EFI Disk.

 

[LDS_Cyber]

It's right in the interface, when you go to Add->EFI Disk.

Got it working with that.. Thanks for that, I didn't see how that could affect the actual disk with the OS.

 

[macpip]

Resolved the issue here on a Windows Server 2019: install of KB5012170 failed at 99%. Then I solved the problem this way:

1. Poweroff Windows server 2019 VM
2. Detach EFI disk
3. Add a new one EFI DISK with "Pre-Enrolled Keys"
4. Boot VM
5. Start Windows Update
6. Install pending update

The update installed successfully.
Thanks to everybody!

 

[Pragma808]

I am experiencing the same issue, though my VM uses a physical NVMe boot drive (no virtual disks attached either). Any ideas on what the solution would be in my case?

 

[michu_pl]

Hello everyone!

After following the steps suggested by macpip, the update was successfully installed, but Red Hat QXL controller stopped working after the reboot. It appears as an unsigned driver in device manager.

Does anyone know what could be the cause and how to fix it? Currently only the generic graphic driver is available and the resolution has been locked to 1024x768

PVE 7.2-7
VM Windows 11 Home 21H2 22000.856

Best regards

 

[cvocvo]

I am experiencing the same issue, though my VM uses a physical NVMe boot drive (no virtual disks attached either). Any ideas on what the solution would be in my case?

Running into the same issue; I'm passing through an NVME drive as PCIE.
I tried installing the update manually with the new EFI disk as suggested above, but I'm still getting an install error

Edit: I just had to admit defeat first; removing and re-adding my EFI disk per @macpip 's instructions worked on Server 2019.

 

[fireon]

This did not work here on Windows10. If i change this, i can see only the windows repair screen. I have also changed for test:

• Hotplug
• Qemu Version
• q35
• Display

But Windows10 will not start anymore.

agent: 1,fstrim_cloned_disks=1
bios: ovmf
boot: order=scsi0
cores: 6
description:
efidisk0: SSD-vmdata:vm-139-disk-0,efitype=4m,pre-enrolled-keys=1,size=1M
hotplug: disk,network,usb
machine: pc-q35-6.0
memory: 6144
name: build-windows-10-64
net0: virtio=91:1F:9C:35:AF:C0,bridge=vmbr0,firewall=1,tag=11
numa: 1
onboot: 1
ostype: win10
parent: vor_start
rng0: source=/dev/urandom
sata0: none,media=cdrom
sata1: none,media=cdrom
scsi0: SSD-vmdata:vm-139-disk-1,discard=on,size=100G,ssd=1
scsihw: virtio-scsi-pci
smbios1: uuid=d3a18ea2-d8e4-4940-bff1-bc169a57bf04
sockets: 1

 

[fluxX04]

Hi,

This did not work here on Windows10. If i change this, i can see only the windows repair screen.

had the same problem on my windows boxes but server 2019-2022.
I fixed it with a reset of the secure boot keys.

Go into th UEFI Shell when the VM starts then Device Manager -> Secure Boot Configuration -> Reset Secure Boot Keys -> Save and continue booting.

Instruction obviously with no warranty because don't know what other things it effects but for me it worked - so make a backup first.

Greetz