Battlefield 6 beta just opened up and apparently they are now requiring Secure Boot enabled for Windows. In my Google-Fu, I haven't really found a well documented way to enable Secure Boot in Windows 11 VM on unRaid. Has anyone got Secure Boot enabled and if so, any guides that exist out there that can help?

I really like have my gaming VM on my server jut to cut down on another box since I really only game 4-5 hours a week.

Here is my XML if I need to make any tweaks there.

<?xml version='1.0' encoding='UTF-8'?>

<domain type='kvm' id='6'>

<name>debo-pc</name>

<uuid>8f4c2bce-bc57-2dd9-f84f-0b8f54c354f3</uuid>

<metadata>

<vmtemplate xmlns="unraid" name="Windows 11" icon="windows11.png" os="windowstpm" webui=""/>

</metadata>

<memory unit='KiB'>16777216</memory>

<currentMemory unit='KiB'>16777216</currentMemory>

<memoryBacking>

<nosharepages/>

</memoryBacking>

<vcpu placement='static'>16</vcpu>

<cputune>

<vcpupin vcpu='0' cpuset='8'/>

<vcpupin vcpu='1' cpuset='24'/>

<vcpupin vcpu='2' cpuset='9'/>

<vcpupin vcpu='3' cpuset='25'/>

<vcpupin vcpu='4' cpuset='10'/>

<vcpupin vcpu='5' cpuset='26'/>

<vcpupin vcpu='6' cpuset='11'/>

<vcpupin vcpu='7' cpuset='27'/>

<vcpupin vcpu='8' cpuset='12'/>

<vcpupin vcpu='9' cpuset='28'/>

<vcpupin vcpu='10' cpuset='13'/>

<vcpupin vcpu='11' cpuset='29'/>

<vcpupin vcpu='12' cpuset='14'/>

<vcpupin vcpu='13' cpuset='30'/>

<vcpupin vcpu='14' cpuset='15'/>

<vcpupin vcpu='15' cpuset='31'/>

</cputune>

<resource>

<partition>/machine</partition>

</resource>

<os>

<type arch='x86_64' machine='pc-q35-7.2'>hvm</type>

<loader readonly='yes' type='pflash'>/usr/share/qemu/ovmf-x64/OVMF_CODE-pure-efi-tpm.fd</loader>

<nvram>/etc/libvirt/qemu/nvram/8f4c2bce-bc57-2dd9-f84f-0b8f54c354f3_VARS-pure-efi-tpm.fd</nvram>

</os>

<features>

<acpi/>

<apic/>

<hyperv mode='custom'>

<relaxed state='on'/>

<vapic state='on'/>

<spinlocks state='on' retries='8191'/>

<vpindex state='on'/>

<synic state='on'/>

<stimer state='on'/>

<vendor_id state='on' value='none'/>

</hyperv>

</features>

<cpu mode='host-passthrough' check='none' migratable='on'>

<topology sockets='1' dies='1' clusters='1' cores='8' threads='2'/>

<cache mode='passthrough'/>

<feature policy='require' name='topoext'/>

<feature policy='disable' name='arch-capabilities'/>

</cpu>

<clock offset='localtime'>

<timer name='hpet' present='no'/>

<timer name='hypervclock' present='yes'/>

</clock>

<on_poweroff>destroy</on_poweroff>

<on_reboot>restart</on_reboot>

<on_crash>restart</on_crash>

<devices>

<emulator>/usr/local/sbin/qemu</emulator>

<disk type='file' device='disk'>

<driver name='qemu' type='raw' cache='writeback' discard='ignore'/>

<source file='/mnt/cache/domains/debo-pc/vdisk1.img' index='3'/>

<backingStore/>

<target dev='hdc' bus='virtio'/>

<boot order='1'/>

<alias name='virtio-disk2'/>

<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>

</disk>

<disk type='block' device='disk'>

<driver name='qemu' type='raw' cache='writeback' discard='ignore'/>

<source dev='/dev/disk/by-id/ata-Samsung_SSD_860_EVO_1TB_S599NE0MA86416V' index='2'/>

<backingStore/>

<target dev='hdd' bus='virtio'/>

<alias name='virtio-disk3'/>

<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>

</disk>

<disk type='file' device='cdrom'>

<driver name='qemu' type='raw'/>

<source file='/mnt/cache/ISO Library Share/virtio-win-0.1.262-2.iso' index='1'/>

<backingStore/>

<target dev='hdb' bus='sata'/>

<readonly/>

<alias name='sata0-0-1'/>

<address type='drive' controller='0' bus='0' target='0' unit='1'/>

</disk>

<controller type='usb' index='0' model='qemu-xhci' ports='15'>

<alias name='usb'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>

</controller>

<controller type='pci' index='0' model='pcie-root'>

<alias name='pcie.0'/>

</controller>

<controller type='pci' index='1' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='1' port='0x10'/>

<alias name='pci.1'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>

</controller>

<controller type='pci' index='2' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='2' port='0x11'/>

<alias name='pci.2'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>

</controller>

<controller type='pci' index='3' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='3' port='0x12'/>

<alias name='pci.3'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>

</controller>

<controller type='pci' index='4' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='4' port='0x13'/>

<alias name='pci.4'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>

</controller>

<controller type='pci' index='5' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='5' port='0x14'/>

<alias name='pci.5'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>

</controller>

<controller type='pci' index='6' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='6' port='0x15'/>

<alias name='pci.6'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>

</controller>

<controller type='pci' index='7' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='7' port='0x8'/>

<alias name='pci.7'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>

</controller>

<controller type='pci' index='8' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='8' port='0x9'/>

<alias name='pci.8'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>

</controller>

<controller type='pci' index='9' model='pcie-root-port'>

<model name='pcie-root-port'/>

<target chassis='9' port='0xa'/>

<alias name='pci.9'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>

</controller>

<controller type='pci' index='10' model='pcie-to-pci-bridge'>

<model name='pcie-pci-bridge'/>

<alias name='pci.10'/>

<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>

</controller>

<controller type='virtio-serial' index='0'>

<alias name='virtio-serial0'/>

<address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>

</controller>

<controller type='sata' index='0'>

<alias name='ide'/>

<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>

</controller>

<interface type='bridge'>

<mac address='52:54:00:xx:xx:xx'/>

<source bridge='br0'/>

<target dev='vnet4'/>

<model type='virtio-net'/>

<alias name='net0'/>

<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>

</interface>

<serial type='pty'>

<source path='/dev/pts/0'/>

<target type='isa-serial' port='0'>

<model name='isa-serial'/>

</target>

<alias name='serial0'/>

</serial>

<console type='pty' tty='/dev/pts/0'>

<source path='/dev/pts/0'/>

<target type='serial' port='0'/>

<alias name='serial0'/>

</console>

<channel type='unix'>

<source mode='bind' path='/run/libvirt/qemu/channel/6-debo-pc/org.qemu.guest_agent.0'/>

<target type='virtio' name='org.qemu.guest_agent.0' state='connected'/>

<alias name='channel0'/>

<address type='virtio-serial' controller='0' bus='0' port='1'/>

</channel>

<input type='mouse' bus='ps2'>

<alias name='input0'/>

</input>

<input type='keyboard' bus='ps2'>

<alias name='input1'/>

</input>

<tpm model='tpm-tis'>

<backend type='emulator' version='2.0' persistent_state='yes'/>

<alias name='tpm0'/>

</tpm>

<audio id='1' type='none'/>

<hostdev mode='subsystem' type='pci' managed='yes'>

<driver name='vfio'/>

<source>

<address domain='0x0000' bus='0x31' slot='0x00' function='0x0'/>

</source>

<alias name='hostdev0'/>

<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>

</hostdev>

<hostdev mode='subsystem' type='pci' managed='yes'>

<driver name='vfio'/>

<source>

<address domain='0x0000' bus='0x31' slot='0x00' function='0x1'/>

</source>

<alias name='hostdev1'/>

<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>

</hostdev>

<hostdev mode='subsystem' type='pci' managed='yes'>

<driver name='vfio'/>

<source>

<address domain='0x0000' bus='0x2e' slot='0x00' function='0x1'/>

</source>

<alias name='hostdev2'/>

<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>

</hostdev>

<hostdev mode='subsystem' type='pci' managed='yes'>

<driver name='vfio'/>

<source>

<address domain='0x0000' bus='0x2e' slot='0x00' function='0x3'/>

</source>

<alias name='hostdev3'/>

<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>

</hostdev>

<watchdog model='itco' action='reset'>

<alias name='watchdog0'/>

</watchdog>

<memballoon model='none'/>

</devices>

<seclabel type='dynamic' model='dac' relabel='yes'>

<label>+0:+100</label>

<imagelabel>+0:+100</imagelabel>

</seclabel>

</domain>

I'm wondering the same. Not sure why EA makes these annoying requirements.

I am trying to do the same, I have my current VM setup with OVMF TPM, and secure boot is OFF in WIN 11. I can't for the life of me find anything current on how to get to turn it on.

I stumbled upon this old thread...but doesn't seem to help.

Also trying to get this working, I found this info https://forums.unraid.net/topic/128595-secure-boot-off-in-ovmf-tpm-bios-windows-11/

It's a bit involved where you sign your on keys from Microsoft. I'm yet to do it as I'd rather an easier solution