{"repo":"haz-ard-9/Windows-vSphere-VMs-Bulk-Secure-Boot-2023-Certificate-Remediation","free":true,"listed":false,"github":"https://github.com/haz-ard-9/Windows-vSphere-VMs-Bulk-Secure-Boot-2023-Certificate-Remediation","clone":"git clone https://github.com/haz-ard-9/Windows-vSphere-VMs-Bulk-Secure-Boot-2023-Certificate-Remediation.git","description":"Bulk assessment and remediation of the Windows Secure Boot 2023 certificate transition on VMware vSphere 8 VMs. Cert deployment and PK enrollment via the ESXi P09 silent path or a SetupMode fallback, with a supported-methods-only mode. BitLocker-aware, optionally snapshots before changes, and includes rollback, snapshot, and NVRAM cleanup modes.","language":"PowerShell","stars":54,"topics":["bitlocker","certificate","esxi","powercli","powershell","secure-boot","secureboot","uefi","vmware","vsphere"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"FixSecureBootBulk.ps1 A PowerShell tool for assessing and remediating the Microsoft Secure Boot 2023 certificate issue on Windows Server VMs running in VMware vSphere 8. Supports Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 and 11. The tool provides assessment/inventory, the Microsoft certificate deployment trigger, PK enrollment, hardware-version upgrade, BitLocker handling, and an NVRAM-rename remediation path. The NVRAM rename is not endorsed by VMware engineering (see notice below). Where a Broadcom-supported path is available for your environment, prefer it. This tool is best used as an assessment and orchestration aid, with NVRAM rename reserved as a field-tested fallback applied with explicit risk acceptance, snapshots retained, and pilot validation. --- ## Important notice regarding support status This script uses the NVRAM rename strategy to resolve 2023 certificate availability in VM UEFI firmware. The approach works by renaming the VM's existing .nvram file so that ESXi regenerates it fresh with the updated certificates on next boot. Broadcom previously documented this method in KB 421593. That KB has since been removed. A Broadcom employee has stated in the Broadcom community forums that deleting or renaming the NVRAM file is not endorsed by VMware engineering and not supported. Subsequently, KB 423919 was updated to explicitly state that it replaces KB 421593 specifically \"to avoid suggestions of deleting NVRAM, as that behavior can lead to un","default_branch":null,"files":null,"tree":[],"storefront":"/r/haz-ard-9","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/haz-ard-9/Windows-vSphere-VMs-Bulk-Secure-Boot-2023-Certificate-Remediation/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}