[German]I'm bringing up again an issue that has been bothering administrators for months, but probably hit some machines running Windows Server 2022 with the September 2023 security updates. After installing security update KB5030216, the machines can no longer boot. This also applies to virtual machines running Hyper-V or VMware ESXi.
Windows Server 2022 Update KB5030216
Cumulative Update KB5030216 was released for Windows Server 2022 on September 12, 2023 (see Patchday: Windows 11/Server 2022 Updates (September 12, 2023)). Microsoft does write in the support article for this update that Windows Server 2022 may no longer start on guest virtual machines (VMs). This only affects Windows Server 2022 VMs with Secure Boot enabled. VMware ESXi and vSphere ESXi 7.0.x are explicitly mentioned as affected environments.
There is the support article VVirtual Machine with Windows Server 2022 KB5022842 (OS Build 20348.1547) configured with secure boot enabled not booting up (90947) from May 2023, which is linked by Microsoft as a solution. This is because the boot problem first occurred in May 2023 and was supposedly solved by updates from Microsoft as well as updating the VMware products.
Blog readers report issues
Administrators reading along here on the blog should be familiar with the issue that occurred in May 2023 and described by VMware in the support post. What strikes me as odd, therefore, is the fact that readers here on the blog are reporting observations that there are boot problems on Windows Server 2022 in connection with the update.
In this German comment an administrator has reported that the update KB5030216 has killed the Windows Server 2022. The server did not start after the update installation and went into repair mode. Unfortunately, the repair did nothing and I did not have the update uninstalled. I interpret this comment to mean that the problem occurred on a bare metal server. However, the reader writes that he also has the same problem in the VM where he is testing the server.
Another German administrator reports in another comment about a customer where a virtual machine running Windows Server 2022 on a Windows Server 2022 Hyper-V host stopped booting after the updates. Thanks to backup, the problem was quickly resolved, but the update installation had to be disabled.
Windows Server 2019 also has a problem
Something must be wrong. In this German comment a reader writes that he can't install updates on some Windows Server 2016 and Windows Server 2019 machines since months, if Secure Boot is active. He has not found a solution, the installation always fails after the reboot at about 99%. The log files do not show anything regarding a diagnosis.
And in this German comment, someone reports four machines running Windows Server 2019 going into recovery after the September 2023 update. Another 50 or so other servers are not experiencing any problems. The administrator could not discover any correlations. Both VMware and Hyper V are in use as virtualization solutions. The machines that do not start can be found on VMware.
Virtualizing Based Security is the problem
In this German comment, the reader states that they were able to isolate the problem under VMware. The affected VMs had VBS (Virtualizing Based Security) active in the VMware virtual machine settings. Inside the VM, that was also active per Local Security Policy. After disabling Secure Boot and VBS, the update could be installed without problems. Afterwards, you can also enable these features again.
Discussion in the VMware community
A blog reader points out here that there are issues with the September 2023 update in conjunction with VMware on AMD CPUs and Windows Server 2019 VMs with VBS and Secure Launch enabled. This specific feature could not be re-enabled after the update either. There is a discussion in the VMware community about this issue.