Preparing VMware VMs for the 2026 Microsoft Secure Boot Certificate Expiration

Posted on by

This is a continuation of January’s post about the upcoming secure boot certificate expiration. I’ve put together a script assisted strategy for patching our fleet of VMware vSphere machines by clearing out the NVRAM files in mass.

The first pass on the script has been uploaded to my GitHub as VMW_MSUEFICA2023Patch.ps1 and has so far been successful in test and pre-production scenarios to work through and patch a batch of VMs.

To reiterate on the issue at hand. In June of this year, the Microsoft signing certificates that are part of the secure boot process that have been in place since 2011 are expiring. Replacement of those certificates in the virtual environment cannot be handled from within the operating system because of an invalid platform key in the VMware vSphere virtual BIOS. So far, Broadcom has published two potential solutions. Either, (1) deleting the NVRAM file and allowing the UEFI variables to reset to new defaults on boot or, (2) fixing the invalid platform key through some very manual console work. I’ve opted to implement the first option.

Continue reading →

Enterprise Preparation for the 2026 Microsoft Secure Boot Certificate Expiration

Posted on by

Back in 2023 with the release of CVE-2023-24932 (BlackLotus), the conversation around replacing Secure Boot certificates came to light. In the context of the CVE, it was to prevent use of signed and completely valid boot manager that could be exploited to bypass Secure Boot protections. Even without the CVE, those same certificates expire in mid-2026 – this year.

For the average consumer, Microsoft is managing the installation of replacement certificates. For enterprises with managed updates, we’re left to do it ourself. Neither instance addresses the revocation of the old certificates, which remains a manual step. Virtual machines add an additional complication with the KEK certificate – more on that below. Continue reading →

Modify Teleport VPN Subnet on Ubiquiti UniFi Gateway

Posted on by

Current lines of the UniFi Gateway devices, such as the UXG-Fiber that I am using, include a built in VPN server called Teleport. The idea is a simple, zero-configuration VPN solution. When activated, the VPN is configured automatically by selecting an unused subnet from the 192.168.X.0/24 range.

While initial deployment was as simple as advertised, I quickly ran into a problem where UniFi assigned a subnet that overlapped with a subnet on an upstream router. Teleport, being a zero-configuration service, gave no way to actually set what subnet is in use. Insert some curiosity and a solution.

Requirements

  • Administrative access to the UniFi OS Control Plane (Cloud Key or equivalent).
  • SSH access to the UniFi OS Control Plane (Cloud Key or equivalent), required to access the MongoDB.

Summary Steps

  • Gain SSH Access to the UniFi OS Control Plane
  • Determine the Site_ID Value for the Teleport Configuration
  • Modify the Teleport Subnet

Continue reading →

MS SQL AlwaysOn Availability Groups with Managed Service Accounts

Posted on by

This is a practical guide for configuration Microsoft SQL Server with AlwaysOn Availability Groups using Managed Service Accounts.

This is not a guide for installing Microsoft SQL Server as there are plenty of existing resources to do so. This guide assumes that you have a pair of fresh SQL Servers or that you have the knowledge to create and install a best practices SQL Server.

Requirements

  • Two or more ready SQL Servers.
  • Domain Administrator, or delegated privileges to create Computer Accounts, Managed Service Accounts, and Security Enabled Groups.
  • Domain Administrator, or delegated privileges to set Service Principal Names.
  • Local administrative privileges on the SQL Server operating system.
  • SA privileges on the SQL Server instances.

Summary Steps

  • Pre-Create Active Directory Resources.
    • Computer Account Objects
    • Managed Service Account Object
    • Service Principal Names
  • Configure the SQL Server operating system.
    • Local Firewall
    • Local Security Policy
    • Network Adapters
  • Create the Windows Server Failover Cluster instance.
  • Configure a File Share as a cluster witness.
  • Enable AlwaysOn functionality for MS SQL.
  • Configure the Managed Service Account for MS SQL.
  • Create the Availability Group.

Continue reading →

Pages: 1 2