Migrating Windows 11 VM from VMware to KVM/QEMU: TPM 2.0 UEFI Boot Encryption

Migrating Windows 11 VM from VMware to KVM/QEMU with TPM 2.0 UEFI Boot and Encryption

Windows 11 introduces new hardware requirements, including TPM 2.0 and UEFI boot support. This article will guide you through the process of migrating a Windows 11 virtual machine (VM) running on VMware Workstation on a Nix OS host to KVM/QEMU while preserving TPM 2.0 UEFI boot and encryption settings.

Prerequisites

• A Windows 11 VM running on VMware Workstation on a Nix OS host
• KVM/QEMU installed on the Nix OS host
• Virtualization support enabled in the host's BIOS
• A spare disk or partition to create a new VM

Exporting the VM from VMware

First, you need to export the VM from VMware Workstation. To do this, follow these steps:

1. Shut down the VM in VMware Workstation
2. Open the VM settings and navigate to the "Options" tab
3. Select "General" and click "Export"
4. Choose a location to save the VM settings and disk files
5. Click "Export" to begin the export process

Creating a New VM in KVM/QEMU

Next, create a new VM in KVM/QEMU using the following command:

Replace /path/to/exported/vm/disk.vmdk with the path to the exported VM disk file and /path/to/windows11.iso with the path to the Windows 11 installation media ISO file.

Configuring TPM 2.0 and UEFI Boot in KVM/QEMU

To configure TPM 2.0 and UEFI boot in KVM/QEMU, follow these steps:

1. Shut down the VM in KVM/QEMU
2. Edit the VM configuration file using virsh edit win11
3. Add the following lines to the <devices> section:
   <tpm model="tpm-tis" version="2.0"></tpm> <boot dev="hd"/> <bootmenu enable="yes"/>

   These lines add a TPM 2.0 device and enable UEFI boot.

4. Save the configuration file and exit
5. Start the VM using virsh start win11

Encrypting the VM Disk in KVM/QEMU

To encrypt the VM disk in KVM/QEMU, follow these steps:

1. Shut down the VM in KVM/QEMU
2. Create an encrypted disk using the following command:
   sudo virt-filesystems --name=win11\_encrypted --format=qcow2 --pool=default --size=100G --topology=sector=512 --type=crypto --crypto-type=aes-cbc-plain --crypto-pass=mysecretpassword --cache=writeback

   Replace 100G with the size of the encrypted disk and mysecretpassword with a secure password.

3. Clone the VM disk to the encrypted disk using the following command:
   sudo virt-clone --original=win11 --name=win11\_encrypted --file=/var/lib/libvirt/images/win11\_encrypted.qcow2

   Replace /var/lib/libvirt/images/win11\_encrypted.qcow2 with the path to the encrypted disk.

4. Edit the VM configuration file using virsh edit win11
5. Replace the <disk> element with the following:
   <disk type="file" device="disk" snapshot="no" atomic="yes"> <driver name="qemu" type="qcow2" cache="writeback"/> <source ...
   • Migrating a Windows 11 VM from VMware to KVM/QEMU with TPM 2.0 UEFI boot and encryption requires exporting the VM from VMware, creating a new VM in KVM/QEMU, configuring TPM 2.0 and UEFI boot, and encrypting the VM disk.
   • References:
   • Exporting a VM from VMware Workstation
   • Configuring TPM 2.0 in KVM/QEMU
   • Configuring UEFI Boot in KVM/QEMU
   • Encrypting a VM Disk in KVM/QEMU