Unlock Windows 11 in VirtualBox: Enable TPM & Secure Boot Now!
Current VirtualBox can provide a Windows 11 guest with a virtual TPM and UEFI Secure Boot. The claim that these features are architecturally impossible in VirtualBox is outdated: Oracle added virtual TPM 1.2/2.0 and Secure Boot support in the 7.0 series. See the Oracle 7.0 release history.
Check Version and Architecture First
Use a maintained VirtualBox release appropriate for the host and guest architecture. A 6.1-era guide does not describe current TPM and Secure Boot support. Check Help > About and Oracle’s documentation for the installed release. For Windows 11 installation, use matching official Windows media and a valid license.
The steps below concern a typical x64 guest. Arm guests have different configuration limits; current Oracle documentation says the TPM and UEFI selections cannot be changed for Arm VMs. Do not assume every x64 option will appear on an Arm host.
Configure a New x64 VM Before Installation
With the VM fully powered off, open Settings > System > Motherboard. Select TPM Version 2.0, enable UEFI/EFI, and enable Secure Boot. Labels can differ between versions. Save the settings before starting Windows Setup. If options are missing, confirm the VirtualBox release, architecture, and whether the VM is actually powered off.
Oracle documents these controls in VM configuration. An unofficial external TPM emulator or a requirement-bypass registry change is not normally needed for this supported configuration.
Meet the Other Windows Requirements
TPM and Secure Boot are not the entire compatibility check. Allocate at least two virtual processors, 4 GB RAM, and a virtual storage device of at least 64 GB, while leaving resources for the host. Check the applicable processor and graphics requirements as well. Minimum values do not guarantee good performance.
For a fresh UEFI installation on a new empty virtual disk, Windows Setup can create the required GPT layout. Do not run DiskPart clean or convert an existing disk merely because an installer gives a general compatibility message. These actions can remove data, and a firmware-mode change can make an existing installation unbootable.
Verify From Inside the Guest
After Windows starts, open System Information with msinfo32. Check BIOS Mode and Secure Boot State for the guest. Open tpm.msc and verify that a TPM is ready and its specification version is 2.0. These observations concern the VM, not automatically the physical host.
A virtual TPM is a supported virtual device; it is not the same thing as handing the guest exclusive ownership of the host’s physical TPM. Secure Boot validates the guest’s boot chain using the VM firmware trust store. Neither feature removes the need to secure the host and control access to VM files.
Preserve TPM and Firmware State
Before changing security configuration on an installed guest, preserve a powered-off backup of the VM and its state, and make sure any BitLocker recovery key is available. Do not clear, replace, or disable its TPM casually: encryption may depend on that state.
Secure Boot keys reside in the VM’s UEFI variable store, including its .nvram file, separately from TPM state. For certificate maintenance, follow Oracle’s Secure Boot key guidance for the exact release. Resetting TPM state is not a substitute for updating firmware trust material.
Diagnose Failures Without Assuming Missing Support
If Windows says it cannot run, record the exact message and verify the guest configuration and media. If TPM detection fails despite correct settings, check current release notes for fixes. If Secure Boot rejects media, check the image and firmware trust configuration before turning the feature off.
Use the VirtualBox troubleshooting guide for unrelated startup, display, or integration problems. A black screen alone does not prove a TPM or Secure Boot failure.
Decide on a Hypervisor From Actual Requirements
VirtualBox, Hyper-V, and VMware have different host support, management, security, and licensing arrangements. A migration may be appropriate for a specific requirement, but is not necessary solely because VirtualBox supposedly lacks TPM and Secure Boot. Check the actual platform capabilities and organizational requirements rather than treating a virtual device as automatic compliance with every security standard.