Can’t enable secure boot on Windows VM? The option’s greyed out because your VM is still on SeaBIOS. Secure Boot needs UEFI — specifically OVMF firmware with a q35 machine type. The checkbox isn’t broken; the whole VM is in legacy mode.
Why it’s greyed out
Proxmox disables the Secure Boot checkbox unless the VM is configured for UEFI. That means two things: the BIOS must be OVMF (UEFI), and the machine type should be q35. If your VM was created with the default SeaBIOS and i440fx, the option stays grey. No amount of clicking fixes it.
Switching an existing Windows VM to UEFI isn’t just a dropdown change. Windows installed in BIOS mode won’t boot from an OVMF firmware — the bootloader is different. You have to convert the disk from MBR to GPT and create an EFI partition. Doable, but you need to be careful.
The fix: convert the VM to UEFI
First, shut down the VM. Then change two settings in the VM’s Options:
- BIOS: OVMF (UEFI)
- Machine: q35
Add an EFI disk if Proxmox didn’t create one automatically. It’s under Hardware → Add → EFI Disk. Pick a storage, give it a small size — 4MB is plenty.
Now the Windows part. Boot the VM from a Windows install ISO. At the first screen, press Shift+F10 for a command prompt. Run:
mbr2gpt /validate /disk:0 /allowFullOS
mbr2gpt /convert /disk:0 /allowFullOSThat converts the disk to GPT and creates the EFI partition. Reboot, and Windows should come up under UEFI. Now the Secure Boot checkbox is active — you can tick it and reboot again.
If mbr2gpt fails
Sometimes it complains about too many partitions or a recovery partition in the way. You can shrink the OS partition from inside Windows first, or delete the recovery partition if you don’t need it. Just back up first — messing with partitions on a live install is risky.
Another route: move the VM’s disk to a new storage as a raw image, then attach it to a fresh UEFI VM. But mbr2gpt is faster if it works.
My take
Honestly, if you need Secure Boot, it’s easier to reinstall Windows with UEFI from the start. The conversion works, but it’s fiddly and Windows sometimes acts weird afterward. For a homelab, I’d just back up the data and do a clean install with OVMF and q35. Less to undo later.
