Windows Server 2012R2 x64 VM - booting from ISO gives an error

Incus
1

Hi,

I wanted to play a little with Windows Server 2012R2, but I have a problem when trying to install it as a VM under Incus 6.1. After I boot VM from created ISO (distrobuilder), the Windows Boot Manager open and from there I can select “Windows Setup [EMS Enabled]”.

After selecting it, the system is trying to boot, but ends up with an “Windows failed to start…” error. Under Info section, it displays an explanation: The operating system couldn’t be loaded because the digital signature of a file couldn’t be verified.

Incus Server information:
Debian 12.5 | Incus 6.1 | 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64 GNU/Linux

ISO information

  1. I downloaded latest WinSrv2012R2 iso from our Microsoft Business Center.
  2. Then I used “Distrobuilder” to repack the image:
    distrobuilder repack-windows SW_DVD9_WINDOWS_SVR_STD_AND_DATACTR_2012_R2_64BIT_ENGLISH_-4_MLF_X19-82891.ISO SW_DVD9_WINDOWS_SVR_STD_AND_DATACTR_2012_R2_64BIT_ENGLISH_-4_MLF_X19-82891_Incus.ISO --debug --windows-version=2k12 --windows-arch=amd64 --cache-dir=/tmp/cache/

it took some time, but was successfully completed.

VM
I created the empty vm, modified the configuration and after that I started the VM
incus init win2012R2vm -p vlan215-win --empty --vm -c security.secureboot=false
incus config device override win2012R2vm root size=50GB
incus config set win2012R2vm limits.cpu=2 limits.memory=8GiB
incus config device add win2012R2vm install disk source=/tmp/SW_DVD9_WINDOWS_SVR_STD_AND_DATACTR_2012_R2_64BIT_ENGLISH_-4_MLF_X19-82891_Incus.ISO boot.priority=10
incus start win2012R2vm --console=vga

VM config
architecture: x86_64
config:
limits.cpu: “2”
limits.memory: 8GiB
security.secureboot: “false”
volatile.cloud-init.instance-id: a272bce4-2c81-41a8-a9cb-9275874252c3
volatile.eth0.host_name: tap9cd0d386
volatile.eth0.hwaddr: 00:16:3e:af:c9:21
volatile.last_state.power: RUNNING
volatile.last_state.ready: “false”
volatile.uuid: 611d595c-1d56-4f60-86ad-5946325f3186
volatile.uuid.generation: 611d595c-1d56-4f60-86ad-5946325f3186
volatile.vsock_id: “2927572970”
devices:
eth0:
nictype: bridged
parent: vlan215
type: nic
install:
boot.priority: “10”
source: /tmp/SW_DVD9_WINDOWS_SVR_STD_AND_DATACTR_2012_R2_64BIT_ENGLISH_-4_MLF_X19-82891_Incus.ISO
type: disk
root:
path: /
pool: pool-ssd-4tb
size: 50GB
type: disk
ephemeral: false
profiles:

  • vlan215-win
    stateful: false
    description: “”

Hardware Information
I am using HP Z4 G4 WorkStation | 128 GB RAM | Intel i7-7800X CPU

Additional info
On that Incus server, other instances are working just fine (Linux Containers, Linux VM-s and Windows 11 VM).

Any Ideas?

Thanks in advance,

Regards
_R

3

Hmm, 2012 is getting a bit old by now so maybe something wrong with those drivers now, sounds like a potential driver signature issue.

I know there used to be a way from the Windows boot menu to disable that validation completely (not that it should be needed).

1 Like
4

Thank you for the answer.

Yes, 2012 is a bit old and it seems to be the driver issue.

  1. Press “F8” key during the setup startup;
  2. Choose “Disable Driver Signature Enforcement”.

After that the Win2012R2 setup window appears.

Thank you for the hint.

Regards
_R

1 Like
5

One additional comment.

There is a way to avoid pressing “F8” and selecting “Disable Driver Signature Enforcement” every single time you restart Windows Server 2012 R2 on Incus Server.

The easiest solution is to put server into test mode (the only difference is that the test mode disables driver signature enforcement). To do that:

  1. Right click on Start → Select “Command Prompt (Admin)”.
  2. Enter command: bcdedit.exe /set nointegritychecks ON
  3. Enter command: bcdedit.exe /set TESTSIGNING ON

Both commands should return the “success” message. After entering those commands, restart the server to check that the booting issue is fixed.

Regards
_R

1 Like