Fixing Parallels Windows VM After Secure Boot DB Update

Problem

After a Windows update that includes the Secure Boot Allowed Signature Database (DB) Update, the Parallels VM fails to boot with:

"The Secure Boot feature prevented the operating system from starting"

Fix Overview

Remove and re-add the virtual TPM chip in Parallels. BitLocker will prompt for the recovery key multiple times during the process — have it ready before starting.

Reference: Parallels KB 131131

Prerequisites

• Snapshot of the VM in its current (broken) state
• BitLocker recovery key saved somewhere outside the VM
• VM able to boot temporarily (via snapshot restore to pre-update state)

Steps

1. Get the BitLocker recovery key

With Windows booted (snapshot restored to pre-update state), open PowerShell as Administrator and run:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object {$_.KeyProtectorType -eq "RecoveryPassword"} |
  Select-Object KeyProtectorId, RecoveryPassword

Copy the 48-digit RecoveryPassword value (format: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX) and save it somewhere outside the VM — Mac notes, password manager, etc.

2. Shut down the VM

Full shutdown — not suspend. Start → Power → Shut down. Wait for Parallels to show the VM as Stopped.

3. Remove the TPM chip

1. Right-click the Parallels Desktop icon in dock → Control Center
2. Click the gear/cog icon next to the VM
3. Hardware → TPM Chip in left sidebar
4. Click – (minus) at the bottom of the hardware list
5. Confirm Remove (the warning about "may become unbootable" is expected — proceed)
6. Close the configuration window

4. Boot the VM and enter the BitLocker key

• Start the VM
• BitLocker recovery screen appears
• Enter the 48-digit recovery key from Step 1

5. Windows updates and restarts

After unlock, Windows applies pending updates and reboots automatically.

6. Enter the recovery key again

• BitLocker prompts a second time after the update reboot
• Enter the same recovery key
• VM continues booting

7. Log in

Sign into Windows normally. Confirm desktop loads and system is responsive.

8. Shut down and re-add TPM

1. Full shutdown from inside Windows
2. Control Center → gear icon → Hardware
3. Click + (plus) at the bottom of the hardware list
4. Select TPM Chip
5. Close the configuration window

9. Restart the VM

Start the VM from Control Center.

10. Enter the recovery key a third time

• BitLocker prompts again (TPM is new from its perspective)
• Enter the same recovery key
• VM reboots

11. Log in — done

Sign in normally. The VM is now booting cleanly with Secure Boot intact and the updated signature database accepted.

Post-fix verification

In PowerShell as Administrator:

Get-BitLockerVolume

Confirm ProtectionStatus: On and VolumeStatus: FullyEncrypted on C:.

Then take a fresh snapshot of the working state so you have a clean rollback point going forward.

If something goes wrong

Revert to the snapshot taken in the Prerequisites section. The VM returns to its pre-fix state with no damage. Either retry, or fall back to Parallels' Option 2 (disable Secure Boot via vm.efi.secureboot=0 boot flag) — though this weakens VM security and may conflict with corporate policy.