I see that after running 2023-02 MSRT on Windows Server 2022, the server is no longer booting as UEFI/EFI with Secure Mode Enabled. After disabling Secure Mode, the server boots as normal. I tested this behaviour on a number of VMs running in an ESX lab and isolated the issue to MSRT. I am not sure if this applies to the specific conditions - VMs running in ESX or it is a more general issue. It is very likely that this is the most common scenario under which Windows Server 2022 is running.
It is still bizarre behaviour to have a scanner which is not even installed supposedly breaking a file signature. Very curious how this can be remediated if Microsoft will not be releasing a patch soon. The log under C:\Windows\debug\mrt.log does not show anything different than previous scans or unusual.
From patchmanagement: "So far this is isolated to a single VM on VMware ESXI, but we have a server 2022, new install from about 2 weeks ago, installed updated Ok, rebooted OK. Just rebooted again and it’s got a “security violation.” Turning off VBS and secure boot seems to have fixed it for now. Others in the reddit megathread are reporting boot issues with server 2022 requiring disabling vbs/secure boot. "
Thanks. I figured out that turning off Secure Boot fixes it. I don't use VBS. As this is a lab, I am not impacted in any way - production wise and I can play with the settings as much as I wish. While many production sites do not install/run MRT, a lot are as it comes on WSUS. For me this is only of academic interest, but I think now I finally got your message about the usefulness of MRT.
I have Win 11 physical and in ESX 7 and they run fine after MRT was run. Same for Win 10 in ESX. For some reason, only the server is impacted. I am amazed that Microsoft has not released an emergency patch to address this issue being about the server running in ESX which is very typical these days.
It's possible that 2022 with UEFI+SB on ESXi v7 isn't that wide spread yet. I still see new VMs created with legacy bios on daily basis and it's surely not affected by this. Also it would be interesting to see if Hyper-V has this issue. I have 2022 Hyper-V hosts, but no 2022 guests on them to test it out, yet.
I think you have a point here. But the VMware virtual firmware has not changed since yesterday when it was working. Unless Microsoft did something on purpose. However Win 11 and Win 10 do not seem to be impacted, so I believe this is rather a bug than intentional.