Windows VM Issue with Active Directory and My Findings (Issue with Intel Lunar Lake Core Ultra CPUs? + workaround)

Apps and Virtualization
1

Hi everyone,

I’m new to TrueNAS and I just started using 25.04.1 (when incus was introduced?) and while I could install the following OS: Windows 11, Windows Server 2025 or 2022, it would 100% of the time go in a recovery boot loop directly after the FIRST reboot AFTER joining the active directory domain.

I looked online to not find too much info on the issue but did find some info. Some hinted that it has something to do with the intel cpu.

I tried disabling all gpos, playing with tpm and secure boot, registry hacks, playing with different versions of virtio drivers, etc. Nothing worked.

However, I did notice that it did happen on proxmox too. CPU type: x86-64-v3 works stable though. Proxmox is using a similar CPU as my truenas: Intel Core Ultra 7 265k. My truenas is using Core Ultra 5 225.

So on 25.04.2 I again tried to install server 2025 with the exact same issue but with this new implementation it allowed me to try new settings, here are my findings:

  1. Cpu type: Host - has boot loop after AD join
  2. Cpu type: Host passthrough - has boot loop after AD join
  3. Cpu type: KVM64 - fails to get past press any key to boot to CD (to install)
  4. Cpu type: Qemu64 - fails to get past press any key to boot to CD (to install)
  5. Cpu type: Tried other various CPU models like broadwell, etc. - Complains not compatible
    6. Cpu type: IvyBridge - Let me use the CPU model and install worked. No boot loop after joining AD + reboot afterwards.

I hope this might help others with my issue that I struggled with and maybe help get a proper cpu type added in dropdown menu settings that works with this cpu optimally.

My CPU: Intel Core Ultra 5 225 on a bare metal truenas (25.04.2)

Thank you everyone and developers.

Ive had my windows server 2025 DC installed for 1 day now stable, where as before it would boot loop after first reboot after joining active directory domain every time.

2

I dont use the hypervisor in TN.
It is a great NAS appliance, but lacks big time as a hypervisor.
ALl my systems now use Proxmox and TN virtualized on them.
Works like charm without any problems.

3

Thanks! I am just using it for if I need a second VM of the same OS type. Like I have a domain controller on proxmox but since I have truenas I have a second domain controller on here. That is my use case for now. Might install proxmox backup server as well. But I think that’s it.

4

Finally found the fix for this issue after months struggling with it.

After switching to “IvyBridge” CPU type for the DC to boot again, you need to disable Credential Guard with the following commands (admin Powershell), then turn off your VM, change CPU type back to “host passthrough”, then reboot.

Commands :

reg add “HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard” /v “EnableVirtualizationBasedSecurity” /t REG_DWORD /d 1 /f
reg add “HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard” /v “RequirePlatformSecurityFeatures” /t REG_DWORD /d 1 /f
reg add “HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard” /v “Locked” /t REG_DWORD /d 0 /f

reg add “HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity” /v “Enabled” /t REG_DWORD /d 1 /f
reg add “HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity” /v “Locked” /t REG_DWORD /d 0 /f

reg add “HKLM\SYSTEM\CurrentControlSet\Control\Lsa” /v “LsaCfgFlags” /t REG_DWORD /d 0 /f
reg add “HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard” /v “LsaCfgFlags” /t REG_DWORD /d 0 /f

5

Also, the issue is not specific to TrueNAS or Lunar Lake CPUs.
It’s virtualized Windows Server 2025 (maybe some previous versions) on late-gens Intel CPUs, when Credential Guard gets activated (such as when promoting a DC).