NixOs works but Windows boots to Bitlocker recovery about lanzaboote HOT 9 OPEN

I assume that you lose your default Windows bootable or something, can you be more explicit about how Windows doesn't boot anymore? What do you observe?

from lanzaboote.

When i had secure boot on:

• windows boot loader successfully booted into windows
• nixos did not boot at all, just 1 second of black screen and back to boot selection menu

When i had secure boot off:

• windows boot loader booted into bitlocker recovery screen
• nixos successfully booted

After lanzaboote with secure boot on:

• windows boot loader boots into bitlocker recovery screen, even after i used the 'enroll-leys --microsoft' command
• nixos successfully boots and uses secure boot

from lanzaboote.

Yes, that's expected, enrolling new keys will change the Secure Boot database and change the measurements for the boot.
You need to recover once the Bitlocker to move on.

from lanzaboote.

This is unrelated to Secure Boot though.

from lanzaboote.

I'm not sure what measurements Windows uses to seal the disk encryption key but what you describe in "After lanzaboote with secure boot on" sounds like what I would expect: You can boot Windows but Bitlocker is not happy because the PCRs have changed.

@RaitoBezarius Do you know off the top of your hat whether the above is expected behavior? If so we should add a warning around having your Bitlocker recovery key handy to the docs.

from lanzaboote.

Yes, that's expected, enrolling new keys will change the Secure Boot database and change the measurements for the boot. You need to recover once the Bitlocker to move on.

Ok that worked, i didnt know microsoft stores the Bitlocker recovery keys online, i thought for sure i just bricked my windows laptop. Sorry for the panic everyone and thanks for the help.

from lanzaboote.

@RaitoBezarius Can we leave this open so we don't forget to add some warning to the documentation?

from lanzaboote.

@RaitoBezarius Can we leave this open so we don't forget to add some warning to the documentation?

Yes of course!

from lanzaboote.