u/DonFazool

I am using the upgrade planner. I selected the option to go to VVF 9 without VCF management services. We have AVI and Live Recovery as add-on products.

The planner is telling me to upgrade AVI (it’s at the latest build 32.2), but it’s also asking me to deploy a license hub as part of the AVI upgrade.

I don’t currently have a license hub for AVI, I just put the license key in the controller licensing section.

So I’m confused, why do I need this license hub for AVI when it’s already licensed and working properly?

I understand I need to deploy ops to get the licenses pushed down for vCenter and ESX now.

Can anyone from Broadcom provide clarity?

https://vmware.github.io/vcf-upgrade-planner/vSphere%20and%20VCF%20Operations%20to%20VVF%209.1%20(without%20VCF%20Management%20Services).html

Generally curious what others are doing.

I used to download the patch ISO and do the updates over SSH (had more than enough issues with the VAMI over the years that I stopped using it)

Since Reduced Downtime Update has been available in 8.0.3, I have been using that since it came out. I really like this method, its like getting a clean vCenter every update. It's been super solid and never once given me any headaches.

Hi everyone

Great sub ! I’ve learned a lot just reading these posts over the last few days. I’ll be at a work conference the first week of Sept, staying at the Venetian.

I booked an extra day to stay in Vegas and am now wondering what to do. I’m all alone, I don’t gamble at all. I’ll already have been there 4 days for the conference and have a feeling I’ll already be done with the strip.

Is the Hoover Dam something worth doing on my last day? Anything else intersting for a solo? Is it generally safe for me to be out alone if I go to Freemont one evening?

Thank you all. Looking forward to checking things out. It’s my first time. Pretty easy going. I love just walking around and checking things out, although I’m a bit terrified of the heat.

Would it even be feasible to walk to Bellagio to see the fountain?

Why on earth would the sales guy and sales engineer (who reached out to me) asking if I wanted to see what's new in 9.1 ask me for a RVTools dump prior to the call?

That tool enumerates your entire stack, down to names of VMs, networks, storage.

Any thoughts on why they would even ask for this?

Thank you to everyone who recommended the Hindu Glue. It wasn’t my default terp profile but I really enjoyed it a lot !

My shop has both Goofies and Purple Zombie

Is there one you prefer over the other (I’ll likely try them all eventually). Just curious what the community consensus is.

Broadcom has released a fix for numerous CVE's affecting multiple versions of AVI.

I happen to run 31.2.2 . I patched it to Patch 03 and half my virtual services say they can't contact the pools anymore. Had no problems for the past year . ZERO.

Here we go again. At least the tickets go to Global Support and the quality of service is half decent.

Please stop using us as beta testers and update your damn documentation properly.

/endrant

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926

Hello everyone,

We use Secure Connect with our SRX1500. We have a number of Mac users (myself included) who are seeing warnings that the current Secure Connect will cease to function in upcoming Mac OS update (Which I believe is next year).

The app is currently complied only for Intel binaries. We are running the latest build from Jan 2025.

Curious if anyone has knowledge if they will release a proper Apple Silicon build ?

I hurt my wrist and cannot use the hand held snips to trim my hedge. It’s about 20 feet long, 2 feet wide and about 3-4 feet tall. It needs a good trim. If you have a hedge trimmer (or I can provide a hand trimmer), I can pay cash.

I see lots of folks looking for some work. It’s probably a 2-3 hour job at best. I can help with the cleanup.

Let me know if you’re interested and we can work out the details. I’m in the west end near the Costco on Merivale Rd.

I got in the car this morning and none of the front USB ports were connecting to my phone. I tried 3 cables , shut the car off and back on - nothing worked.

In desperation I pressed and held the power button on the display for about 20 second until it went black and the R logo reappeared. As soon as I did this, both USB ports started working. They seem to be powered from the screen.

Hopefully this helps someone else

I find my phone gets incredibly hot when I am using the usb-c to lightning cable in the front ports next to the wireless charger. Is anyone else experiencing this?

Even a short 5 min drive makes the phone really warm. That’s not good for battery life.

https://event.vmware.com/flow/vmware/explore2026lv/content/page/catalog?utm_campaign=MCO_FY26_GEN_VMware-Explore-26-LV-Content-Catalog-Live_MKT_CM_6037&utm_content=MCO_FY26_GEN_VMware-Explore-26-LV_6037_Content-Catalog-Live_MKT_PROMO_EM_11496&utm_medium=email&utm_source=eloqua&tab.sessioncatalogtabs=1747347809815001igUo

I probably shouldn't be shocked here. I feel like I just wasted 5k+ of my companies money registering for this. I knew VCF is the flagship but man I figured you'd at least have ONE session that was geared towards VVF or a lower tier offering. Nothing.

My shop has the following 14g in stock. I’ve only ever tried Batch 007 and really like it (but I prefer sweeter weed with a good couch lock)

Hindu Glue
Purple Zombie
Goofiez

Thanks for your help

This script has been extremely helpful to us. If your systems are registered with Intune, you can follow this KB and create a report that you can monitor from Intune. It will show you what systems are fully completed, which ones are in progress and which ones have not yet started.

If you see in progress, likely the certs have been applied but the system is waiting for the final reboot and last execution of the scheduled task before giving the completed (event id 1808) status.

The ones that haven't started I just set that initial reg key to 5944 and within a few days (assuming my users actually reboot when prompted) the issues are resolved.

Note : The link to the script in this KB is deprecated (and the KB mentions it). You can pull the updated script off any Windows server in your fleet. We could not find it on a Windows 11 machine.

https://support.microsoft.com/en-au/topic/monitoring-secure-boot-certificate-status-with-microsoft-intune-remediations-6696a27b-fa09-4570-b112-124965adc87f

For those of you who are curious as to what happens...

I just applied vCenter and ESXi 8.0.3j. After rebooting one of my VMs that has secure boot enabled, I noticed the PK certificate was now present but the KEK was still missing

Check if PK is present from PowerShell

$pk = Get-SecureBootUEFI -Name PK

$bytes = $pk.Bytes

$cert = $bytes[44..($bytes.Length-1)]

[IO.File]::WriteAllBytes("PK.der", $cert)

certutil -dump PK.der

Check if KEK certs are present from PowerShell

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).Bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

In order for the process to complete successfully, I still needed to do the following :

You can simply set the reg key to 0x5944 and wait for the necessary task scheduler task to run plus the 2 reboots required, or you can do it all at once if you're bored

Set AvailableUpdates Registry Key

Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot

Look for a value called AvailableUpdates (If not New -> DWORD (32) -> AvailableUpdates)

Set Value : Hex 5944

 

Trigger the Secure Boot Update Task

Run taskschd.msc

Expand Task Scheduler Library -> Microsoft -> Windows -> PI

In the center panel locate Secure-Boot-Update

Right click Secure-Boot-Update -> Run

Wait 30-60 seconds for task to complete

Last run result should update to 0x0 (success)

 

Verify AvailableUpdates After Task Run

Open regedit and check: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\AvailableUpdates

Expected value after the first run task is 0x4100 in hex or 16640 in decimal (This indicates the certificates were applied but boot manager update is pending a reboot)

 

Reboot

 

Trigger the Secure Boot Update Task Again

Task Scheduler Library → Microsoft → Windows → PI

Right-click Secure-Boot-Update → Run

Wait 30–60 seconds

 

Verify AvailableUpdates After Task Run Again

Open regedit and check: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\AvailableUpdates

Expected value after second task run: 0x4000 (16384 decimal) - fully complete.

 

Verify Certificate Update Success

Open regedit and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

 

Check the value of UEFICA2023Status:

 

Updated - complete

InProgress - still running, wait 30 minutes and trigger the task again

NotStarted - registry value may not have been set correctly, revisit Set AvailableUpdates Reg Key

 

Reboot again

Everything showed it was completed but I did not see the Event ID 1808 until another reboot after running the task twice

It seems VMware Live Site Recovery is not in the list anymore on the interoperability matrix. I'm trying to determine if 9.04 is compatible with vCenter 8.0.3j that was just released.

Any chance someone can let the correct team know so we can get this fixed ?

Thanks !

https://interopmatrix.broadcom.com/Upgrade

I have AVI setup and working fine. I created the user VMware recommends following the guide for 31.2.

It seems to be picking random datastores to deploy services engines (which is fine) but it is also selecting local storage (which is not fine at all).

I was doing ESX updates and vLCM could not put a host in maintenance mode. After digging, it was because AVI had deployed a service engine to that node's local storage.

I can't seem to find a way to tell AVI not to do this (you would think it would be smart enough to know not to do this)

Any idea?

Looks like Broadcom updated the KB with a lot more info. Automated fixes are coming to 8.0.3

https://knowledge.broadcom.com/external/article/423893

VMware's Responsibility:

VMware is taking the lead on ensuring the presence of the Windows OEM Devices PK certificate in the virtual firmware to facilitate KEK update. Our goal is to minimize operational overhead through automated delivery mechanisms for VMs running on major ESX versions currently under General Support.

• For newly created VMs: The Windows OEM Devices PK certificate is initialized automatically on ESX 9.x hosts. For ESX 8.x hosts, this will be initialized automatically after a planned vSphere 8.0 U3 patch is applied. (Note: This KB will be updated once that patch is available). The Microsoft 2023 KEK and DB certificates are initialized automatically on ESX 8.2 or newer hosts. (See the table above for more details).
• For existing VMs: VMware is delivering a comprehensive solution to add the Windows OEM Devices PK certificate into the vUEFI if it is detected as missing from VMs running on ESX 8.x and 9.x hosts (starting from planned future patches). While this solution utilizes automated delivery mechanisms to minimize overhead, it will still require customer actions. (Note: This KB will be updated once the patches are available.)

Customer's Responsibility:

• For PK updates:  Customers should execute PK update based on VMware guidance.
• For KEK and DB updates: Customers should follow their respective OS vendor's guidance to update them natively from within the guest OS.
  • Important Risk Note: VMware's KEK/DB update methods (via the vUEFI interface or VMX configuration) can serve as a fallback. However, updating these from outside the guest OS carries the risk of breaking applications (such as triggering BitLocker recovery) for vTPM-enabled VMs, as it alters Secure Boot variables and vTPM measurements without the OS's awareness.