A company has started planning for migration to Windows 11. An administrator is looking over the requirements for boot and security settings at the VM level to prepare to build new base images. Which option can the administrator exclude from the requirements list for running Windows 11 VMs on AHV?

To install and run Windows 11 on a Nutanix AHV VM, several prerequisites must be met at the VM configuration level. These include enabling UEFI firmware, Secure Boot, and attaching a virtual Trusted Platform Module (vTPM). These are mandatory requirements enforced by the Windows 11 installer. Credential Guard, while a powerful security feature that leverages virtualization-based security (VBS) and is supported on AHV, is not a mandatory prerequisite for installing or running the Windows 11 operating system. It is an optional feature that can be enabled within the OS after installation.

A. vTPM: Windows 11 requires a TPM 2.0 device for security features and installation. AHV provides this through a configurable vTPM, making it a mandatory requirement.
B. UEFI: Windows 11 requires the VM to be configured with UEFI firmware instead of the legacy BIOS. This is a non-negotiable installation requirement.
D. Secure Boot: This is a security standard required by Windows 11 to ensure the boot process is secure. It must be enabled in the VM's UEFI settings.

1. Nutanix AHV Administration Guide (v. 6.5), "VM Management" > "Creating a VM (AHV)" > "Support for Virtual Trusted Platform Module". The guide explicitly lists UEFI, Secure Boot, and vTPM as requirements for Windows 11 VMs.

2. Microsoft Corporation, "Windows 11 System Requirements". Official Microsoft documentation lists TPM 2.0, UEFI, and Secure Boot capability as minimum system requirements for the OS. Credential Guard is documented as a feature, not an installation prerequisite.