Virtual Machine Secure Boot was first introduced in Windows 2012 R2 and was limited to Windows-based VMs. With the introduction of Windows Server 2016, Microsoft extended support for Secure Boot to a number of Linux operating systems running inside a VM. The following Linux distributions are now enabled for Secure Boot:
Ubuntu 14.04 and later
SUSE Linux Enterprise Server 12 and later
Red Hat Enterprise Linux 7.0 and later
CentOS 7.0 and later
The purpose of Virtual Machine Secure Boot is to ensure that every component that is loaded as part of the boot process is trusted, all the way from firmware through to the boot process of the kernel and the loading of an anti-malware driver, assuming one is available and has been installed. By enforcing that all boot components and trusted boot critical drivers are signed, the VM operating system helps to prevent malware from persisting within the VM itself.