There does not appear to be an option to enable TPM 2.0 preventing the creation of Windows VM's

[b1kjsh]

Overview of the Issue

When creating modern Windows VM's you need to have TPM 2.0 enabled in UTM unfortuantely there is not an option to set that value in the current implementation.

Plugin and Packer version

1.14.0

Simplified Packer Buildfile

source "utm-iso" "windows-server-2025" {
  iso_url      = "/Users/XXXX/Downloads/en-us_windows_11_business_editions_version_24h2_x64_dvd_59a1851e.iso"
  iso_checksum = "D0DCA325314322518AE967D58C3061BCAE57EE9743A8A1CF374AAD8637E5E8AC"
  uefi_boot   = true
  display_hardware_type = "virtio-vga-gl"
  disk_size    = 150
  hard_drive_interface = "ide"
  iso_interface = "ide"

  vm_backend   = "qemu"
  vm_arch = "x86_64"

  cpus         = 2
  memory       = 4096

  winrm_username = "vagrant"
  winrm_password = "vagrant"
  communicator = "winrm"
  shutdown_command = "shutdown /s /t 1"
}

Operating system and Environment details

macOS 15.5
UTM 4.6.5

[b1kjsh]

Well after further thought and research it looks like I need to be skipping the TPM part with a registry edit however I'm having trouble getting VNC to work with this windows vm I'm constantly getting the Internal error trying to connect to SPICE server. when the machine starts and it never connects via vnc. At least with the default config it doesn't seem possible, but it would be great to have an example if anyone has gotten windows vm's working.

==> utm-iso.windows-server-2025: Creating ephemeral key pair for SSH communicator...
==> utm-iso.windows-server-2025: Created ephemeral SSH key pair for communicator
==> utm-iso.windows-server-2025: Creating virtual machine...
==> utm-iso.windows-server-2025: Customizing virtual machine...
==> utm-iso.windows-server-2025: Creating hard drive with size 150 MiB...
==> utm-iso.windows-server-2025: Mounting ISOs...
==> utm-iso.windows-server-2025: Mounting boot ISO...
==> utm-iso.windows-server-2025: Attaching display with hardware type 'qxl-vga'...
==> utm-iso.windows-server-2025: Display with hardware type 'qxl-vga' attached successfully.
==> utm-iso.windows-server-2025: Creating forwarded port mapping for communicator (SSH, WinRM, etc) (host port 4283)
==> utm-iso.windows-server-2025: Looking for available port between 5902 and 5902 on 127.0.0.1
==> utm-iso.windows-server-2025: Adding QEMU additional arguments...
==> utm-iso.windows-server-2025: UTM API Unavailable: Add a display device to the VM for VNC to work
==> utm-iso.windows-server-2025: confirm you have done the necessary steps [Y/n]: y
==> utm-iso.windows-server-2025: Proceeding assuming necessary manual steps are done...
==> utm-iso.windows-server-2025: Starting the virtual machine...
==> utm-iso.windows-server-2025: Waiting 15s for boot...
==> utm-iso.windows-server-2025: Connecting to VM via VNC (127.0.0.1:5902)
==> utm-iso.windows-server-2025: error handshaking with VNC: no suitable auth schemes found. server supported: []byte{0x1}
==> utm-iso.windows-server-2025: Detaching displays...
==> utm-iso.windows-server-2025: Deregistering and deleting VM...
==> utm-iso.windows-server-2025: Deleting output directory...
Build 'utm-iso.windows-server-2025' errored after 47 seconds 554 milliseconds: error handshaking with VNC: no suitable auth schemes found. server supported: []byte{0x1}

Update: it looks like the -vnc argument isn't putting in the correct port when scripted. I still have to update the vnc command to point to a specific port in order to get the vnc connection to work properly.

for example if I use:

vnc_port_min = 5902
vnc_port_max = 5902

I get the following in the vm:

And if I comment out those lines and run it again it will magically use port 80 for vnc which is pretty strange.

[naveenrajm7]

Hi @b1kjsh

Re: option to enable TPM 2.0
Please share corresponding config option in UTM. If this field is exposed in UTM scripting it can be exposed here too.

Re: UTM packer template for windows VM
You can check out utm-box windows packer recipe
https://github.com/naveenrajm7/utm-box/blob/main/os_pkrvars/windows/windows-11-aarch64.pkrvars.hcl
I have used this plugin to build and publish UTM windows vagrant box.
I remember I used windows answers file as cd to achieve autoinstall of windows. (So I didn't use VNC in this case)

Re: VNC port.
In plugin code VNC port is subtracted by 5900 before adding VNC port in qemu. Same was done in other packer plugins which with with VNC

[saily]

Hi, sure disabling the TPM 2.0 check through a registry entry is possible and can be done via autounattend.xml file as well, it might stop working in future versions/updates though.

For some use-cases it might be useful to have more configurable qemu options (see request in #27), similar to qemuargs in the packer-plugin-qemu plugin.