Prep a Virtual Machine for testing VMware Workspace ONE UEM

   January 27, 2021  Leave a Comment on Prep a Virtual Machine for testing VMware Workspace ONE UEM  Posted in Workspace ONE 0 Likes 9762 Views

Last Updated 8/22/2022 to correct macOS Section

At least once a week someone asks me why their Windows 10/11 virtual machine doesn’t work properly with VMware Workspace ONE UEM. Enrollment failures, invalid Serial Numbers, inability to encrypt, lack of a TPM…. it usually all boils down to some not so obvious setting that need to be changed. Follow this guide and your VM will fully support Workspace ONE UEM

Getting Started:

If you have never done this before, scroll down to the header below named “I’ve never done this before” for a step-by-step list of instructions.

For Windows VM’s you will need an .ISO of Windows 10/11 Professional. Why Professional Edition? Microsoft requires all OEM’s the ship a PC with either Home or Pro edition. If you are testing Workspace ONE UEM Drop Ship Provisioning you should always start with Pro edition. You can always upgrade to Enterprise via UEM device profile.

If you plan to test OS Updates, make sure you download an OS version earlier than the latest version from Microsoft so that your VM has something to update to. At the time of this writing I would recommend starting on Windows 10, version 21H1 (updated October 2021), a build stable enough to not run into any major bugs but also one old enough that there are plenty of updates to apply if you plan to test OS Feature updates.

A Note about Windows Product Key Activation: A common problem we run into with MDM is that people forget to Activate the Windows 10/11 OS. While VMware Horizon virtual desktops work fine (for POC) without a valid and activated OS license key, many MDM commands do not. You will need to license and activate Windows for MDM to properly function. To do so use a working KMS server, Retail keys, or MAK keys.

The Short Version of what to edit:

Special Note for Fusion for macOS users: Prior to VMware Fusion 12 editing the VMX file could be done with VMware Fusion running. As of VMware Fusion 12.x (and above) the app must be closed prior to adjusting the VMX file.

After creating the Windows 10/11 VM, BEFORE powering on the VM for the first time, edit the .VMX file and add the following lines:

  1. Shorten the Serial Number:
    While not technically required to enroll into MDM, it’s a good idea to make this change as it makes troubleshooting easier and helps keep the UEM Console clean.

    SMBIOS.useShortSerialNumber = “TRUE”
    SMBIOS.use12CharSerialNumber = “TRUE”


  2. This step is optional. BitLocker support for multiple hard drives requires the drives to be fixed. To achieve this add the following to the .VMX file

    AHCI.PORT.HOTPLUG.ENABLED = “FALSE”
    DEVICES.HOTPLUG = “False”

  3. Make sure your VM has the following configuration:
    1. Adjust the VM’s available RAM to a minimum of 4096MB to ensure Windows PE loads properly
    2. For Windows 11 this next step is a requirement. For Windows 10 you could skip it, but I don’t recommend it.
      1. Add a virtual TPM to the VM by first choosing to encrypt the VM, setting a password, then choosing Add Hardware and selecting the TPM from the list.
  4. Testing Microsoft AutoPilot? Complete the following:
    1. After the OS has finished the install and the computer reboots into OOBE for the first time you need to enter Windows 10 Audit Mode. On a macOS host machine, press Ctrl-Shift-Fn-F3. For Windows host machines Shift-F3 will get you there. If done properly, the computer will reboot and you will see the computer login as admin
    2. Install VMTools using the Complete Option. DO NOT allow VMTools reboot the computer
    3. Adjust the Windows 10 Timezone and the Time
    4. With Microsoft retiring the Business Store portal, it’s best to register the device hardware hash directly with the Microsoft AutoPilot registration service by completing the following.
      1. Open Powershell and run:
        1. Set-ExecutionPolicy Unrestricted
        2. Install-Script Get-WindowsAutoPilotInfo -Force
        3. Get-WindowsAutoPilotInfo.ps1 -online
        4. Once you have copied the ID, run Sysprep with the Cleanup Action set to “Enter System Out-of-Box Experience (OOBE) and change the Shutdown Options box to “Shutdown,” then select OK
        5. When the VM powers off, take a Snapshot

That’s it for Windows 10/11. Remember if you need more step-by-step scroll down for full details.

For macOS VM’s keep reading:

What about macOS VM’s?

Legally speaking Apple allows the use of macOS VM’s only on Apple hardware (aka you can’t run macOS Vm’s on your Dell laptop). Since your host machine is expected to be an Apple hardware device, you’ll be using VMware Fusion for this process. Note that creating and running macOS VM’s on Apple Silicon is an entirely different ballgame and not something supported with the process below. The process below works for Intel based Apple hardware.

Note about VMware Fusion: Prior to VMware Fusion 12 editing the VMX file could be done with VMware Fusion running. As of VMware Fusion 12.x and above the VMware Fusion app must be closed prior to adjusting the VMX file.

  1. Adjust the serial number of the VM.

    Workspace ONE UEM needs serial numbers to be alphanumeric characters only. This is the new default for VMware Fusion 11.1.0 and higher though it’s a good idea to confirm if you already have the set in the VMX. 
smbios.restrictSerialCharset = "TRUE"

The next config will depend on if you need the VM to support Apple Business Manager (ABM), formerly Apple Device Enrollment Program (DEP):

2. I do not need to test device enrollment through Apple Business Manager:

In this case, add the following entries to the VMX file which are used to set a valid serial number, a valid hardware model Identifier, and adjust the board-id using the following as a sample: 

hw.model.reflectHost = “FALSE"
hw.model = “MacBookPro15,2"
serialNumber.reflectHost = “FALSE"
serialNumber = “Replace me with the serial number from your host machine, incrementing the last digit by 1”
smbios.reflectHost = "FALSE"

By default the VMX file should already include the value: 

board-id.reflectHost = "TRUE" 

Change this value to "FALSE" if you plan on the VM being a different hardware type than your host machine. 

You are done making edits. Save the .VMX boot your macOS and choose About this Mac and confirm that you have a valid model number and serial number listed. If they display correctly (compared with your host device) you are good to go. If there are spaces, weird characters or blank results re-check your work and try again.

2a. I need to test device enrollment through Apple Business Manager: :

In this case the host macOS machine must already be registered with ABM. First launch Terminal and run the following 3 terminal scripts to gather the data from a physical MAC is that DEP enabled:

The Hardware Model:

ioreg -l | awk '/product-name/ { split($0, line, "\""); printf("%s\n", line[4]); }'

The Serial Number:

ioreg -l | awk '/IOPlatformSerialNumber/ { split($0, line, "\""); printf("%s\n",line[4]); }'

The Board-ID:

ioreg -lp IOService | awk '/board-id/ { split($0, line, "\""); printf("%s\n", line[4]);}'

Then adjust the .VMX file as follows:

Change 
board-id.reflectHost = "FALSE”

Add 
serialNumber.reflectHost = "FALSE” 
hw.model.reflectHost = "FALSE” 
hw.model = "Hardware Model from Script above”
serialNumber = "Serial Number from Script above” 
board-id = "Board-ID from Script above”  
smbios.reflectHost = "FALSE"

How do I know this worked?

To confirm the configuration, boot the macOS VM then choose the Apple Logo > About this Mac. If this page shows a serial number and a hardware model you passed. If not, try step 2 or 2a again.

MDM enrollment will fail if the macOS doesn’t see a valid serial number and hardware model.

I’ve never done this before. Give me the Step-By-Step for Windows 10/11 VMs:

This step-by-step guide is written for VMware Fusion version 12.X running on macOS Big Sur 11.1 (Intel CPU) and is written to build a Windows 10 VM. The configurations described below are supported for VMware Workstation for Windows and for VM’s running on VMware vSphere but the exact steps will vary slightly. Adjust the names of the ISO to match what you downloaded from Microsoft.

  1. Open VMware Fusion on your Mac
  2. Click the Plus mark to “Add a New VM”
  3. On the “Select the installation method” drag and drop the en_windows_10_business_editions_version_20h2_updated_nov_2020_x64_dvd_e5d7759b.iso then click Continue
  4. Uncheck “Use Easy Install” then click Continue
  5. Choose Firmware Type: Choose UEFI then click Continue
  6. On the “Finish” page, if you click “Finish” the VM will auto launch and will break a number of things that must be changed BEFORE first launch so don’t do that. Instead click on “Customize Settings” 
  7. At the prompt to “Save As” – change the file name to something meaningful to you, I tend to use something like “AutoPilot_20H2,” and if necessary, change the file path, then click Save which will now launch the Settings Pane for the VMs.
  8. Now that we have stopped the VM from starting, close both the Settings Pane and the newly created VM window so that you are back to the Virtual Machine Library Folder. Next we are going to shorten the Serial Number for the VM. 
    1. From the Virtual Machines List, select the VM you just created right-click on it and choose “Show in Finder”
    2. From Finder, right-click on the name.vmwarevm file and choose 
      “Show Package Contents”
    3. Find the .VMX file in the list and using a text editor, open the .VMX file for editing
    4. Add the following two lines at the end of the VMX file:
      SMBIOS.useShortSerialNumber = “TRUE”
      SMBIOS.use12CharSerialNumber=”TRUE”hci.port.hotplug.enabled = “FALSE”
      devices.hotPlug = “FALSE”
    1. Save the file and close it. 
  9. Back in the Fusion Virtual Machine Library, right-click on the new VM and choose Settings. Click on “Encryption and Restrictions” and Enable Encryption

Pick a password, it’s a lab so “111111” works well, then click “Remember Password” then click OK. 

  1. Click OK on the “Encryption Added” screen
  2. Click Show All to go back to the Core: Settings menu
  3. Click Add Device
  4. Choose “Trusted Platform Module”
  5. Click Add
  6. Click Show All
  7. This step is optional but if your physical machine can handle the settings change the following: Processor & Memory: 2 Core and 4096 MB for Memory
  8. Under Display settings: Make sure “Use full resolution for Retina display” is NOT checked. 
  9. Under Network Adapter, change the Network Adapter to use Bridged Networking with AutoDetect and at the bottom of this page under “Advanced options” make sure a MAC address is populated. If it is not, choose the Generate Button to do so. Click Show All from the top when finished. 
  10. Now click the Red Circle on the top left of the Core Settings page to close this dialog
  11. The VM is now configured
  12. Before you power on the VM a few points about what is about to happen. When you click the big white Play Button to Power On the VM, Fusion will tell the VM to attempt to boot from the ISO. What you are looking for is a single line of white text that reads 

“Press Any Key to Boot from the CD”

On a VM, on a modern computer, this is almost instantaneous so you must be ready to hit a key almost as soon as you power on the VM. However, when you power on the VM, VMWare Fusion changes the focus of the mouse and keyboard from the existing VM to the host machine. If you were to press any key when this happens, the key press would happen on the MacOS not inside your Windows 10 VM and the VM will not boot from the ISO because it did not respond to your button press. To avoid this pesky feature of Fusion, hover your mouse over the Play button, click Play, then immediately single click the Window again to make sure the focus of your mouse remains with the VM. You might have to click a couple of times with your mouse. While you are clicking away, have your finger on your keyboard ready to press a button the moment you see the “Press Any key to Boot from the CD”

  1. If everything worked in the previous step you should now be looking at a purple background and the Windows Setup screen
  2. If you are in the USA, keep the default language, time, and keyboard inputs to the default and click Next
  3. Click Install Now then you should see “Setup is Starting”
  4. The next screen that appears is “Select the operating system you want to install” 

Be careful and DO NOT select “Windows 10 Enterprise N”

I will point out that technically every version listed here will function for Autopilot but for most demo use cases Windows 10 Pro is the Best Practice. Use Workspace ONE UEM to upgrade Pro to Enterprise.

Pick “Windows 10 Professional” x64 Architecture and Click Next

  1. Click “I accept the license terms” then Click Next
  2. On the screen “Which type of installation do you want?” 

Choose Custom: Install Windows only (advanced)

  1. Leave the “Where do you want to install Windows?” page alone and click NEXT
  2. At this point Windows Setup begins and you should see “Installing Windows”
  3. Stand up and stretch. You’ve got between 5 minutes and 20 minutes depending on what type of hardware your physical machine is on. Grab a coffee. You’ve earned it by getting this far. 
  4. Windows will reboot several times eventually prompting you to join a Wireless Network.

There will not be a prompt if you are using a wired network or you are on a VM and your host is already internet connected. 

  1. If your device is ETHERNET Connected, Windows will skip a prompt for Region, if not, at the “Let’s start with Region. Is this right?” Choose the correct region and select Yes
  2. Next Windows asks: Is this the right keyboard layout? Choose Yes
  3. Next Windows asks: Want to add a second keyboard layout? Choose Skip
  4. Wait for the screen “Now we have some important setup to do” and a few seconds later the screen “Sign in with Microsoft” appears. 
  5. Congratulations! The Windows 10 VM is now configured