It is possible to run qemu VMs that emulate EFI and secureboot well enough
for Windows to boot.
This is still true, technically. Windows will boot. But it will not update
reliably anymore. Microsoft broke it, ostensibly for "security reasons".
Microsoft released a Windows update that will not install on qemu EFI VMs:
https://www.bleepingcomputer.com/news/security/windows-kb5012170-secure-b...
dbx-update-may-fail-with-0x800f0922-error/
I was scratching my head, trying to figure out why this update won't
install. A search on the cryptic error code brought up some random crap that
wasted a ton of my time, doing things like resizing my system partition,
almost bricking my VM (typical MS-Windows noise). Only after I got the
bright idea of searching for both the error code and the update code itself
did I find this article, and digging further found this:
https://github.com/tianocore/edk2/discussions/3221
There's still a lot of things I don't understand. What is being blacklisted,
exactly, here. The OVMF RPM – to the best of my understanding – is
emulated hardware. How does running some PowerShell voodoo end up updating
(emulated) hardware? And if it's not a magical hardware update, yammers
about an update to the bootloader on the EFI system partition. Except that
(at least in my case), the bootloader should be Microsoft's own bootloader,
since I used Micorosoft's own tools to convert my BIOS Windows VM to an EFI
one (mbr2gpt, that's how I was able to get a working EFI Windows VM).
But the bottom line: this is now broken. Just an FYI…