Use this FAQ when a guarded material cannot be deployed, a bunch cannot attest, a shielded digital machine (VM) cannot be provisioned or began, or an operation equivalent to migration, servicing, or restoration fails. It accompanies the Microsoft Study module: https://be taught.microsoft.com/en-us/coaching/modules/guarded-fabric-shielded-virtual-machines/
Warning
Do not use TPM clearing, an unrelated new or native KP, disabled Safe Boot or CI, a weaker attestation mode, certificate-validation bypasses, or copied proprietor personal keys as generic troubleshooting fixes. Do not delete protected VM state or checkpoint information to make an error disappear. These actions can weaken the belief boundary or completely take away entry to encrypted knowledge.
Resolve platform failures earlier than investigating HGS coverage. A function title showing in a script would not set up that the goal system helps it.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
HostGuardian is not obtainable or the host cannot change into guarded. |
The Hyper-V host runs an unsuitable Home windows Server version or launch. | Use a supported Datacenter version for guarded Hyper-V hosts. Do not confuse this requirement with HGS servers, whose position is obtainable in Normal and Datacenter. Test the Home windows Server 2025 version stock. |
| The HGS position is put in on a Hyper-V host, however attestation assist is lacking. | HostGuardianServiceRole was confused with the host-side HostGuardian function. |
Set up the proper host options on the guarded host and deploy HGS on its individually administered servers. Putting in the HGS position would not enroll the native Hyper-V host or defend its VMs. |
| A required cmdlet, module, or wizard is lacking. | Lacking RSAT/provisioning instruments, incorrect machine or PowerShell surroundings, unsupported parameter, or incomplete function set up. | Test Get-WindowsFeature, Get-Command, module supply/model, and put in assistance on the machine that performs that stage. Set up the documented instruments there. Do not transfer proprietor secrets and techniques to a bunch simply because the host has extra instruments. |
| A graphical shielding-data or template wizard will not run on Server Core. | The workflow assumes a neighborhood Desktop Expertise interface. | Use the supported PowerShell workflow or a trusted Desktop Expertise administration system with the required instruments. Server Core assist for HGS and Hyper-V would not suggest each graphical preparation software is obtainable domestically. |
| Options or safety settings are configured, however do not take impact. | A required restart hasn’t occurred, Group Coverage hasn’t utilized, or a coverage is configured however not operating. | Full the permitted upkeep restart and test efficient coverage and operating safety providers. Distinguish Win32_DeviceGuard configured values from operating values. Drain workloads first the place mandatory. |
| TPM-trusted stipulations or virtualization startup fail. | Lacking/disabled TPM 2.0, SLAT, IOMMU, {hardware} virtualization, UEFI boot, or Safe Boot; incompatible firmware or drivers. | Confirm precise firmware settings and supported {hardware}, not solely specs. TPM mode requires UEFI 2.3.1 or later and the related protections to operate. Exchange unsuitable {hardware} or use a individually permitted structure; do not silently decrease assurance. |
| Enabling Host Guardian assist or HVCI causes a cease error or machine failure. | A driver or machine is incompatible with virtualization-based code integrity. | Preserve the host out of placement, protect the crash proof securely, and use the supported rollback or restoration path. Acquire suitable OEM firmware/drivers and take a look at the safety configuration earlier than returning the host to service. |
| A copied instance fails with a selected visitor, machine, nested-virtualization, or administration mixture. | Help was inferred from unusual Hyper-V assist or an older instance. | Confirm the precise construct, visitor OS, safety coverage, machine function, and operation. Use an explicitly supported mixture. A profitable unshielded-VM take a look at is not assist proof for the shielded equal. |
References
The HGS cluster provides attestation and key safety. It’s separate from the Hyper-V cluster that gives workload availability.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| The position installs, however no working HGS forest or service exists. | Function set up was mistaken for forest creation and HGS initialization. | Full the documented Set up-HgsServer and Initialize-HgsServer levels, with the proper identification, certificates, and restart boundaries. Examine Get-HgsServer; a profitable position set up alone is not completion. |
| New-forest setup or domain-controller promotion fails. | Incorrect beginning area membership, DNS/community configuration, permissions, title conflicts, or an incomplete earlier try. | Overview deployment and AD DS occasions, right the precise prerequisite, and observe the supported set up/restoration path. Do not experiment by deleting AD or cluster objects. Protect DSRM restoration credentials individually. |
| HGS cannot be deployed appropriately in an current forest. | Tried deployment in a baby area, insufficient privileges, or unsuitable bastion-forest design. | Deploy within the current forest’s root area utilizing the documented stipulations. If the forest is not an remoted, extremely privileged safety boundary, redesign slightly than accepting fabric-administrator management over HGS. |
| A further HGS node will not be part of or initialize. | The brand new node cannot resolve the present forest, credentials cannot be part of/put it up for sale, a reboot is excellent, or the existing-node deal with is incorrect. | Restore area connectivity and approved enrollment, then initialize towards a reachable current HGS node. Confirm area, cluster, and HGS membership slightly than assuming one implies the others. |
| HGS fails after dropping a node or throughout upkeep. | Inadequate wholesome nodes, quorum or cluster-network failure, inadequate remaining capability, or a shared failure area. | Restore cluster communications and wholesome capability utilizing the permitted cluster restoration plan. Service one node at a time. Do not drive quorum or take away cluster state and not using a restoration choice and proof. |
| Requests intermittently fail by way of a healthy-looking service title. | One HGS node has stale coverage, damaged TLS, unusable keys, a failed utility pool, or an HSM entry downside. | Correlate failures with the responding node. Train attestation and key launch on each node whereas preserving service-name validation. Restore or safely take away the failing node from service; one profitable clustered request is not ample. |
| The KPS utility pool cannot use its service identification. | HGS node pc accounts cannot retrieve the gMSA password, AD replication is unhealthy, or service identification configuration modified. | Restore the precise gMSA retrieval permissions and AD/service configuration. Individually test private-key permissions. Do not exchange the gMSA with a broad administrator account. |
| KPS returns HTTP 500 with a required-privilege or security-audit-source error. | The HGS gMSA lacks Generate safety audits (SeAuditPrivilege), typically after security-policy hardening. |
Restore the documented person proper by way of the controlling coverage on each HGS node. Protect required default principals in addition to the gMSA: assigning this proper replaces, slightly than appends to, the present checklist. |
| A JEA reviewer cannot join or cannot run a requested command. | Incorrect microsoft.home windows.hgs endpoint, incorrect position membership, WinRM authentication/listener failure, or a command outdoors the delegated position. |
Restore the endpoint and authenticated remoting path. Use reviewer entry for inspection and the approved HGS administrator position for adjustments. A reviewer being unable to edit coverage is anticipated, not grounds for granting Area Admins. |
| The complete material cannot begin after an influence or web site outage. | Virtualized HGS, DNS, identification, or backup-access providers rely upon shielded VMs that want the unavailable HGS. | Restore an independently bootable restoration path. Place important restoration providers and credentials outdoors that round dependency. A manufacturing structure should have the ability to begin its safety dependencies earlier than protected workloads. |
| HGS turns into gradual or instances out throughout a restart wave. | Simultaneous attestation/key-release demand, HSM latency, useful resource exhaustion, or an excessive amount of capability eliminated for upkeep. | Measure the constrained useful resource, restore capability, and stagger begins or upkeep. Validate latency and key entry underneath consultant load. Longer timeouts alone do not restore unavailable keys or failed attestation. |
References
Test transport and repair identification earlier than altering host belief. The host’s Attestation and KeyProtection URLs and the proprietor’s metadata URL serve totally different operations.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| The HGS service title would not resolve or resolves to the incorrect nodes. | Lacking/stale DNS data, incorrect conditional forwarders, incorrect DNS suffix, or use of a node title as a substitute of the distributed service title. | Right authoritative data and forwarding, then confirm decision from every affected host and owner-management system. Do not use an IP-address URL to bypass a TLS-name failure. |
| TCP 443 or required deployment/area visitors is blocked. | Routing, firewall, VLAN, community ACL, or segmentation adjustments. | Restore solely the required documented flows for HGS, AD DS, cluster operation, and administration. Opening HTTPS alone would not fulfill forest creation, replication, gMSA, or cluster dependencies. |
| TCP succeeds however HTTPS authentication fails. | Expired/not-yet-valid TLS certificates, service-name/SAN mismatch, incorrect binding, lacking personal key, or an untrusted chain. | Right the endpoint certificates and binding on the affected nodes, validate time, and distribute the verified public belief chain to shoppers. Retain title and chain validation. TLS identification is separate from HGS guardian authorization. |
| TLS works on one pc however not one other. | CA belief was deployed solely within the HGS forest, an intermediate was put within the root retailer, or shopper coverage hasn’t utilized. | Set up verified roots and intermediates of their right native pc shops utilizing the suitable area or proprietor coverage. HGS-forest Group Coverage would not configure hosts in one other forest or impartial proprietor methods. |
| Chain validation is gradual or fails regardless of the basis being put in. | Required intermediate discovery, CRL, or AIA endpoints are unavailable; certificates dates or belief coverage are incorrect. | Restore the related PKI publication and community paths and examine chain-validation errors. Do not globally disable revocation checks. HGS service-key revocation semantics aren’t a motive to disregard TLS belief failures. |
| A service URL returns an surprising web page, 404, or the incorrect service. | Incorrect protocol/path, incorrect HGS occasion, or proxy/routing configuration. | Evaluate shopper settings with the supposed Get-HgsServer output and use the proper /Attestation and /KeyProtection paths. Verify the supposed group and guardian keys earlier than accepting metadata. |
| Requests fail solely by way of an inspection, load-balancing, or WAN path. | The middleman adjustments protected visitors, routes to unhealthy nodes, or introduces an unsupported TLS/proxy configuration. | Evaluate with an permitted direct service path, protect errors, and proper the middleman design. VMM particularly paperwork provisioning failures when packets are modified in transit. Do not weaken message validation to accommodate rewriting. |
| HGS breaks after HTTPS hardening. | The required HTTP IIS binding was eliminated, or TLS settings grew to become incompatible with the shopper stack. | Restore the supported HGS binding configuration; retain HTTP binding as documented whereas utilizing permitted community controls for entry restrictions. Examine protocol compatibility individually. Do not re-enable out of date TLS variations because the default repair. |
| Well being certificates seem expired or not but legitimate; Kerberos additionally fails. | Time drift amongst hosts, HGS nodes, area controllers, or the administration system. | Restore trusted time synchronization first. If HGS’s internally managed attestation signer stays invalid, observe its documented renewal-task process. That certificates is not the administrator-provided KPS signing certificates. |
| Hosts contact an outdated service or lose fallback after a configuration edit. | Stale endpoints or a Set-HgsClientConfiguration name omitted the fallback parameters. |
Examine all 4 endpoint values and restore the permitted major/fallback pairs. Omitting fallback parameters clears that configuration. Recheck each providers’ insurance policies and keys; URL configuration would not synchronize them. |
References
Determine the certificates’s function earlier than repairing it: HGS signing, HGS encryption, HTTPS, host-key identification, proprietor identification, template signing, and visitor endpoint identification aren’t interchangeable.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| A standalone CA request stays pending or no certificates file is returned. | Administrative approval is required; submission was mistaken for issuance. | Report the request ID, have the CA administrator authenticate and approve the request, and retrieve the issued certificates. Do not repeatedly generate new keys whereas ready for approval. |
| Certificates enrollment fails with a template or CA configuration error. | An enterprise-template process was utilized to a standalone CA, the ComputerNameCAName worth is incorrect, or enrollment entry is unavailable. |
Use the proper CA and enrollment workflow. Standalone CAs do not use certificates templates; put the required properties within the request and have the CA administrator assessment the issued end result. |
| HGS rejects a signing/encryption certificates or crypto operations fail. | Legacy CSP slightly than KSP, unsuitable algorithm/key dimension, lacking usages, or a vendor supplier mismatch. | Acquire the documented HGS certificates profile: KSP, RSA of at the least 2048 bits, required signing/data-encipherment usages and Server Authentication EKU. Confirm the issued certificates slightly than assuming the request was honored. |
| Certificates acceptance succeeds however the personal key’s absent. | Solely a public .cer was imported, acceptance occurred on a distinct pc from the request, or the unique key was misplaced. |
Settle for towards the unique request/key or restore an permitted PFX/provider-backed key. A public certificates cannot recreate its personal key. Reissuing with a distinct key’s a rollover, not restoration of the unique. |
| PFX import or export fails. | Incorrect password, broken file, inaccessible path/retailer, lacking personal key, or deliberately nonexportable/HSM-backed key. | Confirm the supposed artifact and authorization. Use the unique protected PFX/password or the supplier’s supported provisioning and restoration methodology. Do not attempt to make a nonexportable key exportable as an incident shortcut. |
A certificates reveals HasPrivateKey, however HGS cannot use it. |
The gMSA lacks entry, the supplier cannot open the important thing, or the secret’s obtainable solely underneath one other identification. | Confirm precise cryptographic use underneath the HGS service identification and restore the minimal private-key/supplier permissions. Key affiliation, file entry, and profitable service use are separate checks. |
| A brand new HGS node has certificates objects however cannot launch keys. | Thumbprint-referenced personal keys weren’t put in or approved on that node. | Provision the unique private-key entry on each node. PFX-provided HGS keys can replicate; thumbprint references do not replicate their personal keys. Take a look at every node earlier than admitting visitors. |
| HSM-backed operations fail or change into intermittent. | HSM outage, community/session failure, lacking KSP/driver, inaccessible key set, authorization change, or HSM capability exhaustion. | Use the vendor-supported well being and restoration procedures, restore the proper key set, and confirm node and gMSA entry. Do not create unrelated alternative keys or export keys into an unapproved software program retailer. |
| HTTPS fails after including a node or renewing certificates. | TLS certificates/bindings had been assumed to copy with HGS service keys. | Configure the permitted TLS identification and private-key entry on every node. Take a look at service-name and chain validation from hosts. TLS deployment and HGS signing/encryption-key replication are totally different processes. |
| A service or host-key certificates expires, however authorization continues. | Expiry was incorrectly handled as key withdrawal. | This may be anticipated: HGS makes use of its signing/encryption certificates as key containers, and host-key attestation registers the general public key slightly than implementing certificates expiry. Explicitly retire the related service key or host registration. TLS expiry nonetheless impacts transport. |
| Importing guardian metadata fails though the service nonetheless makes use of these keys. | Proprietor-side certificates checks reject an expired or untrusted guardian certificates. | Authenticate the material and keys independently, restore belief or get hold of applicable up to date metadata/certificates by way of an permitted course of. Do not normalize untrusted-root/expiry bypasses. Import-time validation and HGS’s use of registered keys have totally different semantics. |
| Outdated VMs fail after a certificates was renewed with the identical topic. | Renewal generated a brand new key pair; the topic stayed the identical however cryptographic identification modified. | Recuperate the unique uncompromised key if obtainable, or carry out owner-authorized existing-KP updates as a deliberate rollover. Stock retained backups and PDKs earlier than retiring the outdated key. |
References
Examine AttestationStatus, AttestationSubStatus, the service contacted, and the occasion timeline collectively. Do not equate a beforehand profitable end result with a contemporary take a look at of the present configuration.
| Consequence | Interpretation | Decision overview |
|---|---|---|
NotConfigured |
The shopper is not configured for HGS-backed attestation/key safety; it may be in native mode. | Configure the permitted HGS endpoints and retest. Native vTPM operation is not proof of guarded-fabric safety. |
Unknown |
No usable attestation result’s obtainable, generally as a result of attestation hasn’t but been tried. | Test configuration, provoke a contemporary supported shopper take a look at, and accumulate diagnostics. Do not deal with the absence of a rejection as acceptance. |
TransientError |
A networking, service, or different momentary failure prevented completion. | Correlate DNS, TLS, IIS, HGS-node well being, and timing. Retry after the underlying situation is repaired slightly than repeatedly re-enrolling the host. |
Expired |
A beforehand issued well being certificates is now not legitimate. | Test clocks and repair reachability, then get hold of contemporary attestation. Examine renewal failures if the situation recurs. |
UnauthorizedHost |
The introduced identification is not admitted underneath the energetic mode. | Evaluate the precise TPM identification, host public key, or legacy AD group identification with the relevant registration. An AD-group membership restore is related solely to AD-based attestation. |
TpmError |
The host could not full TPM-related attestation work. | Overview TPM, firmware, and measured-boot proof; test TPM readiness and OEM updates. Do not clear or exchange the TPM earlier than assessing protected-state and restoration penalties. |
InsecureHostConfiguration |
A number of enabled host safety necessities aren’t glad. | Comply with the precise substatus and confirm efficient host state. Right unintended drift or approve a justified coverage/proof change; do not disable each failed test. |
Handed however the VM nonetheless fails |
Host admission succeeded; VM guardian authorization, provisioning, visitor encryption, and migration authentication weren’t thereby confirmed. | Transfer to the failing later layer. Examine KPS and the VM’s current KP for key-release errors, or provisioning/visitor/migration proof for later failures. |
References
The next substatuses describe the bodily Hyper-V host, not the visitor vTPM. Verify the precise spelling and coverage conduct on the put in construct.
| Failure mode or substatus | Possible causes | Decision overview |
|---|---|---|
| TPM registration experiences a lacking or untrusted endorsement-key certificates. | Export wasn’t elevated, the OEM did not provision the certificates as anticipated, or HGS lacks the TPM producer’s belief chain. | Export the identifier with applicable privileges, examine lacking certificates with the OEM, and set up verified producer roots/intermediates in TrustedTPM_RootCA and TrustedTPM_IntermediateCA on each HGS node. The HGS TLS CA is not the TPM producer CA. |
| A alternative host or TPM is not acknowledged. | Enrollment describes the outdated bodily TPM, even when the hostname is unchanged. | Confirm the brand new {hardware}’s provenance and safety configuration, enroll its precise identification, and withdraw the retired identification from all relevant HGS providers. Do not reuse one other host’s identifier file. |
SecureBoot |
Safe Boot is not enabled or the required boot belief configuration is not in use. | Allow Safe Boot with the Microsoft Safe Boot template. Examine incompatible or revoked boot elements; do not restore by leaving Safe Boot disabled. |
SecureBootSettings |
Present measurements do not match permitted baselines, together with after firmware, DBX, boot-authority, or debug-setting adjustments. | Clarify the measurement change. Roll again unintended drift or seize and approve a brand new baseline from a verified configuration. Use a baseline applicable to that {hardware}/firmware class. |
VirtualSecureMode |
VBS is not operating, regardless of potential coverage configuration. | Test firmware virtualization, platform protections, efficient coverage, hypervisor startup, driver compatibility, and required restart. Confirm the operating protected surroundings earlier than reattestation. |
HypervisorEnforcedCodeIntegrityPolicy |
Hypervisor-enforced code integrity is not energetic or is not enforced as required. | Right HVCI configuration and incompatible elements, activate the supposed coverage, and confirm runtime state. An audit-only coverage or a registry setting alone would not show enforcement. |
CodeIntegrityPolicy |
The energetic CI coverage is lacking, stale, or not registered with HGS within the anticipated kind. | Evaluate the deployed coverage and registered permitted unsigned binary. Activate the supposed enforced coverage and register its matching measurement by way of change management. See the subsequent part for policy-deployment failures. |
Iommu |
IOMMU/DMA safety is unavailable, disabled, or not required by the host’s VBS configuration. | Allow supported {hardware} and the required VBS DMA safety; exchange unsuitable {hardware} if mandatory. Disabling the HGS requirement adjustments the menace mannequin. |
PagefileEncryption |
Host paging-file encryption is not enabled as required. | Apply the supported encrypted-paging configuration and any required restart, then reattest. This test issues host paging knowledge, not visitor BitLocker volumes. |
FullBoot |
The host resumed from sleep or hibernation slightly than finishing the required full boot. | Prepare a managed full restart with workloads drained. Confirm the restart path as a substitute of repeatedly resuming the host. |
HibernationEnabled |
Host hibernation configuration would not meet admission coverage. | Apply the permitted no-hibernation configuration and restart. Do not loosen up the coverage merely to protect a sleep/resume operational apply. |
DumpsEnabled |
Dumps are enabled whereas coverage requires them disabled. | Disable the disallowed dumps. If operational necessities justify encrypted dumps as a substitute, use an explicitly permitted HGS dump-policy design slightly than an advert hoc exception. |
DumpEncryption |
Dumps are permitted however not encrypted as required. | Disable dumps or configure supported dump encryption in accordance with coverage. Defend diagnostic assortment as potential tenant-sensitive materials. |
DumpEncryptionKey |
The host encrypts dumps with a key that HGS would not acknowledge. | Use an permitted dump-encryption key and register its right hash/coverage with HGS. Protect the impartial private-key restoration authority wanted to learn a certified dump. |
TcgLogVerification |
Measured-boot log retrieval/verification fails due to firmware, TPM, {hardware}, or an outdated PXE community boot program. | Gather TPM/boot proof, assessment boot order, replace permitted firmware and PXE elements, and contain the OEM the place mandatory. Do not register an unverifiable log as an accepted baseline. |
BitLocker |
An enabled HGS host-BitLocker coverage is not glad. | Confirm and restore the required safety of the host OS quantity. This coverage is disabled by default and is impartial of visitor encryption. Do not change it with out the HGS coverage proprietor’s choice. |
| All artifacts appear current, however attestation nonetheless fails or unexpectedly makes use of an older model. | Incompatible identification/baseline/CI artifact variations, a model setting retained throughout improve, or matching legacy artifacts that let fallback. | Stock precise variations and put in command interfaces. Set up a whole permitted version-2 path, then retire unapproved version-1 artifacts. Do not invent a model parameter or downgrade to bypass endorsement validation. |
| Failure follows TPM clearing, safety reset, or alternative though the server nonetheless boots. | TPM-protected or VBS identification materials modified; beforehand sealed state or offline caches aren’t usable. | Recuperate host safety configuration and re-establish on-line attestation/key launch underneath the permitted identification. Use impartial restoration materials for affected encrypted host knowledge. A TPM reset is not a innocent stock operation. |
References
App Management for Enterprise code integrity controls what can run. HGS checks whether or not the host is utilizing an permitted coverage; it would not certify that each allowed program is secure.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| An permitted driver, backup agent, or administration software is blocked. | Lacking permit guidelines, an excessively slender rule, or an replace invalidated a hash rule. | Study CodeIntegrity occasions and confirm the writer/package deal. Replace solely the required permitted guidelines, validate in audit on a reference system, and deploy/register the enforced coverage by way of change management. |
| No audit occasions seem, however enforcement later breaks workloads. | The audit coverage wasn’t energetic, or the take a look at did not train the related workload. | Confirm the coverage is energetic after deployment/restart, then train backup, administration, drivers, servicing, and restoration. An empty log with out consultant exercise is not proof of compatibility. |
| HGS rejects a bunch after a signed CI coverage is registered. | The signed wrapper or a distinct binary was equipped as a substitute of the matching unsigned measured coverage. | Register the proper unsigned kind equivalent to the deployed signed coverage. Do not take away signed-policy safety from the host merely to simplify registration. |
| CI deployment experiences a lacking supplier or policy-format error. | The only-policy replace supplier is not obtainable, or the software, file format, and goal construct do not match. | Confirm the put in supplier/software and supported coverage format. Validate each native enforcement and HGS measurement; assist for CiTool or a number of insurance policies alone would not show {that a} specific HGS mixture works. |
| A coverage file was up to date, however the host nonetheless presents the outdated coverage. | Deployment focused the incorrect location, activation failed, a restart is required, or signed replace guidelines rejected the change. | Examine the energetic coverage and deployment occasions. Use the supported activation/replace process and required restart. Do not repeatedly register totally different HGS artifacts to hide an inactive host coverage. |
| A signed coverage prevents boot or cannot be changed. | Required boot elements had been blocked, the approved replace signer is unavailable, or signed-policy restoration wasn’t ready. | Use the permitted signed-policy restoration/replace course of with retained signing authority and restoration entry. Protect proof and restore a known-good coverage; do not arbitrarily delete EFI or protected coverage information. |
| Attestation passes with an unexpectedly permissive software program configuration. | A broad writer rule, audit coverage, out of date coverage, or different unintended admission artifact stays accepted. | Overview enforcement and coverage scope, take away unapproved artifacts after impression evaluation, and take a look at rejection of a consultant unapproved configuration. A Handed end result can expose a policy-design failure slightly than show robust safety. |
References
Host-key possession, AD group membership, and TPM-backed measured well being are totally different admission mechanisms. HGS has one energetic attestation mode.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| A bunch key was registered, however the host remains to be rejected. | HGS is utilizing one other mode, the shopper presents one other key, or the required model is not energetic. | Evaluate HGS mode/model with the host’s precise public key and registration. Stage a service-wide mode change solely in any case affected shoppers are prepared; registration would not change the mode. |
| Host-key attestation fails after rebuild, rotation, or stock scripting. | The native key was regenerated, misplaced, or changed with out enrolling the brand new identification. | Determine the supposed key and its provenance. Enroll an permitted alternative on each relevant HGS service and withdraw the outdated registration. Do not run key-generation instructions as read-only stock. |
| A customized host-key certificates cannot be used. | Lacking/unusable personal key, incorrect supplier permissions, or an unsuitable certificates profile. | Confirm the documented host-key profile and private-key usability. Customized certificates require the suitable RSA key, Consumer Authentication EKU, and Digital Signature utilization; do not substitute the KPS or TLS certificates blindly. |
| A bunch with unapproved drivers nonetheless passes host-key attestation. | Key possession was mistaken for measured-health validation. | This can be a design limitation, not a driver-detection bug. Use TPM-trusted attestation when measured boot and CI assurance are required. Do not describe a host-key success as proof of a clear software program state. |
| Eradicating one hostname would not reliably deauthorize a bunch, or an expired certificates nonetheless works. | One other registration refers back to the identical key, the secret’s shared/copied, or certificates expiry was mistaken for withdrawal. | Determine and withdraw the precise public-key authorization all over the place. Assess each host holding that non-public key and transfer to distinct protected identities. Validate the put in elimination interface; do not guess a cmdlet or coverage title. |
| Many hosts fail after switching attestation modes. | Required artifacts weren’t staged, mode adjustments have not reached all nodes, or shoppers are incompatible. | Examine mode on every node and the shopper inhabitants. Full the permitted transition or managed rollback, then accumulate contemporary outcomes. Do not delete the outdated enrollment earlier than the permitted alternative path is confirmed. |
| A legacy AD-authorized host is rejected after group or area adjustments. | Incorrect registered group SID, stale computer-account group membership, failed required belief, or DNS/Kerberos/time failure. | Restore the documented AD-based belief and group path, refresh machine membership as required, and retest. Recreating a bunch with the identical title would not protect its SID. This is not a repair for TPM or host-key mode. |
| A workgroup host is rejected solely as a result of it is not within the HGS area, or AD mode is assumed eliminated. | Area necessities or deprecation had been misinterpreted. | TPM and host-key attestation do not require becoming a member of the HGS forest. Diagnose precise admission proof. AD-based attestation is deprecated, not robotically eliminated; preserve solely required legacy use and plan a supported migration. |
References
Examine KPS, the VM’s current KP, and guardian identities. A bunch could also be eligible to run some house owners’ VMs whereas appropriately being denied entry to others.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| One VM fails whereas different shielded VMs begin on the identical host. | Its KP would not authorize the obtainable material keys, an outdated key was retired, or the VM’s protected state is inconsistent. | Protect the present KP and examine its guardian identities with KPS keys and the latest change file. The proprietor authorizes any KP replace; HGS directors restore permitted service-key usability. |
| A VM fails solely at a restoration web site or new vacation spot. | The vacation spot passes attestation however its material guardian is not approved by that VM. | Have the proprietor grant the permitted restoration guardian entry to the present KP, preserving its secret. Configure future PDKs individually. Storage entry and host admission do not authorize the vacation spot. |
| KPS experiences an unwrap/key-protection failure for a lot of VMs. | Incorrect KPS endpoint, unavailable signing/encryption keys, disabled keys, invalid well being proof, or a service/private-key failure. | Correlate KPS and shopper occasions, validate contemporary attestation, and test the whole required key set on each node. Do not weaken attestation or copy proprietor keys to hosts. |
| Updating a PDK or making HGS keys major would not restore an current VM. | These operations do not rewrite the deployed VM’s KP. | Use the owner-authorized grant/revoke workflow on the present KP. Deal with the PDK as a future-provisioning artifact and retain the unique PDK for its restoration position. |
| Proprietor guardian creation or KP adjustments fail with missing-key/entry errors. | Solely public metadata is current, the incorrect certificates retailer or identification is used, or proprietor private-key entry is lacking. | Restore and authorize the matching proprietor keys on the owner-controlled administration system. Validate precise use, not simply HasPrivateKey. Material-administrator membership is not proprietor authority. |
| A KP export cannot be parsed or fails after a file switch. | Binary knowledge was formatted as textual content, truncated, overwritten, or confused with one other VM’s KP. | Retrieve an genuine lossless byte export and protect its VM/model affiliation. Preserve protected originals and authenticated handoffs. Do not reconstruct bytes from a console show. |
| A returned KP is stale or conflicts with the VM’s present state. | The VM began in the course of the change, one other operator modified it, or the incorrect export/return pair was used. | Cease the change and reconcile present state underneath proprietor management. Preserve the VM off for the whole permitted replace and use distinct artifact names. Do not apply a stale end result just because the command accepts bytes. |
| Grant succeeds however required revocation or export fails. | An incomplete workflow left a partial or outdated staged return file. | Deal with the entire change as failed. Do not switch a grant-only end result when revocation was required. Protect the unique and create a brand new totally verified return artifact solely after each required operation succeeds. |
| A VM turns into inaccessible after attaching a brand new or native KP. | The unrelated KP would not protect the key related to current vTPM/protected state, or authorization was weakened. | Cease additional adjustments. Use an permitted matching rollback KP/constant backup or proprietor restoration path. Final-known-good rollback is suitable provided that it would not restore withdrawn belief. A brand new PDK KP is not a restore for an current VM. |
| Guardian names match, however authorization nonetheless fails. | Pleasant names or certificates topics had been mistaken for cryptographic identification; metadata got here from one other material or predates rollover. | Evaluate authenticated signing/encryption key identities and the precise KP content material. Acquire permitted metadata independently of its filename or show title and authorize the supposed keys. |
| Proprietor keys are misplaced whereas some VMs proceed to run. | Present KPS authorization nonetheless works, however proprietor replace/restoration authority is unavailable. | Protect operating availability and remaining restoration choices whereas retrieving impartial owner-key backups. Plan owner-authorized restoration/reprotection if potential. Continued operation is not proof that future KP updates or catastrophe restoration stay potential. |
| A KP change fails whereas studying or writing its staging information. | The listing exists solely on the opposite pc, a file occupies the listing path, permissions are incorrect, an output title is already in use, or one other operator modified the staged artifact. | Put together and limit the host-side and owner-side directories independently. Use unused filenames, protect unique exports, coordinate concurrent entry, and cease on each failed learn/write. Do not overwrite a retained KP or ship an unverified partial file. |
Additionally see the module’s existing-KP change process.
References
The writer prepares and indicators the template; the proprietor decides whether or not to belief it. Signature integrity is not an alternative to approval of the picture’s contents.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
Defend-TemplateDisk rejects the disk or the Home windows template cannot boot appropriately. |
Incorrect VM technology, MBR slightly than GPT, dynamic visitor disk, unsuitable partitions, or incorrect Home windows-volume filesystem. | Put together the supported technology 2 Home windows structure: GPT, a primary visitor disk, right EFI/boot partitions, and an NTFS Home windows quantity. A dynamically increasing VHDX will not be a Home windows dynamic disk. Do not format the EFI system partition as NTFS. |
| Specialization fails throughout each VM from a template. | The supply wasn’t generalized, Home windows updates/setup are incomplete, or a required visitor part is lacking. | Restore and validate the retained servicing supply, full supported generalization, and create a contemporary protected copy. Do not restore the only real signed template in place. |
| Template signing fails. | Lacking or inaccessible writer personal key, incorrect certificates/profile, unsuitable preparation instruments, or an inaccessible disk. | Confirm the writer’s permitted signing identification, key usability, instruments, and disk entry. Preserve writer personal keys within the publisher-controlled preparation surroundings. |
| Template safety is interrupted or runs out of house. | Inadequate storage, file locks, I/O failure, or course of interruption throughout an in-place transformation. | Protect proof and the failed copy, right the dependency, and restart from the known-good unprotected servicing supply. Do not distribute {a partially} reworked disk with an outdated catalog. |
| A protected template fails when booted as an unusual VM. | A secure-provisioning template was used as a standard boot disk. | Use the supported shielded provisioning path. For servicing, return to the unprotected supply. Booting the protected template as an unusual VM is not a supported validation methodology. |
| The PDK and VSC aren’t relevant to one another. | Incorrect template identification, writer, model rule, catalog, or PDK sort. | Evaluate the proprietor’s permitted template identification and actual model semantics. Provide the proper signed artifacts or get hold of approval for a brand new model. Do not broaden acceptance merely to eradicate the mismatch. |
| Applicability passes, however precise provisioning rejects the disk. | The equipped VHDX modified after signing or would not correspond to the catalog. | Quarantine the disk, examine substitution or corruption, and acquire the genuine protected picture. Retest precise disk validation, not simply the PDK/VSC relationship. |
| A signed picture or later accepted model accommodates unapproved software program. | Writer compromise, weak source-image assessment, or overly broad future-version belief. | Include affected deployments, examine the publishing authority, and rebuild from permitted sources. Tighten model/writer approval and rotate affected secrets and techniques. A legitimate signature would not set up that the software program is benign. |
References
Why do shielding-data creation and VM provisioning fail?
Preserve PDK creation, template validation, VM configuration, and visitor specialization separate. A visual VM object or returned helper object is not proof of profitable provisioning.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| PDK creation fails or required guardian/qualifier inputs are lacking. | Lacking proprietor keys/instruments, incorrect guardian choice, malformed enter, inaccessible information, or a new-template/existing-VM parameter-set mismatch. | Use the proper workflow on the trusted proprietor system, validate all inputs, and choose the supposed proprietor, materials, and picture qualifiers. Protect the unique encrypted package deal after creation. |
| Provisioning cannot learn the PDK, VSC, template, or specialization file. | Incorrect path, file permissions, incomplete switch, corrupt artifact, or inaccessible library/share. | Restore authenticated intact artifacts and minimal required learn/write entry for the provisioning identification. Test storage domestically and remotely. Do not grant broad entry to plaintext proprietor information. |
New-ShieldedVM is not discovered or behaves in a different way from the instance. |
Lacking/unapproved GuardedFabricTools model, command shadowing, dependency mismatch, or unsupported target-build conduct. | Confirm command supply and the reviewed package deal model, together with nested modules and put in interfaces. The module’s pinned 1.1.1 instance is not proof of common Home windows Server 2025 compatibility. Do not bypass execution coverage or import an unreviewed alternative. |
| A technology 2 VM exists however is not truly shielded or totally provisioned. | Solely New-VM, vTPM enablement, or state-encryption settings had been utilized; the proprietor’s coverage and initialization had been omitted. |
Use a validated full orchestration that applies the PDK-derived coverage/KP and safe provisioning. Examine ensuing firmware/safety state and provisioning standing. Do not invent a Set-VMSecurity -ShieldingRequested parameter. |
| VM creation or template copy fails earlier than specialization. | Inadequate disk house or reminiscence, invalid path, conflicting VM title, lacking digital change, permissions, or storage failure. | Right the precise capability/configuration subject and reconcile partial artifacts earlier than retrying. The instance CPU/reminiscence values aren’t capability suggestions for each workload. |
| Specialization hangs or Home windows setup experiences an enter error. | Invalid unattend XML, lacking placeholder, invalid product key, unsupported setup setting, or script failure. | Validate the proprietor’s reply file and equipped values towards the goal picture. Reproduce with nonsecret take a look at knowledge in an remoted owner-approved lab. Right the PDK for a managed new try; do not downgrade a manufacturing VM’s coverage for console entry. |
| Laptop naming, networking, or enrollment fails throughout setup. | FSK tokens do not match owner-approved placeholders, deal with/DNS knowledge is incorrect, duplicate names/IPs exist, or domain-join credentials/connectivity fail. | Reconcile actual placeholders and the supposed community/identification providers. Preserve credentials inside owner-controlled encrypted inputs, not fabric-readable specialization values. |
| A visitor setup script or endpoint certificates is not put in. | A file referenced by the reply file wasn’t included within the PDK, the trail is incorrect, or required secret entry is not obtainable. | Have the proprietor right package deal contents, paths, and setup logic. Confirm the ensuing visitor endpoint identification. Do not expose personal certificates to the material to work round packaging errors. |
| A helper returns with out an unambiguous success end result. | An asynchronous job remains to be operating, failed, or wasn’t appropriately tracked. | Examine Get-ShieldedVMProvisioningStatus and its error particulars till the end result is obvious. A lacking job/standing object, operating VM, or object returned by a helper is not a hit criterion. |
| A retry fails as a result of the VM already exists or has partial protected state. | Creation/initialization was rerun blindly towards an interrupted deployment. | Isolate the failed occasion, protect logs and artifacts, and use the workflow’s supported cleanup/retry process underneath change management. Do not overwrite a working VM, its disks, or its KP. |
| Current-VM conversion fails or leaves encryption incomplete. | A brand new-template recipe was reused; technology, disk structure, visitor, helper, or conversion stipulations aren’t glad. | Take a recoverable backup and use a supported conversion path with proprietor approval and downtime. Confirm precise quantity encryption. Including a vTPM alone neither encrypts current disks nor removes outdated plaintext copies. |
| Newly provisioned VMs share credentials or unintended identities. | A reusable PDK/reply file hard-codes per-VM secrets and techniques or names. | Cease additional deployment, restore the owner-controlled identification/credential lifecycle, and rotate affected credentials. Reissue permitted packages. Profitable provisioning can nonetheless signify a critical configuration failure. |
References
As soon as provisioning and key launch succeed, distinguish community entry, visitor authentication, visitor boot, and encryption state. The material operator and the visitor administrator aren’t the identical safety identification.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| The VM runs however RDP, WinRM, or SSH is unreachable. | Incorrect digital change/VLAN, deal with, DNS, route, visitor firewall, disabled listener, or incomplete visitor setup. | Material directors test the exterior path; the proprietor checks visitor providers and firewall/configuration. Restore the supposed administration endpoint with out altering the KP or exposing visitor secrets and techniques. |
| The endpoint responds however authentication fails. | Incorrect, expired, locked, or unauthorized visitor credentials; area/time failure; incompatible authentication configuration. | Restore visitor/area identification underneath proprietor authority and use a supported authentication methodology. Material membership is not a visitor credential bypass. |
| RDP/WinRM certificates or SSH host-key identification would not match expectations. | Incorrect endpoint, stale deployment identification, certificates renewal/configuration failure, or potential interception. | Cease trusting the session till the proprietor verifies the endpoint by way of an impartial channel. Restore the proper identification and belief configuration; do not routinely dismiss warnings or settle for alternative keys blindly. |
| Primary console, debugging, disk inspection, or a security-weakening edit is blocked. | The VM’s shielded coverage deliberately restricts fabric-administrator entry. | Deal with the block as anticipated safety. Use owner-authenticated visitor administration or a documented proprietor restoration path. Do not exchange the coverage with encryption-supported mode as a routine operational repair. |
| Enhanced Session Mode or PowerShell Direct is not obtainable. | Unsupported host/visitor mixture, lacking visitor configuration, proprietor restrictions, or absent visitor credentials. | Test version-specific assist and proprietor coverage. The place supported, these paths nonetheless require visitor authentication; their existence would not grant an administrator a approach round proprietor authorization. |
| Home windows begins solely to a BitLocker restoration immediate. | Visitor boot measurements or vTPM/protected state modified, a restoration situation occurred, or restored state would not match. | Protect the restoration level and use the proprietor’s legitimate OS-volume restoration mechanism. Diagnose visitor adjustments individually from host attestation. Do not reset the vTPM to bypass restoration. |
| A vTPM is enabled, however the OS quantity is not protected. | Provisioning did not full, BitLocker wasn’t enabled, encryption is incomplete, or safety is suspended. | The proprietor inspects quantity standing, encryption proportion, and safety standing contained in the visitor, then repairs the supported encryption configuration and escrow. Host-side safety properties do not show visitor encryption. |
| A knowledge disk is unencrypted or cannot unlock after restart/restore. | OS-volume shielding was assumed to cowl knowledge volumes, or data-volume protectors/normal-unlock dependencies weren’t preserved. | Set up and confirm an owner-controlled encryption, unlock, and restoration coverage for each knowledge quantity. Escrow the matching restoration materials. The OS disk’s shielded restoration key is not a data-disk key. |
| An utility is compromised or visitors is readable regardless of shielding. | Visitor malware, susceptible purposes, stolen proprietor credentials, or unencrypted utility visitors lie outdoors the host-isolation assure. | Apply visitor/utility incident response, patching, authorization, and community encryption. Host attestation would not attest visitor utility conduct, and encrypted migration would not encrypt unusual workload visitors. |
| An encryption-supported or unusual VM would not meet the malicious-admin requirement. | VM coverage was confused with host eligibility, BitLocker, or vTPM enablement. | Reassess the required safety and use an permitted shielding/reprotection workflow the place supported. Confirm current copies and uncovered secrets and techniques. Enrolling a bunch would not improve each VM’s coverage. |
References
Test each unusual Hyper-V dependencies and the vacation spot’s guarded-fabric eligibility. Neither source-host success nor a wholesome HGS cluster proves {that a} specific vacation spot can run the VM.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| The vacation spot rejects a shielded VM. | It fails attestation, cannot attain a certified KPS, lacks the required options, or its guardian is not within the VM’s KP. | Validate the vacation spot independently and restore the precise admission/key-release subject. Do not copy proprietor or HGS personal keys onto vacation spot hosts; generic local-vTPM certificate-copy recommendation is not an HGS restore. |
| Migration breaks after upgrading to Home windows Server 2025. | Credential Guard prevents the CredSSP delegation path beforehand utilized by stay migration. | Configure supported Kerberos constrained delegation or resource-based constrained delegation with the AD administrator. Preserve Credential Guard enabled. Altering VirtualMachineMigrationAuthenticationType alone would not configure AD delegation. |
| Kerberos migration fails with entry/delegation errors. | Lacking/duplicate SPNs, incorrect service/account scope, delegation restrictions, DNS/time issues, or an unsuitable initiating identification. | Right the precise Kerberos and constrained-delegation design for migration and, when wanted, storage providers. Take a look at from the precise initiating identification. Do not allow unconstrained delegation as a generic restore. |
| Migration fails solely from a distant administration session. | The authentication path requires delegation that the distant workflow would not provide. | Evaluate native and distant initiation underneath the permitted design and restore supported delegation. Do not assume host attestation provides credentials for the administration second hop. |
| Migration experiences processor or VM configuration incompatibility. | CPU-feature variations, incompatible firmware/settings, or a VM configuration model newer than the vacation spot helps. | Select a suitable vacation spot or a supported deliberate compatibility setting. Deal with configuration-version upgrades as doubtlessly irreversible for return migration. Do not assume a compatibility change handles each CPU/vendor distinction. |
| Switch stalls, instances out, or stops after beginning. | Migration-network failure, insufficient bandwidth, packet loss, firewall restrictions, overloaded storage, or concurrency/capability limits. | Determine and restore the failing path or useful resource, scale back rivalry, and take a look at at consultant load. Protect state/migration encryption slightly than disabling it for throughput. |
| VM storage is not obtainable on the vacation spot. | Lacking shared-storage/CSV entry, incorrect SMB/storage permissions, absent storage-move parameters, or an unsupported disk/machine association. | Restore supported vacation spot storage entry or use the proper storage-migration workflow. Do not copy an energetic VHDX and deal with it as a constant VM switch. |
| Migration succeeds however the workload loses community entry. | Vacation spot digital switches, VLANs, community mappings, or visitor addressing differ. | Right vacation spot networking and confirm proprietor entry and utility well being. A accomplished compute transfer would not show community continuity. |
| Cluster failover cannot begin the VM though HGS is wholesome. | The VM position is not configured appropriately, no eligible node/capability exists, cluster quorum is misplaced, or shared sources are unavailable. | Restore the workload cluster and placement coverage. Registering a clustered VM position provides availability administration, not shielding. The Hyper-V cluster and HGS cluster want impartial well being checks. |
| Resume/import fails with saved-state incompatibility. | The saved state is incompatible with the vacation spot construct/CPU or the restore set is broken. | Protect a constant backup and assess a supported owner-approved cold-start path. Discarding saved reminiscence can lose unsaved work; do not delete vTPM, KP, protected configuration, or disk-chain information as a generic repair. |
| Reproduction failover or failback fails. | Vacation spot host/key authorization wasn’t maintained, storage/community mapping differs, or a beforehand trusted web site was withdrawn. | Revalidate the chosen duplicate’s KP, vacation spot attestation, keys, present insurance policies, and utility consistency in isolation. Take a look at failback as a separate operation; replication success alone is not proof of recoverability. |
| Drain/migration fails whereas a backup or checkpoint operation is energetic. | A VM is in an incompatible transitional state, a backup lock is held, or checkpoint processing is caught. | Coordinate with the backup product and examine VMMS/cluster/backup occasions. Full or get better the supported operation earlier than retrying. Do not manually delete checkpoint chains or restart shared providers with out assessing different VMs. |
Additionally see the module’s destination-eligibility and protected-state steerage.
References
Safety proof and cryptographic dependencies survive past the change window. Take a look at each the present workload inhabitants and retained restoration factors.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| An permitted firmware, driver, OS, or Safe Boot replace causes rejection. | The supposed change altered measured proof or CI guidelines with out coordinated approval/registration. | Confirm the precise replace, stage matching permitted artifacts, reattest, and begin a protected take a look at workload. Do not authorize unexplained measurements simply because the change window was permitted. |
| Older hosts fail after HGS coverage activation. | New checks had been activated earlier than all hosts equipped the required proof. | Comply with the module’s cumulative-update order: guarded hosts first, then HGS nodes, then any individually required coverage activation. For OS-version upgrades, use the precise compatibility matrix slightly than assuming the identical order. |
| OS-version improve breaks mixed-version operation. | Unsupported host/HGS mixtures, outdated attestation variations, or configuration-version adjustments. | Validate the precise supply, goal, and intermediate mixtures. Stage the supported improve sequence and rollback boundaries. An older Home windows Server improve article is not blanket approval for each later launch mixture. |
| New VMs work after key rollover, however older VMs or backups fail. | Outdated KPs/PDKs authorize retired keys, and primary-key choice did not replace them. | Restore an permitted uncompromised restoration path or have house owners replace current KPs. Stock checkpoints, replicas, backups, and future-provisioning packages earlier than disabling outdated keys. |
| Some requests fail instantly after new keys change into major. | The brand new key’s personal half or permissions weren’t provisioned on each node. | Restore constant key entry on all nodes earlier than finishing the transition. Take a look at precise key launch; public metadata publication alone would not show usable personal keys. |
| An out of date or weaker host configuration nonetheless passes after rollout. | Short-term outdated baselines, CI insurance policies, host registrations, or legacy variations had been by no means retired. | Finish the permitted overlap window, withdraw out of date artifacts with dependency assessment, and take a look at contemporary rejection. Do not hold a everlasting weaker fallback merely to keep away from documenting exceptions. |
| Retirement destroys service availability or restoration functionality. | The final usable HGS key/node, required area service, owner-key copy, or backup dependency was eliminated too early. | Cease retirement, get better permitted materials the place potential, and full dependency-aware decommissioning. Clear-HgsServer and Uninstall-HgsServer have totally different area/cluster penalties and are not common reset instructions. |
References
Belief-policy adjustments have an effect on future authorization selections. They do not erase already launched secrets and techniques, cease each operating workload, or rewrite historic backups.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| A deauthorized host continues operating a shielded VM. | The VM already obtained keys; current well being proof or eligible cached materials might stay related. | Isolate the host and its administration/community entry underneath the incident plan, block placement, protect proof, and get better on clear infrastructure. Confirm future rejection individually from fast containment. |
| A withdrawn host remains to be admitted elsewhere. | Solely major HGS was up to date, one other registration/model stays, or a shared host key remains to be trusted. | Stock each relevant HGS service and precise identification, together with fallback and legacy artifacts. Withdraw the proper identification all over the place and take a look at contemporary attestation. Do not take away a shared baseline to focus on one host. |
| HGS or its signing/encryption keys are compromised. | An attacker can alter admission or use the material’s key-protection authority. | Rebuild from clear administrative authority, assessment coverage, set up clear keys, and have house owners withdraw compromised guardians from current KPs and future PDKs. Do not blindly restore unreviewed HGS state. |
| An proprietor guardian key’s compromised. | The attacker has owner-level authority affecting that possession group. | Assess all dependent workloads and copies. Set up clear proprietor restoration/reprotection authority by way of a validated course of and rotate uncovered visitor secrets and techniques. Rotating solely HGS keys would not restore owner-key compromise. |
| A writer/template-signing key’s compromised. | Malicious photos will be signed as an permitted writer. | Cease new provisioning from the affected belief, protect proof, rebuild permitted photos, and revise owner-approved catalogs/model guidelines and publishing keys. Examine already deployed photos slightly than merely re-signing them. |
| Plaintext reply information, PFX passwords, proprietor keys, or decrypted restoration keys are uncovered. | Insecure staging, shared folders, transcripts, assist bundles, or backup entry. | Limit and protect proof by way of incident response, assess which secrets and techniques had been disclosed, rotate/reprotect as required, and take away unauthorized copies underneath coverage. Deleting one working file would not undo publicity. |
| Rotating keys would not eradicate the publicity. | Plaintext, outdated KPs, outdated keys, credentials, or backups had been already copied. | Assess the complete publicity window and affected copies. Reprotect knowledge and rotate visitor/utility secrets and techniques the place required. Wrapping-key rotation is not retroactive erasure. |
| Shielding would not forestall deletion, outage, or hostile administration of the entire design. | Material directors retain availability management, or HGS/proprietor/writer roles aren’t genuinely separated. | Defend backup retention and impartial restoration, implement administrative separation, and deal with collapsed authority as a design failure. Shielding is not an availability assure or safety from each trusted authority. |
Additionally see the module’s compromise-response unit.
References
Distinguish a operating VM from a chilly begin. A at the moment operating workload would not show that it might restart, migrate, or get better after one other failure.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| Operating VMs survive an HGS outage however chilly begins fail. | Operating VMs have already got usable materials; new begins lack an obtainable approved launch path or eligible cache. | Restore major/fallback HGS or use beforehand established eligible offline operation. Keep away from pointless VM/host restarts till dependencies are understood. Do not exchange the KP. |
| Fallback URLs are configured, however the restoration HGS rejects the host or VM. | Enrollment, insurance policies, keys, TLS belief, or KP authorization weren’t maintained independently. | Restore the lacking permitted dependency on the restoration service and host. Distinct material keys require proprietor authorization for that guardian; endpoint configuration would not copy coverage or keys. |
| Fallback would not override a major safety rejection. | Availability fallback was mistaken for a approach round failed belief checks. | Right the precise safety situation. Do not design restoration HGS to simply accept hosts particularly rejected by major coverage. Fallback is for an unreachable/unresponsive service, not a weaker admission route. |
| Offline caching is enabled, however the VM will not begin offline. | The host/VM by no means obtained eligible cacheable materials, the construct is not supported, or the VM was solely guest-restarted. | Whereas HGS is obtainable, carry out the required full VM shutdown and begin underneath the permitted caching coverage, then take a look at an remoted outage. Enabling the service flag alone would not populate each VM’s cache. |
| Offline startup labored earlier than servicing however fails afterward. | CI, Safe Boot, VBS identification, or different security-state adjustments invalidated the cache. | Restore on-line attestation and acquire new eligible materials after the permitted change. Do not try to hold an outdated cache throughout a modified safety identification. |
| A cache on one host would not assist one other host or restoration web site. | Offline materials is host-, VM-, and security-state-specific slightly than transportable restoration authority. | Present the vacation spot with its personal legitimate on-line authorization and any permitted cache eligibility. Full-site restoration requires impartial keys and VM backups, not copies of a misplaced host’s cache. |
| Operators count on a bunch restart to work offline in each case. | Cache eligibility was inferred from a previous VM-only begin slightly than the precise reboot/security-state state of affairs. | Take a look at the supposed restart and servicing circumstances. Keep on-line restoration capability for circumstances that invalidate eligibility; do not promise offline operation solely from a configuration flag. |
| Disabling caching or withdrawing belief is anticipated to erase cached secrets and techniques instantly. | Service coverage was confused with deletion of fabric already launched to a different system. | Apply express containment and assess cached/running-state publicity. Use caching solely after approving its availability-versus-revocation tradeoff. |
References
Recuperate the authorization, keys, and guarded state wanted by the chosen restoration level. A latest VHDX is not essentially a recoverable shielded VM.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| VM backups exist, however restoration operators cannot entry them. | Backup identification, DNS, MFA/secret entry, repository decryption keys, or storage is dependent upon the failed material. | Restore impartial restoration authority and infrastructure first. Preserve examined entry to encrypted off-site/offline or immutable copies outdoors routine material management. |
| HGS state import fails. | Incorrect export password, broken/incomplete file, uninitialized vacation spot, incompatible construct, or unresolved import errors. | Confirm the protected export, initialize a supported clear HGS vacation spot, and examine every reported error. Reconcile duplicates intentionally; do not assume a command returning some objects means full restoration. |
| HGS import succeeds however key launch nonetheless fails. | The export accommodates public references, not the thumbprint-referenced/HSM personal keys. | Restore the unique personal keys by way of their impartial restoration methodology and authorize each node. HGS state import cannot reconstruct lacking nonexported keys. |
| HGS restores with out working DNS, TLS, AD identification, or JEA. | These dependencies had been assumed to be a part of the HGS state export. | Recreate the service identification, area/cluster configuration, administration, and TLS endpoints as required. Restore legacy AD host-group membership individually; an HGS export preserves group SIDs, not membership. Overview coverage after which take a look at shopper attestation and precise VM key launch. |
| The restored HGS service admits retired hosts or makes use of compromised keys. | An outdated or unreviewed export restored historic belief. | Overview all imported identities, variations, insurance policies, and keys earlier than exposing the service. Take away withdrawn belief underneath the incident/restoration plan. A usable backup is not robotically an permitted safety configuration. |
| Rebuilding HGS with the outdated certificates names would not unlock current VMs. | The brand new certificates comprise totally different keys. | Restore the unique uncompromised key materials or use surviving proprietor authority to authorize clear alternative keys in current KPs. Names cannot recreate cryptographic continuity. |
| A disk-only restore cannot begin the protected VM. | VM configuration, KP, vTPM/protected state, or checkpoint-chain dependencies weren’t backed up. | Restore a supported constant whole-VM set. If that set is unavailable, assess the separate owner-authorized guest-volume restoration path. Attaching the VHDX to a brand new VM is not equal to restoring it. |
| A restored VM has BitLocker or state-consistency errors. | Disks, configuration, KP, vTPM state, or differencing-disk dad and mom come from totally different closing dates. | Recuperate a constant known-good set with out enhancing the originals. Protect disk-chain relationships and use supported backup tooling. Do not combine state information to see which mixture boots. |
| A pre-rollover backup cannot begin or authorizes a compromised guardian. | Its KP nonetheless is dependent upon historic keys and permissions. | Examine in isolation. Use an permitted retained uncompromised key or clear owner-authorized restoration/reprotection. By no means re-enable a compromised guardian in manufacturing solely for comfort. |
| Backup succeeds however utility/item-level restore fails. | Crash consistency was mistaken for utility consistency, or the product lacks the required shielded-VM/guest-aware assist. | Confirm product/model/operation assist and use owner-authorized visitor credentials the place required. Take a look at utility restoration and knowledge integrity, not solely profitable VM boot. |
| A checkpoint or duplicate would not present an impartial restoration copy. | It shares storage, administrative management, chain dependencies, or unavailable keys with manufacturing. | Keep individually protected backups and take a look at full restoration. Checkpoints and replication can assist restoration operations however do not exchange impartial retention or recoverable keys. |
| Restoration exceeds RTO or loses extra knowledge than the RPO permits. | Safety dependencies are older than VM backups, retrieval was by no means rehearsed, or the restoration web site lacks capability/community mappings. | Outline and take a look at RPO/RTO for HGS, proprietor keys, KPs, unique PDKs, VM state, and purposes collectively. Refresh the restoration stock after coverage/key adjustments and rehearse dependency-ordered restoration. |
Really useful order: get better clear authority and backup entry; restore energy, networks, DNS, time, and required identification providers; rebuild/restore HGS and keys; set up eligible hosts/storage; restore constant VMs; then have house owners validate visitor and utility well being.
Additionally see the module’s artifact-custody and restoration models.
References
That is an owner-controlled guest-volume operation, not HGS service restoration. Work on an remoted constant copy and protect the unique restoration level.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
Save-ShieldedVMRecoveryKey cannot discover the anticipated materials. |
Incorrect disk, broken/inaccessible knowledge, or a VM outdoors the documented eligibility. | Choose the Home windows visitor’s OS disk and confirm provenance. The documented mechanism requires a Home windows shielded VM deployed with a PDK created on Home windows Server model 1709 or later. Use one other legitimate owner-escrowed protector if this path would not apply. |
Extraction works, however Unprotect-ShieldedVMRecoveryKey fails. |
Incorrect/or newly generated PDK, lacking matching proprietor personal keys, or private-key entry failure. | Retrieve the unique deployment PDK and usable matching proprietor keys on the trusted restoration pc. A alternative file with the identical title or an HGS backup is not equal. |
| The recovered file is not accepted as a typed restoration password. | The output is a decrypted .bek key file, not essentially a numerical recovery-password string. |
Use the supported BitLocker restoration process that accepts the important thing file for the matching OS quantity. Defend the decrypted file as plaintext restoration authority. |
| The OS restoration key would not unlock an encrypted knowledge quantity. | The fabric is restricted to the OS quantity; knowledge volumes have impartial protectors. | Retrieve that knowledge quantity’s owner-escrowed restoration materials. Do not overwrite or take away its protectors whereas trying to find a working key. |
| An accurate key would not restore a wholesome workload. | The filesystem/utility is broken, the disk chain is incomplete, or the restoration level is inconsistent. | Recuperate the very best constant backup and use supported quantity/utility restore on copies. Decryption establishes entry, not knowledge integrity or utility consistency. |
| Authentic proprietor authority and all legitimate restoration protectors are unavailable. | Irrecoverable key loss or destruction of the one constant restoration artifacts. | Exhaust independently retained reliable restoration sources and assess whether or not one other approved path stays usable. If none exists, knowledge will be completely unrecoverable. Material-administrator entry, new certificates, or a brand new vTPM do not present a bypass. |
After restoration, restore the supposed encryption and authorization, validate proprietor entry, and take away momentary decrypted materials in accordance with the permitted dealing with coverage.
References
Use these restoration sequences when a Hyper-V host or HGS server experiences TPM errors, a server stops at BitLocker restoration after a {hardware} change, or an unavailable certification authority (CA) blocks certificates operations. The host TPM, HGS guardian keys, and CA signing keys have totally different restoration dependencies. Changing one would not recreate one other.
Signs can embody TpmError, a lacking or not-ready TPM, or a bunch BitLocker restoration immediate. Firmware configuration, driver issues, and TPM lockout can resemble {hardware} failure. Verify the trigger with the server OEM slightly than treating each attestation failure as a failed chip. The host’s bodily TPM is separate from every visitor’s vTPM.
- Defend operating workloads and accumulate proof. Cease new placement on the affected host. Protect operating VMs the place secure; do not restart them merely to check the fault. On the affected host, examine
Get-Tpm,Get-HgsClientConfiguration, and TPM, BitLocker, and HostGuardian occasions. Report latest firmware, motherboard, boot, and coverage adjustments. - Retrieve restoration materials earlier than {hardware} adjustments. Acquire the host’s escrowed BitLocker restoration password or different legitimate restoration protector, plus restoration materials for any individually encrypted host knowledge volumes. Protect accessible, constant VM backups and their configuration, KPs, vTPM/protected state, disks, and checkpoint relationships. A visitor’s BitLocker restoration key would not unlock the host’s encrypted quantity.
- Recuperate workload availability on an eligible host. If supported migration can nonetheless full, transfer workloads to a wholesome guarded host that passes attestation and might get hold of keys approved by every VM’s current KP. In any other case, use a supported cluster-failover or constant whole-VM restore workflow. Do not assume stay migration can succeed after the TPM fault. Bodily TPM failure would not, by itself, completely bind an intact shielded VM to the failed host.
- Restore or exchange the failed platform part. Comply with the OEM’s supported {hardware} and firmware process. Use the host restoration protector if BitLocker blocks entry. After restore, restore the required TPM 2.0, UEFI, Safe Boot, VBS, and enforced CI configuration. Full the supported BitLocker post-recovery course of so safety makes use of the supposed TPM; confirm safety is energetic and restoration materials is escrowed earlier than returning the host to manufacturing. Do not go away BitLocker suspended.
- Register a alternative TPM as a brand new identification. If the TPM was changed, seize its precise platform identifier with
Get-PlatformIdentifierand have the HGS administrator register it on each relevant major and fallback HGS deployment. Confirm the alternative TPM’s endorsement-certificate chain. Reuse current permitted baselines and CI insurance policies solely after they nonetheless match; approve new artifacts just for an defined configuration change. An outdated identifier export is not a backup of the unique TPM’s personal keys. Withdraw the retired host identification with out deleting shared baselines or weakening attestation. - Show restoration earlier than resuming placement. Restore the proper major and fallback endpoints if the host was rebuilt, then get hold of contemporary attestation with
Take a look at-HgsClientConfiguration. Take a look at a managed shielded-VM chilly begin and have the proprietor confirm visitor entry, encryption, and utility well being. Do not depend on the failed host’s outdated offline cache. The place caching is permitted, set up new eligibility with the required full VM shutdown and begin whereas HGS is obtainable.
Restoration restrict: If the one VM copy is on an encrypted host quantity and neither a sound host-volume restoration protector nor an impartial backup is obtainable, HGS cannot unlock that host quantity for you. If solely a visitor disk survives, assess the separate owner-authorized guest-volume restoration path; creating a brand new vTPM or KP is not equal to recovering the unique VM.
References
First set up whether or not the error issues the HGS server itself or a Hyper-V host making an attempt to attest. HGS working in TPM-attestation mode validates the Hyper-V hosts’ TPM proof; that setting would not robotically retailer HGS guardian keys within the HGS server’s TPM. This module creates HGS certificates with the Microsoft Software program Key Storage Supplier. A neighborhood TPM failure can forestall the server’s BitLocker-protected OS from unlocking or have an effect on different TPM-protected credentials, however it would not robotically destroy these software-backed HGS keys.
- Decide the outage scope. Test particular person HGS nodes, not simply the service title. Preserve wholesome nodes serving requests and use the permitted upkeep process to maintain an unusable node out of the service path. Protect quorum, DNS, and remaining capability. Keep away from pointless guarded-host or VM restarts whereas the obtainable key-release paths are lowered.
- Safe the obtainable restoration materials. Retrieve the affected HGS server’s personal BitLocker restoration protector earlier than resetting or changing its TPM. From a wholesome HGS node, protect an up-to-date
Export-HgsServerStatebackup and its password by way of the permitted custody course of. Additionally find the unique HGS private-key backups or HSM restoration functionality and the individually maintained TLS materials. If no node is obtainable, use the independently retained backups. - Restore the node or exchange it within the surviving cluster. Recuperate OS entry and restore the {hardware} by way of the OEM-supported course of, then restore the server’s BitLocker safety. If the node cannot be repaired, observe the documented process so as to add a alternative HGS node to the surviving deployment. On this module, HGS nodes are area controllers: coordinate domain-controller alternative and AD well being slightly than blindly rolling again a server disk picture. Dropping one node would not require rebuilding your complete HGS forest or altering each VM’s guardian.
- Use HGS catastrophe restoration if your complete cluster is misplaced. Reestablish the required clear identification, DNS, time, and administration dependencies; set up and initialize a alternative HGS deployment; then use
Import-HgsServerStatewith the permitted export and its password. Overview restored host identities, baselines, CI insurance policies, and withdrawals earlier than admitting workloads. Want the documented HGS rebuild-and-state-restore process over assuming a whole-server picture reconstructs the distributed service. - Restore usable keys on each node. PFX-based keys will be restored from the HGS export and replicated by HGS. Thumbprint-referenced and HSM-backed personal keys require their separate restoration or provider-access process and gMSA permissions on every node. Restore TLS certificates and bindings individually; they are not equipped by the HGS state export. Protect the unique, uncompromised material key identities when potential. Neither a brand new certificates with the outdated topic nor a alternative TPM recreates a misplaced personal key.
- Validate the whole service and refresh backups. Verify AD, gMSA, DNS, TLS, and HGS well being, together with precise private-key use on each node. Run HGS diagnostics, get hold of contemporary host attestation, and take a look at key launch with a managed shielded-VM chilly begin. Have the proprietor confirm the workload, then restore the supposed node redundancy and take a brand new protected HGS export.
Restoration restrict: If all usable copies of the required HGS personal keys are misplaced, use one other material guardian already approved by the VM’s KP, or have the proprietor use surviving proprietor keys to authorize alternative material keys within the current KP. Protect its secret and hold the VM off all through that change. A brand new PDK would not restore deployed KPs. With out a certified key path, proprietor authority, or legitimate visitor restoration materials, some VM knowledge will be completely unrecoverable.
References
How do I preserve or get better the material when the CA is offline?
An unavailable certificate-issuance service, an deliberately offline root CA, and an unreachable certificate-validation endpoint aren’t the identical failure. Current certificates do not change into invalid merely as a result of the issuing service is stopped. HGS would not want a newly issued certificates for each VM begin, and its signing/encryption key-container certificates have totally different expiry and revocation semantics from TLS certificates. HTTPS and different certificates shoppers can nonetheless fail when certificates validity, chain constructing, or required revocation checks fail.
- Determine which CA and operation are affected. Decide whether or not the CA is an offline root used throughout managed signing operations or an issuing CA wanted for pending requests and renewals. This module makes use of a standalone CA; do not assume enterprise certificates templates or autoenrollment apply. If current HGS operations nonetheless work, protect availability whereas arranging the required CA operation slightly than changing working guardians.
- Separate issuance from certificates validation. From the affected host or administration community, test certificates dates, trusted roots and intermediates, service-name matching, and time. Examine the precise authority info entry (AIA) places and certificates revocation checklist (CRL) distribution factors (CDPs) embedded within the affected certificates chain. A operating CA would not show these places work, and a stopped CA would not make individually hosted publication endpoints unavailable.
- Restore the publication path when chain or revocation retrieval fails. Restore DNS, community entry, internet or listing publication, and the switch of the proper CA certificates and signed CRLs. An current legitimate CRL will be served with out preserving the CA’s signing service on-line. If a required CRL has expired, the accountable CA should publish a brand new signed CRL; restore parent-CA publication dependencies as wanted. For an offline root, use the permitted managed startup, signing, and switch course of, then return it offline. Preserve any required base and delta CRLs constant. Do not disable revocation checking or change clocks to hide expiry.
- Restore an unexpectedly unavailable issuing CA. Have the CA administrator examine the AD CS service (
CertSvc), occasions, storage, database/log entry, and signing-key or HSM availability. Right the recognized dependency underneath the CA’s restoration process. Restoring an HTTP CDP alone would not restore issuance, and repeatedly restarting the service will not recreate a lacking signing key or restore a broken database. - Restore the unique CA if its server is misplaced. Use the supported AD CS restoration/migration process with the unique CA identification, CA certificates and personal keys, database and logs, registry configuration, and
CAPolicy.infthe place used. Restore HSM entry and any relevant AD dependencies individually. Match the standalone/enterprise and root/subordinate CA sorts. Forestall the outdated and alternative servers from working independently as the identical CA. Preserve the AIA/CDP places referenced by current certificates obtainable; altering extensions on the brand new server impacts solely newly issued certificates. - Full pending issuance and required renewals. Retain every excellent request and its matching personal key, get hold of the permitted issued certificates, and settle for it on the system holding that key. Renew expired TLS or CA certificates by way of the suitable PKI process, distribute the required public belief chain, and replace TLS bindings on every HGS node. Restoring the CA or changing a TLS certificates would not, by itself, require altering HGS guardian keys. If material signing/encryption key pairs actually change, use the owner-authorized existing-KP workflow slightly than assuming a same-name certificates preserves entry.
- Confirm service continuity earlier than closing the outage. Take a look at permitted enrollment/renewal, chain constructing, and revocation retrieval from consultant shopper networks utilizing each current certificates and an permitted take a look at certificates. Verify contemporary HGS attestation and a managed VM key-release take a look at. Monitor certificates and CRL expiry and confirm publication earlier than the subsequent deliberate offline interval. A intentionally offline root can stay offline between its scheduled operations whereas its publication endpoints keep obtainable.
Restoration restrict: If the CA signing key’s irretrievably misplaced, a alternative CA with the identical title cannot subject certificates or contemporary CRLs underneath the unique key. Plan a managed trust-chain transition and affected-certificate alternative. A CA backup would not usually comprise the HGS personal keys generated on HGS nodes; protect and get better these keys independently.
References
Lacking or stale proof can delay restoration and conceal belief failures. Gather sufficient info to establish the layer with out disclosing the secrets and techniques that layer protects.
| Failure mode or symptom | Possible causes | Decision overview |
|---|---|---|
| A requested occasion channel is absent or has no occasions. | Incorrect pc/channel/construct, disabled logging, incorrect time window, inadequate entry, or no try occurred. | Uncover put in HostGuardian, CodeIntegrity, VMMS, employee, and cluster channels underneath the proper authority. Correlate timestamps and generate an permitted diagnostic try. Do not suppress errors and label an empty end result wholesome. |
| Monitoring is inexperienced whereas chilly begins or key launch fail. | Monitoring exams solely TCP, one node, a operating VM, or a beforehand cached end result. | Monitor the complete approved path: contemporary attestation, key usability on every node, managed chilly begins, fallback readiness, and recoverability. Preserve artificial exams remoted and non-destructive. |
| Occasions throughout methods seem contradictory. | Clock drift, stale standing, totally different responding HGS nodes, combined modes/variations, or unrelated makes an attempt. | Align the timeline, operation/VM identification, endpoint, node, and alter file. Retain the unique output alongside the interpretation. |
| Logs disappeared after compromise or rollback. | Proof existed solely on an affected host, retention was too brief, or restoration changed native logs. | Ahead and retain safety occasions outdoors routine material management and protect proof earlier than remediation. Lacking proof would not show that no compromise occurred. |
| A diagnostic bundle accommodates keys or tenant secrets and techniques. | Transcripts captured PFX passwords, restoration protectors, reply information, personal keys, or delicate configuration. | Limit the bundle instantly, apply the incident-handling course of, and produce a sanitized minimal mandatory copy for assist. Do not paste decrypted .bek information or private-key materials into tickets. |
| No listed trigger explains the failure. | A product defect, {hardware} fault, vendor integration, or unmodeled mixture requires deeper investigation. | Seize a minimal copy on a supported remoted system, correlate version-specific launch notes, and escalate with proof. Do not fabricate an error-code interpretation or progressively disable protections till the symptom disappears. |
References
