Shielded VM Template Creation in a Hyper-V Guarded Cloth

To arrange a shielded digital machine template on a Hyper-V guarded cloth, that you must put together a safe atmosphere (Host Guardian Service, guarded hosts) after which create a BitLocker-protected, signed template disk. This doc assumes that every one Home windows Server situations used are operating Home windows Server 2022 or Home windows Server 2025.

Host Guardian Service (HGS): Deploy an HGS cluster (usually 3 nodes for top availability) in a separate Lively Listing forest devoted to HGS. For manufacturing, HGS ought to run on bodily (or extremely secured) servers, ideally as a three-node cluster. Make sure the HGS servers have the Host Guardian Service function put in and are updated with software program updates.

Attestation Mode: TPM-Primarily based: Be sure that HGS is configured for TPM-trusted attestation. In TPM mode, HGS makes use of every host’s TPM 2.0 identification (EKpub) and measured boot sequence to confirm the host’s well being and authenticity. This requires capturing every Hyper-V host’s TPM identifier and establishing a safety baseline:

TPM 2.0 and Boot Measurements: On every Hyper-V host, retrieve the TPM’s public endorsement key (EKpub) and add it to the HGS belief retailer (e.g. utilizing Get-PlatformIdentifier on the host and Add-HgsAttestationTpmHost on HGS). HGS will even require a TPM baseline (PCR measurements of the host’s firmware/boot elements) and a Code Integrity (CI) coverage defining allowed binaries. Generate these from a reference host and add them to HGS in order that solely hosts booting with the authorized firmware and software program can attest efficiently.

Host Necessities: Every guarded host (Hyper-V host) should meet {hardware}/OS necessities for TPM attestation. This consists of TPM 2.0, UEFI 2.3.1+ firmware with Safe Boot enabled, and help for IOMMU/SLAT (for virtualization-based safety). On every host, allow the Hyper-V function and set up the Host Guardian Hyper-V Help characteristic (obtainable in Datacenter version). This characteristic permits virtualization-based safety of code integrity (making certain the host hypervisor solely runs trusted code), which is required for TPM attestation. (Take a look at this configuration in a lab first as VBS/CI can have an effect on some drivers).

Guarded Cloth Configuration: Be part of Hyper-V hosts to the material area and configure networking in order that guarded hosts can attain the HGS servers (arrange DNS or DNS forwarding between the material area and HGS area). After organising HGS and including host attestation information, configure every Hyper-V host as a guarded host by pointing it to the HGS cluster for attestation and key retrieval (utilizing Set-HgsClientConfiguration to specify the HGS attestation and key safety URLs and any required certificates). As soon as a number attests efficiently, it turns into a licensed guarded host in a position to run shielded VMs. HGS will launch the required decryption keys solely to these hosts that move well being attestation.

Put together a Technology 2 VM: On a Hyper-V host (it may be an everyday host or perhaps a non-guarded host for template creation), create a brand new Technology 2 digital machine. Technology 2 with UEFI is required for Safe Boot and digital TPM help. Connect a clean digital onerous disk (VHDX) for the OS. Set up Home windows Server on this VM utilizing customary set up media.
Partition and File System Necessities: When putting in the OS on the template VM, make sure the VHDX is initialized with a GUID Partition Desk (GPT) and that the Home windows setup creates the required partitions: there needs to be no less than a small System/EFI boot partition (unencrypted) and the primary OS partition (which can later be BitLocker-encrypted). The disk have to be a fundamental disk (not dynamic inside the visitor OS) and formatted with NTFS to help BitLocker. Utilizing the default Home windows setup on a clean drive usually meets these necessities (the installer will create the EFI and OS partitions routinely on a GPT disk).
Configure the OS: Boot the VM and carry out any baseline configuration wanted. Don’t be part of this VM to any area and keep away from placing delicate information on it accurately a generic base picture. Apply the newest Home windows Updates and set up any required drivers or software program that needs to be a part of the template OS (e.g. widespread administration brokers). Guaranteeing the template OS is absolutely up to date is essential for a dependable shielding course of.
Allow Distant Administration: As a result of shielded VMs can solely be managed remotely (no console entry), take into account configuring the template to allow Distant Desktop and/or PowerShell WinRM, and make sure the firewall is configured accordingly. You may additionally set up roles/options that many VMs will want. Nevertheless, don’t configure a static IP or distinctive machine-specific settings on this template as these shall be provided by way of a solution file throughout provisioning.

Run Sysprep: Within the VM, open an elevated Command Immediate and run:
C:WindowsSystem32SysprepSysprep.exe /oobe /generalize /shutdown
Select “Enter System Out-of-Field Expertise (OOBE)”, examine “Generalize”, and set Shutdown choice to “Shutdown” if utilizing the GUI. This strips out machine-specific particulars and prepares the OS for first-boot specialization. The VM will shut down upon completion.
Do Not Boot After Sysprep: Go away the VM off after it shuts down. The OS on the VHDX is now in a generalized state. Don’t boot this VM once more (doing so will boot into OOBE and break its generalized state). At this level you will have a ready OS disk (the VHDX) prepared for sealing.
(Non-obligatory) Backup the VHDX: It’s a good suggestion to make a duplicate of the sysprep’ed VHDX at this stage. After the following step (sealing the template), the disk shall be BitLocker-encrypted and can’t be simply modified. Conserving an unencrypted copy permits you to simply replace the template picture sooner or later if wanted.

Subsequent, seal the template VM’s OS disk utilizing the Shielded VM Template Disk Creation course of. This may encrypt the disk (getting ready it for BitLocker) and produce a signed catalog in order that the disk’s integrity may be verified later.

Set up Shielded VM Instruments: On a machine with GUI (this is usually a administration server and even Home windows 11 with RSAT), set up the Shielded VM Instruments element. On Home windows Server, use PowerShell:
Set up-WindowsFeature RSAT-Shielded-VM-Instruments -IncludeAllSubFeature (and reboot if prompted).
This supplies the Template Disk Wizard (TemplateDiskWizard.exe) and PowerShell cmdlets like Defend-TemplateDisk.
Receive a Signing Certificates: Purchase a certificates to signal the template disk’s Quantity Signature Catalog (VSC). For manufacturing, use a certificates issued by a trusted CA that each the material directors and tenants belief (e.g. an inside PKI or a certificates from a mutually trusted authority). The certificates’s public key shall be referenced later by tenants to belief this template. (For a lab or demo, you should utilize a self-signed cert, however this isn’t really useful for manufacturing.) Import the certificates into the native machine’s certificates retailer if it’s not already current.
Launch the Template Disk Wizard: Open Template Disk Wizard (present in Administrative Instruments after putting in RSAT, or run TemplateDiskWizard.exe). This wizard will information you thru defending the VHDX:
Certificates: Choose the signing certificates obtained within the earlier step. This certificates shall be used to signal the template’s catalog.
Digital Disk: Browse to and choose the generalized VHDX from Step 2 (the sysprep’ed OS disk).
Signature Catalog Information: Present a pleasant identify and model for this template disk (e.g. Title: “WS2025-ShieldedTemplate”, Model: 1.0.0.0). These labels assist establish the disk and model to tenants.
Proceed to the ultimate web page and Generate. The wizard will now:
o Allow BitLocker on the OS quantity of the VHDX and retailer the BitLocker metadata on the disk (but it surely does not encrypt the amount but as encryption will finalize when a VM occasion is provisioned with this disk).

o Compute a cryptographic hash of the disk and create a Quantity Signature Catalog (VSC) entry (which is saved within the disk’s metadata) signed along with your certificates. This ensures the disk’s integrity may be verified; solely disks matching this signed hash shall be acknowledged as this template.
Await the wizard to complete (it might take a while to initialize BitLocker and signal the catalog, relying on disk dimension). Click on Shut when completed.
The VHDX is now a sealed template disk. It’s marked internally as a shielded template and can’t be used besides a traditional VM with out going via the shielded provisioning course of (trying besides it in an unshielded method will probably trigger a blue display). The disk’s OS quantity continues to be largely unencrypted at relaxation (encryption will full when a VM is created), but it surely’s protected by BitLocker keys that shall be launched solely to a licensed host by way of HGS.
Extract the VSC File (for Tenant Use): It’s really useful to extract the template’s Quantity Signature Catalog to a separate file. This .vsc file accommodates the disk’s identification (hash, identify, model) and the signing certificates information. Tenants will use it to authorize this template of their shielding information. Use PowerShell on the RSAT machine:
```
Save-VolumeSignatureCatalog -TemplateDiskPath "C:pathWS2022-ShieldedTemplate.vhdx" -VolumeSignatureCatalogPath "C:pathWS2022-ShieldedTemplate.vsc"
```
This protects the .vsc file individually. Share this .vsc with the VM homeowners (tenants) or have it obtainable for the shielding information file creation within the subsequent step.

Alternatively to the wizard, you should utilize PowerShell: after putting in RSAT, run Defend-TemplateDisk -Path -Certificates -TemplateName “” -Model to seal the disk in a single step. The wizard and PowerShell obtain the identical consequence.

A shielding information file (with extension .pdk) accommodates the delicate configuration and keys required to deploy a shielded VM from the template. This consists of the native administrator password, area be part of credentials, RDP certificates, and the record of guardians (belief authorities) and template disk signatures the VM is allowed to make use of. For safety, the shielding information is created by the tenant or VM proprietor on a safe machine outdoors the material, and is encrypted in order that cloth admins can not learn the contents.

Conditions for Shielding Information:

Receive the Quantity Signature Catalog (.vsc) file for the template disk (from Step 3) to authorize that template.
If the VM ought to use a trusted RDP certificates (to keep away from man-in-the-middle when connecting by way of RDP), get hold of a certificates (e.g. a wildcard certificates from the tenant’s CA) to incorporate. That is elective; if the VM will be part of a site and get a pc certificates or if you happen to’re simply testing, it’s possible you’ll skip a customized RDP certificates.
Put together an unattend reply file or have the data wanted to create one (admin password, timezone, product key, and so forth.). Use the PowerShell perform New-ShieldingDataAnswerFile to generate a correct unattend XML for shielded VMs. The unattend will configure the VM’s OS on first boot (e.g. set the Administrator password, optionally be part of a site, set up roles, allow RDP, and so forth.). Make sure the unattend permits distant administration (e.g. activate RDP and firewall guidelines, or allow WinRM) as a result of console entry shouldn’t be obtainable for shielded VMs. Additionally, don’t hardcode any per-VM values within the unattend that ought to differ for every occasion; use placeholders or plan to provide these at deployment time.

Creating the .PDK file:

On a safe workstation (not on a guarded host) with RSAT Shielded VM Instruments put in, launch the Shielding Information File Wizard (ShieldingDataFileWizard.exe). This software will acquire the wanted information and produce an encrypted PDK file.
Proprietor and Guardian Keys: First, arrange the guardians. “Guardians” are certificates that characterize who owns the VM and which materials (HGS situations) are approved to run it. Sometimes:
- The Proprietor Guardian is a key pair that the tenant/VM proprietor possesses (the non-public key stays with the tenant). Create an Proprietor guardian (if not already) by way of the wizard’s Handle Native Guardians > Create possibility. This generates a key pair in your machine. Give it a reputation (e.g. “TenantOwner”).
- The Cloth Guardian(s) correspond to the HGS of the internet hosting cloth. Import the HGS guardian metadata file supplied by the hoster (that is an XML with the HGS public key, exported by way of Export-HgsGuardian on the HGS server). Within the wizard, use Handle Native Guardians > Import so as to add the hoster’s guardian(s) (for instance, “Contoso HGS”). For manufacturing, you may import a number of datacenter guardians if the VM can run in a number of cloud areas, embrace every approved cloth’s guardian.
- After including, choose all of the guardian(s) that characterize materials the place this VM is allowed to run. Additionally choose your Proprietor guardian (the wizard might record it individually). This establishes that the VM shall be owned by your key and may solely run on hosts authorized by these cloth guardians.
Template Disk (VSC) Authorization: The wizard will immediate so as to add Quantity ID Qualifiers or trusted template disks. Click on Add and import the .vsc file similar to the template disk ready in Step 3. You possibly can normally select whether or not the shielding information trusts solely that particular model of the template or future variations as nicely (Equal vs. GreaterOrEqual model matching). Choose the suitable possibility based mostly on whether or not you wish to enable updates to the template with out regenerating the PDK. This step ensures the secrets and techniques within the PDK will solely unlock when that particular signed template disk is used.
Unattend and Certificates: Present the reply file (Unattend.xml) for the VM’s specialization. In the event you created one with New-ShieldingDataAnswerFile, load it right here. In any other case, the wizard might have a simplified interface for widespread settings (relying on model, it might immediate for admin password, area be part of information, and so forth.). Additionally, if utilizing a customized RDP certificates, import it at this stage (so the VM will set up that cert for distant desktop).
Create the PDK: Specify an output file identify for the shielding information (e.g., MyVMShieldingData.pdk) and end the wizard. It should create the .pdk file, encrypting all of the supplied information. The Proprietor guardian’s non-public key’s used to encrypt secrets and techniques, and the Cloth guardian’s public key ensures that HGS (holding the corresponding non-public key) is required to unlock the file. The PDK is now prepared to make use of for provisioning shielded VMs. (You can even create PDKs by way of PowerShell with New-ShieldingDataFile for automation.)

Observe the PDK is encrypted such that solely the mix of the proprietor’s key and a licensed cloth’s HGS can decrypt it. Cloth admins can not learn delicate contents of the PDK, and an unauthorized or untrusted host can not launch a VM utilizing it. Preserve the PDK file secure, because it accommodates the keys that can configure your VM.

In some situations, particularly if that you must convert an current VM right into a shielded VM or in case you are not utilizing SCVMM for provisioning, a Shielding Helper disk is used. The Shielding Helper is a particular VHDX containing a minimal OS that helps encrypt the template disk and inject the unattend inside a VM with out exposing secrets and techniques to the host. SCVMM can automate this, but when that you must do it manually or for current VMs, put together the helper disk as follows:

Create a Helper VM: On a Hyper-V host (not essentially guarded), create a Gen 2 VM with a brand new clean VHDX (do not reuse the template disk to keep away from duplicate disk IDs). Set up a supported OS (Home windows Server 2016 or greater, a Server Core set up is enough) on this VM. This VM shall be short-term and its VHD will grow to be the helper disk. Guarantee you may log into it (set a password, and so forth.), then shut it down.
Initialize the Helper Disk: On a Hyper-V host with RSAT Shielded VM Instruments, run the PowerShell cmdlet:

    Initialize-VMShieldingHelperVHD -Path "C:VMsShieldingHelper.vhdx"

This command ought to level to the VHDX of the helper VM. This injects the required provisioning agent and settings into the VHDX to make it a shielding helper disk. The VHDX is modified in-place (take into account making a backup beforehand).
Do Not Boot the Helper VM Once more: After initialization, don’t begin the helper VM from Step 1. The VHDX is now a specialised helper disk. You possibly can discard the VM’s configuration. Solely the VHDX file is required going ahead.
Reuse for Conversions / Non-VMM Deployments: For manually shielding an current VM, you’d connect this helper VHDX to the VM and use PowerShell (e.g. ConvertTo-ShieldedVM or a script) to encrypt the VM’s OS disk utilizing the helper. The helper boots instead of the VM’s OS, makes use of the PDK to use BitLocker and the unattend to the OS disk, then shuts down. The VM is then switched besides from its now-encrypted OS disk with a digital TPM. (Observe: Every initialized helper VHDX is often one-time-use for a given VM; if that you must defend a number of VMs manually, create or copy a contemporary helper disk for every to keep away from BitLocker key reuse).

Copy the VHDX and PDK: Switch the sealed template .vhdx and the .pdk file to the Hyper‑V host (or a cluster shared quantity if the host is a part of a Hyper‑V cluster). For instance, place them in C:ShieldedVMtemplates on the host. This ensures the host can learn the information throughout VM provisioning.
Confirm File Belief: (Non-obligatory) Double-check that the template disk’s signature is acknowledged by the tenant’s shielding information. The template’s .vsc file (quantity signature catalog) ought to have been used when creating the PDK, so the PDK will “belief” that particular template hash. Additionally confirm that the HGS guardian within the PDK matches your cloth’s HGS public key. These should align, or the VM provisioning shall be rejected by HGS.

Observe: The PDK is encrypted and can’t be opened by the material admin because it’s designed in order that solely HGS (and the VM proprietor) can decrypt its contents. The host will use it as-is throughout provisioning. Be sure to don’t modify or expose the PDK’s contents.

PowerShell to finalize the shielded VM setup. Arrange the important thing protector on the present VM. For a clear course of, you should utilize New-ShieldedVM on the guarded host:


New-ShieldedVM -Title "Finance-App1" `
    -TemplateDiskPath "C:ShieldedVMTemplatesWS2025-ShieldedTemplate.vhdx" `
    -ShieldingDataFilePath "C:ShieldedVMTemplatesTenantShieldingData.pdk" -Wait

This single command will create a brand new VM named “Finance-App1” utilizing the desired template disk and shielding information file. It routinely configures the VM’s safety settings: attaches a vTPM, injects the Key Protector (from the PDK) into the VM’s safety settings, and attaches the shielding helper disk besides and apply the unattend. The -Wait flag tells PowerShell to attend till provisioning is full earlier than returning.

Observe: Make sure the VM identify is exclusive in your Hyper-V stock. The New-ShieldedVM cmdlet requires the GuardedFabricTools module and can fail if the host isn’t a guarded host or if guardians aren’t correctly configured. It makes use of the host’s configured HGS connection to request keys when provisioning.

In case your shielding information’s unattend file included placeholders for distinctive settings (for instance, a static IP deal with, customized pc identify, and so forth.), you may provide these values with the -SpecializationValues parameter on New-ShieldedVM. This takes a hashtable mapping the placeholder keys to precise values. As an illustration:

$specVals = @{
  "@ComputerName@" = "Finance-App1"
  "@IP4Addr-1@"   = "10.0.0.50/24"
  "@Gateway-1@"   = "10.0.0.1"
}
New-ShieldedVM -Title "Finance-App1" -TemplateDiskPath C:ShieldedVMTemplatesWS2025-ShieldedTemplate.vhdx `
  -ShieldingDataFilePath C:ShieldedVMTemplatesTenantShieldingData.pdk -SpecializationValues $specVals -Wait

This could change placeholders like @ComputerName@ within the unattend with “Finance-App1”, and so forth. Use this provided that the unattend (contained in the PDK) was arrange with such tokens. In lots of circumstances, the shielding information may already include all required settings, so specialization values are elective.

As soon as the shielded VM deployment is initiated (both by WAC or PowerShell), the provisioning course of begins on the guarded host. This course of is computerized and includes a number of phases behind the scenes:

The host registers a brand new Key Protector for the VM (containing the VM’s BitLocker key, sealed to the VM’s digital TPM and the material’s HGS). It then contacts the HGS. HGS verifies the host’s well being (attestation) and, if the host is allowed and wholesome, releases the important thing protector to the host.
The VM is initially began utilizing a short lived shielding helper OS (usually a small utility VHD). This helper OS boots inside the brand new VM and makes use of the unattend file from the PDK to configure the primary OS disk. It injects the administrator password, area or community settings, permits RDP/WinRM, after which finalizes BitLocker encryption of the VM’s OS quantity utilizing the VM’s vTPM. This encryption locks the OS disk so it will probably solely be decrypted by that VM’s vTPM (which in flip is just launched by HGS to trusted hosts).
When specialization is full, the VM will shut down routinely. This shutdown is a sign that provisioning is completed. The helper disk is then routinely indifferent, and the VM is now absolutely shielded.

As an administrator, it is best to monitor this course of to know when the VM is prepared:

In Home windows Admin Middle’s VM record, you might even see the VM’s state change (it’d present as “Off” or “Stopped” after the provisioning shutdown). You might not get an in depth standing in WAC throughout provisioning. Refresh the view to see if the VM has turned off after a couple of minutes.
Utilizing PowerShell, you may question the standing: run Get-ShieldedVMProvisioningStatus -VMName on the guarded host to examine progress. This cmdlet reveals phases or any errors throughout provisioning. (If the provisioning fails, the cmdlet or Hyper-V occasion logs will present error particulars. Widespread causes embrace guardian mismatches or unattend errors.)

As soon as the VM has shut down indicating success, you may proceed to start out it usually. In WAC, choose the VM and click on Begin (or use Begin-VM -Title in PowerShell). The VM will boot its now-configured OS. On first boot, it would undergo closing OS specialization (the usual Sysprep specialize/move completion).

Your new VM is now operating as a shielded VM. Key factors for administration:

Restricted Host Entry: As a result of it’s shielded, the Hyper-V host admin can not view the VM’s console or use PowerShell Direct on this VM. In WAC (or Hyper-V Supervisor), if you happen to attempt to hook up with the VM’s console, will probably be blocked (you may see a black display or an error). That is anticipated as shielded VMs are remoted from host interference. All administration have to be completed via the community.
Accessing the VM: Use the credentials set within the unattend/PDK to go browsing to the VM by way of Distant Desktop (RDP) or one other distant technique (e.g. PowerShell Remoting). Make sure the VM is related to a community and has an IP (by way of DHCP or the unattend’s settings). The unattend ought to have enabled RDP or WinRM as configured earlier. For instance, if the PDK joined the VM to a site, you may RDP with a site account; if not, use the native Administrator and the password from the shielding information.
Confirm Shielded Standing: In WAC’s stock, the VM ought to present as a era 2 VM with a TPM. You possibly can affirm it’s shielded by checking VM’s Safety settings (they’ll present that the VM is utilizing a Key Protector and is shielded, usually the UI can have these choices greyed-out/enforced). You can even use PowerShell: Get-VMSecurity -VMName . It ought to present Shielded: True and record the Key Protector ID, and so forth.
Routine Administration: You possibly can handle the VM (begin/cease/reset) in WAC like another VM. Backups, replication, and so forth., needs to be completed with shielded VM-compatible strategies (e.g. use Hyper-V checkpoints or backup APIs because the VM’s disks are encrypted however manageable via Hyper-V). Cloth admins can not alter the VM’s settings that will compromise its safety (for example, you can’t take away the vTPM or flip off shielding with out the VM proprietor’s consent).

Set up HGS in a brand new forest | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-install-hgs-default

Guarded cloth and shielded VMs | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node

Seize TPM-mode info required by HGS | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-tpm-trusted-attestation-capturing-hardware

Guarded host stipulations | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-guarded-host-prerequisites

Evaluation HGS stipulations | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-prepare-for-hgs

Create a Home windows shielded VM template disk | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-template

Shielded VMs for tenants – Creating shielding information to outline a shielded VM | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-tenant-creates-shielding-data

Shielded VMs – Making ready a VM Shielding Helper VHD | https://be taught.microsoft.com/en-us/windows-server/safety/guarded-fabric-shielded-vm/guarded-fabric-vm-shielding-helper-vhd