Should all my Virtual Machines be Shielded VMs?

One of the security features IT Pros were missing in the first three versions of Hyper-V Server was securing virtual machines against potential host compromise. The idea behind this feature request was to protect virtual machines from malicious Hyper-V Admins and malware attacks in both public and private clouds. In simple language, if someone could export or copy your VHD disk and try to access it offline in Disk Management or run it on a non-genuine Hyper-V host, the new security feature shouldn’t allow it.

Microsoft accepted this challenge and implemented this security feature request in Windows Server 2016 / Hyper-V Server 2016. It is known as a Shielded Virtual machine. In this article, we will explain what a shielded VM looks like, and how and when to use them. Let’s get into it!

Malicious Hyper-V Admin exported and attached VHD to Disk Management. All data are fully accessible to perform brute-force attacks on user accounts on the Active Directory server.

Today in Windows Server 2019 and Windows Server 2022, it still exists and you can use it to protect the integrity of your virtual machines and hosted data and services (e.g. AD, SQL, File Server, DNS, etc). This article is about shielded virtual machines, installation requirements, and improvements in Windows Server 2019 and Windows Server 2022.

What is a Shielded Virtual Machine?

A shielded virtual machine is a generation 2 VM (Hyper-V supports generation 1 and generation 2 VMs), it has a virtual TPM (Trusted Platform Module), is encrypted with BitLocker (AES 256 encryption) and it can run only on healthy and trusted Hyper-V Server/s. If you protect your VMs using guarded fabric, malicious Hyper-V Admins will not be able to access the data residing within the virtual machine. That is a layer of security that doesn’t come natively with regular VMs.

Malicious Hyper-V admin is not able to power shielded virtual machine on untrusted Hyper-V host

Infrastructure Requirements for Shielded VMs

The shielded virtual machines are dependent and work together with two other components, Host Guardian Service (HGS) which is typically a cluster of three nodes, and one or more guarded hosts. Each host and each shielded virtual machine that is created on guarded fabric is protected by Host Guardian Service. In addition to that, guarded fabrics consist of four components including code integrity (measure if there are any changes in the code, e.g. malware injection), virtual secure mode (isolated user mode where keys are kept away from the malware), TPM (physical and synthetic protection), and Host Guardian Service.

The HGS protects hosts and shielded virtual machines by providing two services, attestation service, and key protection service. The task of the attestation service is to ensure that only trusted and genuine Hyper-V hosts can run shielded virtual machines and the Key Protection service takes care of providing necessary keys to power virtual machines on and to perform live migration to other guarded hosts. The diagram below explains it.

Source: Guarded fabric and shielded VMs overview

What Windows Server Editions Support Shielded Virtual Machines?

In order to deploy shielded virtual machines, you must be running Windows Server 2019 Datacenter or Windows Server 2022 Datacenter. Windows Server 2019 and 2022 Standard edition supports Hyper-V Server and creating regular virtual machines, but it does not support creating shielded virtual machines.

The guest operating system should be running Windows Server 2012, Windows 8 and later, or Linux (as of Windows Server 2019).

Shielded VM Improvements in Windows Server 2019 and Windows Server 2022

There are a few improvements in Windows Server 2019 and Hyper-V 2019 compared to the previous version. However, there are no changes in Windows Server 2022 since Microsoft focuses on Azure Stack HCI. Microsoft will continue to provide support for shielded virtual machines in Windows Server 2022, but there are no further developments. On the client version of Windows RSAT (Remote Server Administration Tools), the shielded VM tools feature will be removed.

So, what’s new in a Windows Server 2019/Hyper-V Server 2019 that is also available in Windows Server 2022/Hyper-V 2022 Windows role?

First. Microsoft stopped developing Host Guardian Service Active Directory attestation mode and created a new, simpler attestation mode called Host Key Attestation. The host key attestation provides equivalent functionality and is not dependent on TPM 2.0 devices. It uses key pairs to authenticate hosts with HGS, and the hosts are no longer dependent on Active Directory. Windows Server 2019 supports the V2 Attestation Version. This means that a fresh install of HGS on Windows Server 2019 will use the v2 attestation. If you do an in-place upgrade from Windows Server 2016 to Windows Server 2019, you will need to manually enable the v2 attestation version on your Windows Server 2019.

Second. It now supports creating Linux shielded virtual machines. However, please keep in mind that Microsoft doesn’t support each Linux distribution, but Ubuntu 16.04 LTS with the 4.4 kernel and later, Red Hat Enterprise Linux 7.3 and later, and SUSE Linux Enterprise Server 12 Service Pack 2 and later.

Third. You can run shielded-protected virtual machines in offline mode even if HGS is not reachable. This is not configured by default, and you need to enable it by running the following command on all HGS hosts.

Set-HgsKeyProtectionConfiguration – AllowKeyMaterialCaching

Fourth. Microsoft also implemented the option to easily integrate a backup for the HGS URL. If the primary HGS server goes down, the Hyper-V protected hosts provide shielded VM with no downtime. You need to execute the following command on your HGS hosts. You should replace https://HGS.Primary.com and https://HGS.Backup.com with their own domain names and protocols.

Set-HgsClientConfiguration-KeyProtectionServerUrl ‘ https://HGS.Primary.com/KeyProtection ‘-AttestationServerUrl ‘ https://HGS.Primary.com/Attestation ‘-FallbackKeyProtectionServerUrl ‘ https://HGS.Backup.com/KeyProtection ‘- FallbackAttestationServerUrl “https://HGS.Backup.com/Attestation”

Fifth. Use TPM and bind shielded virtual machine to specific Hyper-V host. This is mostly used for the privileged access machines and branch offices.

Sixth. You can use now VMConnect Enhanced Session Mode and PowerShell Direct to troubleshoot if you lost connection to shielded virtual machines.

How do I Deploy Shielded Virtual Machines in my Network?

We already covered shielded virtual machines in Hyper-V Server 2016 on standalone hosts. The procedure is equally applicable to Windows Server 2019 and Windows Server 2022.

Microsoft classifies the deployment steps into four parts, which includes planning, deployment, management, and troubleshooting.

Planning. Two critical factors are mandatory to have a successfully guarded environment. The first one is about hosters and the second one is about tenants. You need to plan the strength of trust (TPM and Host key attestation) that you want to achieve in your guarded fabric.

Deployment. Before you can create a shielded virtual machine, you need to create a guarded fabric. The procedure consists of 15 steps from verifying HGS prerequisites, configuring the clustered HGS nodes to creating a shielded virtual machine. The complete installation procedure is documented here.

Management. This part consists of creating and assigning the proper access permissions and roles to HGS. HGS ships with Just Enough Administration (JEA) roles that let you assign delegated permissions.

Troubleshooting. The usual question is, what if something goes wrong? You might experience different problems in your enterprise environments, from HGS certification issues, permissions level problems, attestation failures, and others. Microsoft developed a tool called Guarded Fabric Diagnostic Tool. It can identify and remediate common failures within the guarded fabric infrastructure, including HGS, guarded hosts, and services such as Active Directory and DNS. In addition to that, you can also analyze event log files. This diagnostic tool is helpful, but it is not a replacement for strong monitoring and incident response platform, which we recommend you use.

How Can You Manage Shielded Virtual Machines?

You can use System Center Virtual Machine Manager (VMM) to deploy shielded virtual machines in a couple of ways. One is to convert an existing virtual machine into a shielded virtual machine, and the second way is to create a new virtual machine as a shielded virtual machine. Here is a nice video that shows the procedure of creating shielded VM using VMM.

You can also use Hyper-V Manager to create and configure shielded virtual machines. Other than connecting to your Windows Server > Hyper-V Manager, you can also install Hyper-V client on your Windows 10 and Windows 11 and do your work from there.

Virtual Machines Backup and Restore Strategy

That is where Altaro Software comes into play. Altaro provides you with the backup of your workloads hosted on virtual machines on Hyper-V Server 2019 and 2022 (older versions are also supported). You can backup your virtual machines to onsite and offline on-premise and cloud locations. Altaro supports augmented inline deduplication which dramatically reduces storage requirements for your backup repository by creating the smallest backup size. Run your free trial today!

Other relevant articles/pages worth sharing:

Hyper-V 2016 Shielded Virtual Machines on Stand-Alone Hosts

Virtualized Domain Controllers: 4 Myths and 12 Best Practices

Hyper-V Infrastructure & Troubleshooting – a comprehensive forum resource for common Hyper-V problems

I hope you enjoyed reading this article. I welcome you to visit my own blog TechwithJasmin.com, and I’m looking forward to connecting with you via LinkedIn.

Note: To be able to create this article, I run my workloads on a powerful mini PC – Intel NUC powered with the CPU i7, the latest generation, 64 GB RAM DDR4, 256 M.2 SSD. Intel® NUC Mini PCs are fully complete and ready to work out of the box. You can learn more here Intel® NUC Products.