Guarded fabric and shielded VMs

• Platí pro:

  ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016

One of the most important goals of providing a hosted environment is to guarantee the security of the virtual machines running in the environment. As a cloud service provider or enterprise private cloud administrator, you can use a guarded fabric to provide a more secure environment for VMs. A guarded fabric consists of one Host Guardian Service (HGS) - typically, a cluster of three nodes - plus one or more guarded hosts, and a set of shielded virtual machines (VMs).

Important

Ensure that you have installed the latest cumulative update before you deploy shielded virtual machines in production.

Videos, blog, and overview topic about guarded fabrics and shielded VMs

• Video: How to protect your virtualization fabric from insider threats with Windows Server 2019
• Video: Introduction to Shielded Virtual Machines in Windows Server 2016
• Video: Dive into Shielded VMs with Windows Server 2016 Hyper-V
• Video: Deploying Shielded VMs and a Guarded Fabric with Windows Server 2016
• Blog: Datacenter and Private Cloud Security Blog
• Overview: Guarded fabric and shielded VMs overview

Planning topics

• Planning guide for hosters
• Planning guide for tenants

Deployment topics

• Deployment Guide
  • Quick start
  • Deploy HGS
  • Deploy guarded hosts
    • Configuring the fabric DNS for hosts that will become guarded hosts
    • Deploy a guarded host using AD mode
    • Deploy a guarded host using TPM mode
    • Confirm guarded hosts can attest
    • Shielded VMs - Hosting service provider deploys guarded hosts in VMM
  • Deploy shielded VMs
    • Create a shielded VM template
    • Prepare a VM Shielding helper VHD
    • Set up Windows Azure Pack
    • Create a shielding data file
    • Deploy a shielded VM by using Windows Azure Pack
    • Deploy a shielded VM by using Virtual Machine Manager

Operations and management topic

• Managing the Host Guardian Service