Server 2022 & 2025 Hyper-V New instance error "key protector could not be unwrapped"

Question

I just setup 3 Server 2025 and 1 Server 2022 servers, and installed the Hyper-V Feature. However, when I go to create a new VM host from MS ISO for Windows 11 I get the following:

The key protector could not be unwrapped. Details are included in the HostGuardianService-Client event log.

The event log

The remote attestation request failed because Isolated User Mode could not be detected. Verify that the Isolated User Mode feature is installed and that Virtualization Based Security has not been disabled manually or by local/domain-level policy. Event IDs 1025 and 3025 represent the same event.

So, I do not need Host Guardian because this is a small homelab for work, and I just want to be able to setup Win11 with TPM for Bitlocker. Nothing I have done seems to get this to work. Here are a few articles I have read and tried

https://www.reddit.com/r/HyperV/comments/16gxx0c/unable_to_enable_tpm_setting_the_key_protector/

https://bobcares.com/blog/hyper-v-the-key-protector-could-not-be-unwrapped/

I am not moving a VM from one host to another, and solutions state it is a cert issue from the original host. This cannot be the case because I am setting up the VM from scratch. I simply want to be able to Provision a new Windows 11 endpoint and enable Bitlocker....nothing special. What am I missing here? I previously had ESXi and Proxmox on these same host computers, and had 0 issues with Win11 TPM. TPM is enabled in BIOS, so, this has to be something with a Hyper-V setup somewhere.

Answer 1

Upgraded firmware and cleared TPM. After reboot was able to setup Win11 with TPM.

Answer 2

Export and Import Certificates:

• On the original Hyper-V host, export the certificates used for the Shielded VM.
  • Open the Run dialog, type mmc, and press Enter.
    • Add the Certificates snap-in for the Local Computer.
      • Navigate to Shielded VM Local Certificates and export the certificates.
• Import these certificates on the new Hyper-V host.
  • Transfer the exported certificates to the new host.
  • Open the Run dialog, type mmc, and press Enter.
  • Add the Certificates snap-in for the Local Computer.
  • Import the certificates into the Shielded VM Local Certificates store.
  • Export and Import Certificates:
    • On the original Hyper-V host, export the certificates used for the Shielded VM.
      • Open the Run dialog, type mmc, and press Enter.
      • Add the Certificates snap-in for the Local Computer.
      • Navigate to Shielded VM Local Certificates and export the certificates.
    • Import these certificates on the new Hyper-V host.
      • Transfer the exported certificates to the new host.
      • Open the Run dialog, type mmc, and press Enter.
      • Add the Certificates snap-in for the Local Computer.
      • Import the certificates into the Shielded VM Local Certificates store.