Design, operate, and recover Hyper-V guarded fabrics and shielded virtual machines
Guarded fabrics and shielded virtual machines provide Hyper-V's strongest built-in protections against fabric-administrator inspection and tampering when configured with hardware-backed host attestation.
- Host Guardian Service verifies cryptographic evidence of host identity, measured boot, and code integrity policy against approved requirements before releasing virtual machine key material.
- Signed templates, encrypted provisioning data, and enforced shielding settings protect deployment integrity and prevent fabric administrators from weakening virtual machine security settings.
- BitLocker encrypts the Windows guest's operating system volume, while Hyper-V encrypts sensitive saved state and live-migration traffic.
A guarded fabric separates control of virtualization infrastructure from authority to read protected workloads. That separation is useful when a virtual machine (VM) owner must protect guest secrets from a compromised, malicious, or curious fabric administrator. A guarded fabric requires more than an encrypted virtual disk: Hyper-V host eligibility, VM policy, key custody, and recovery must work together.
Note
Microsoft lists guarded fabrics and shielded VMs as no longer in development, while explicitly retaining support.
Learning objectives
After completing this module, you'll be able to:
- Explain which attacks shielding addresses, which administrators remain trusted, and which risks require other controls.
- Choose attestation, editions, hardware, identities, networks, certificates, and availability dependencies for the required assurance.
- Explain HGS initialization, Hyper-V host enrollment, policy versions, active modes, and attestation evidence.
- Design guardians, key protectors, trusted templates, shielding data, and an owner-approved provisioning path.
- Plan servicing, migration, key rollover, trust withdrawal, and incident containment without silently weakening policy.
- Distinguish HGS recovery, whole-VM recovery, guest recovery, fallback services, and offline key caching.
- Separate connectivity, attestation, key release, provisioning, migration authentication, and guest failures.
Prerequisites
Understanding of:
- Hyper-V and AD DS administration
- Public key infrastructure (PKI), BitLocker, and Secure Boot
- Backup and recovery concepts