Summary
A guarded fabric works only when its authority boundaries survive normal operation, change, outage, and recovery. TPM attestation determines whether a Hyper-V host meets approved security conditions. A VM's shielded policy and KP separately determine its protections and authorized fabrics. Neither decision substitutes for the other.
Owner-approved images, protected provisioning data, and independent key custody extend that boundary into deployment. Servicing and key rollover preserve it only when old and new states are deliberately managed. Recovery must restore both usable cryptographic relationships and the intended trust decisions, not merely make a VM boot.
More info
- Features Removed or No Longer Developed in Windows Server
- Comparison of Windows Server editions
- Guarded Fabric and Shielded VMs overview
- Trusted Launch for Azure VMs
- Overview for Trusted launch for Azure Local VMs enabled by Azure Arc
- Guest attestation for Trusted launch for Azure Local VMs (preview)
- Server-side encryption of Azure managed disks
- Guarded Fabric and Shielded VM Planning Guide for Hosters
- Guarded Fabric and Shielded VM Planning Guide for Tenants
- Guarded host prerequisites
- Roles, Role Services, and Features included in Windows Server - Server Core
- Review HGS prerequisites
- Choose whether to install HGS in its own new forest or in an existing bastion forest
- Install HGS in a new forest
- Initialize the HGS cluster using TPM mode in a new dedicated forest (default)
- Configure additional HGS nodes
- Obtain certificates for HGS
- Certreq
- Certutil
- What is the Certification Authority Role Service in Windows Server?
- Distribute certificates to Windows devices by using Group Policy
- Capture TPM-mode information required by HGS
- Install trusted TPM root certificates
- Troubleshoot the Host Guardian Service
- Create a host key and add it to HGS
- Deploy App Control for Business policies using script
- Set-HgsServer (HgsServer)
- Upgrade a guarded fabric to Windows Server 2019
- Set-HgsClientConfiguration (HgsClient)
- HgsAttestation Module
- Shielded VMs for tenants - Creating shielding data to define a shielded VM
- New-HgsGuardian (HgsClient)
- Create a Windows shielded VM template disk
- Create a shielded VM using PowerShell
- ShieldedVMProvisioning Module
- New-ShieldingDataFile (ShieldedVMDataFile)
- Grant-HgsKeyProtectorAccess (HgsClient)
- Revoke-HgsKeyProtectorAccess (HgsClient)
- Provision shielded virtual machines in VMM
- Create a Linux shielded VM template disk (further study, not a second deployment track)
- GuardedFabricTools 1.1.1 (source and version reference, not evidence of Windows Server 2025 runtime validation)
- Managing the Host Guardian Service
- Branch Office Considerations
- Considerations and known issues when using Credential Guard
- What's new in Windows Server 2019
- Troubleshoot guarded hosts
- Save-ShieldedVMRecoveryKey (ShieldedVMDataFile)
- Unprotect-ShieldedVMRecoveryKey (ShieldedVMDataFile)