Initialize HGS using Admin-trusted attestation

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016

Important

Admin-trusted attestation (AD mode) is deprecated beginning with Windows Server 2019. For environments where TPM attestation is not possible, configure host key attestation. Host key attestation provides similar assurance to AD mode and is simpler to set up.

These steps vary depending on whether you are initializing HGS in a new forest or an existing bastion forest:

1. Initialize the HGS cluster in a new forest (default)

   -Or-

   Initialize the HGS cluster in an existing bastion forest

2. Configure DNS forwarding in the fabric domain

3. Configure DNS forwarding and a one-way trust in the HGS domain