{"id":79040,"date":"2018-06-04T12:20:06","date_gmt":"2018-06-04T12:20:06","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=79040"},"modified":"2021-04-27T13:55:24","modified_gmt":"2021-04-27T13:55:24","slug":"hyper-v-and-powershell-shielded-virtual-machines","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/sysadmin\/powershell\/hyper-v-and-powershell-shielded-virtual-machines\/","title":{"rendered":"Hyper-V Shielded Virtual Machines with PowerShell: Guarded Fabric, Host Guardian Service, and vTPM Configuration"},"content":{"rendered":"

The series so far:<\/strong><\/p>\n

    \n
  1. Hyper-V and PowerShell: The Basics<\/a><\/li>\n
  2. Hyper-V and PowerShell: Shielded Virtual Machines<\/a><\/li>\n<\/ol>\n\n

    <\/a> In Windows Server 2016, Microsoft implemented a strong security concept called Shielded VMs. Shielded VMs have been improved in the Windows Server 2019 release. In the second part of this series, Nicolas describes what Shielded Virtual Machines are and how to configure them using PowerShell.<\/p>\n

    One key investment area that Microsoft improves in every Windows Server release is security. Whether you work for a small company or a multinational company, security is essential. But sometimes, it can be hard to secure your machines. If you work with physical machines, then you simply put these machines in a secure datacenter with padlocks and <\/a>provide access only to authorized administrators. On top of that you could have security guards in front of the datacenter. With Virtual Machines, you don\u2019t have this security perimeter because many administrators can access these VMs, such as: Hyper-V administrators, backup administrators, storage administrators, or maybe network administrators. These administrators can access your virtual machines because they need access to VMs in order to do their jobs! Thus, they must be able to access the VHD disks.<\/p>\n

    What are the security risks?<\/h3>\n

    The first risk that you can encounter is, for example, that your storage administrator with access to Hyper-V, will copy and paste one or many VHD disks to a USB device. The reason why Hyper-V presents such a huge risk has to do with Hyper-V anatomy. A virtual machine is a VHD disk which is nothing more than a file. Rather than booting the virtual machine, anyone could simply mount the VHD disk on a different Windows Server, thus giving the administrator access to the full contents of the VHD disk. In a better case, you will be notified that a copy has been made to an external drive; in the worst case you will have no awareness that your data has been compromised. Another risk is a malware attack. Imagine your Hyper-V host is compromised; all your VHD disks will be vulnerable and the malware will have full access to your Virtual Machines.<\/p>\n

    To reduce such risks, Microsoft has introduced Shielded Virtual Machines.<\/p>\n

    How Do Shielded Virtual Machines Work?<\/h3>\n

    Shielded Virtual Machines are based on the following concepts:<\/p>\n