1
Q
What is the Host Guardian Service?
A
A server role installed on a secure cluster of bare-metal servers that are able to measure the health of a Hyper-V host and release keys for powering on or live migrating shielded VMs. Runs the attestation service and key protection service.
2
Q
What are the necessary requirements of a Guarded Fabric?
A
1 Host Guardian Service (usually cluster of 3 nodes)
1 or more guarded hosts
A set of shielded VMs
3
Q
What are the requirements for deploying a host guardian service
A
- At least 2 HGS Servers: Servers can be physical or virtual (3 total recommended)
- Servers should have TPMs (2.0 recommended, 1.2 supported)
- Server Core 2016+
- Network line-of-site to fabric allowing HTTP
- HTTPS certificate for access
- Every 4C/4GB can handle 1000 Hyper-V Hosts
4
Q
How do you handle disaster recovery for a Host Guardian Service?
A
Choose One
- Install separate HGS in each DC to authorize shielded VMs
- Install HGS stretch cluster between two or more datacenters
- Register Hyper-V with another HGS as a failover
NOTE: HGS should be backed up by exporting its configuration for local recovery
5
Q
What services (functions) are provided by the host guardian service?
A
- Attestation: Ensures only trusted Hyper-V Hosts can run shielded VMs
- Key Protection: Provides keys necessary to power on and live migrate shielded VMs to other guarded hosts.
6
Q
What security benefit is gained from shielded VMs?
A
If a VM is exported or copied, the VM cannot be run as it is only allowed to run from protected systems.
7
Q
What are the different attestation modes?
A
- TPM-Trusted attestation (Hardware based)
- Host Key Attestation (based on asymmetric key pairs)
- Admin-trusted attestation (AD based; depreciated in Server 2019)
8
Q
What attestation mode is recommended in a guarded fabric?
A
TPM-Trusted mode. It offers stronger assurances bv ensuring the guarded hosts are approved based on their TPM identity, measured boot sequence, and code integrity policies.
9
Q
What are the requirements for TPM-trusted attestation/
A
TPM 2.0 and UEFI 2.3.1 with Secure Boot
10
Q
If a Hyper-V Host does not have TPM 2.0 can it still be part of a guarded fabric?
A
Yes. It requires a compromise by using Hosted Key Attestation instead of TPM attestation. Hosted Key Attestation utilizes asymmetric keys to validate hosts.
11
Q
What is Admin-trusted attestation?
A
This attestation mode uses AD Group Membership to attest a guarded fabric. It is being deprecated in Server 2019 in favor of Host Key Attestation.
12
Q
What are the primary use cases for Shielded VMs and Guarded Fabric?
A
Cloud Providers and Enterprise Clouds
13
Q
What types of VMs can be run on a guarded fabric?
A
- Normal VMs with no protection
- Encryption-supported VMS who can be configured by fabric admins
- Shielded VMs who are protected in a way that cannot be disabled by fabric admins
14
Q
How does the guarded host determine a VM is still protected after the VM has been started?
A
In addition to the initial check of the VM at boot, TPM-trusted attestation checks the VM every 8 hours after its boot.
15
Q
Which HGS attestation mode would you use if the goal is to protect VMs from malicious admins or a compromised fabric?
A
TPM attestation. This mode works well for multi-tenant hosting as well as high-value enterprise environments.
16
Q
You work for a company that has industry-specific compliance settings that require that VMs be encrypted at rest and in flight. Which HGS attestation mode accommodates this requirement?
A
Host Key Attestation. Works well for general purpose data centers where fabric admins are trusted and are allowed access to guest VMs.
17
Q
What powershell cmdlets can be used to backup and restore an HGS?
A
Export-HgsServerState
Import-HgsServerState
18
Q
What version of Windows Server is required for a server to be made a Guarded Host?
A
- Host Key Attestation: Server 2019 Standard or Datacenter
- TPM-Based: Server 2016+ Standard or Datacenter
19
Q
What needs configured so the fabric (host) domain and the HGS domain can communicate?
A
DNS forwarding
20
Q
Why is HGS relegated to its own forest?
A
The AD for HGS is treated as sensitive because its administrators have access to the keys that control shielded VMs. The environment is self-contained and thus a known good source.
21
Q
Can an HGS be installed in an existing Bastion forest?
A
Yes. HGS can be installed in an existing bastion forest. The only real forest requirement for the HGS is that it be configured in the root domain of the forest.
22
Q
What cmdlet will install the Host Guardian Service role?
A
Install-WindowsFeature -Name HostGuardianServiceRole - IncludeManagementTools -Restart
23
Q
What command will install an HGS in its own dedicated forest?
A
Install-HgsServer -HsgDomainName $DomainName -SafeModeAdministratorPassword $PwdSecString -Restart
24
Q
What is the process to add HGS to an existing Bastion Forest?
A
- Install HGS Role
- Join HGS to existing domain (HGS must be added to the root domain)
- Create security group for HGS Nodes
- Create gMSA for the HGS (gMSA will need to be able to generate events in the security log on the HGS server)
- Configure/Create JEA Security Groups. JEA is not required to manage HGS but it must be configured.
Create 2 groups: Admins and Reviewers - Configure/Create cluster computer objects
Prestage the computer accounts if the Hgs Account cannot create computers. Whoever runs the Initialize-HgsServer command needs full control over the cluster object and the security object. - Configure security.
25
What is the function of the certificates on the HGS?
HGS certificates are used to protect the sensitive information needed to start a shielded VM. They never leave the HGS are are only used to decrypt VM keys.
26
What are the requirements of the HGS Certificate?
Key Algorithm: RSA
Minimum key size: 2048 bits
Signature Algorithm: Recommended SHA256
Key Usage: Digital Signature and Data Encipherment
EKU: Server Authentication
Key renewal policy: Renew with the same key
Subject Name: Recommended to use the company web address
27
What names are required on the HGS SSL Certificate?
Subject Name: Name of the HGS Cluster. This is the name supplied with Initialize-HGSServer
SAN: If a different DNS name is used to access the cluster, include it as a SAN
28
In which version of Windows was the ability to list a second set of HGS Urls for the Shielded VMs made available?
Server 2016 version 1709
29
If you configure a failback HGS, what must be done to ensure that VMs can attest?
- Ensure that either the servers have a shared encryption and signing certificates, or separate certificates are used to configure the HGS shielded VMs to use both HGS Servers
- Attestation policies need to be in sync between the two clusters
- Hyper-V hosts need to be Server 2016 version 1709 or Server 2019.
- Run the command: Set-HgsClientConfiguration -FallBackKeyProtectionServerUrl $URL1 -FallbackAttestationServerUrl $URL2
30
How do you undo the fall back configuration for an HGS?
Run the command: Set-HgsClientConfiguration and omit any of the fallback data
31
How may certificates are needed on the HGS Cluster?
Two: One for signing and one for encryption
32
What cmdlet would configure an HGS Cluster using TPM attestation?
Initialize-HgsServer -TrustTPM
33
What cmdlet would allow you to run diagnostics against the HGS?
Get-HgsTrace -RunDiagnostics
34
How do you get a TPM's Endorsement Key to use with TPM-trusted attestation?
Use the cmdlet Get-PlatformIdentifer to grab the key. You'll need to output the XML portion of the command to a file
35
For (legacy) Admin-trusted delegation, how do you authorize servers to be part of the attestation service?
Add-HgsAttestationHostGroup -Name $GroupName -Identifier $GroupSID
36
What trusts need configured between the HGS Cluster and the production forest?
A one-way trust needs configured with the HGS trusting production
37
How does Active DIrectory-trusted attestation validate the guarded host's configuration file?
It doesn't. This can only be done with TPM-trusted attestation.
38
What cmdlet generates a new Code Integrity Policy?
New-CIPolicy
Note: You need to copy the policy file to the HGS using the following cmdlet: Add-HgsAttestationCIPolicy -Name $Policy -Path $PolicyP7B
39
How do you gather the TPM baseline policy from every host?
Get-HgsAttestationBaselinePolicy -Path $PolicyPath
| Note: This needs run on every host with a different hardware profile.
40
How do you register the TPM policy with the attestation service?
Add-HgsAttestationTPMPolicy -Name $Policy -Path $PolicyPath
41
How do you configure guarded hosts to request keys for HGS Servers?
- Run Get-HgsServer on the HGS Server to get the attestation URLs.
- Run Set-HgsClientConfiguration -KeyProtectionServerURL $KPSUrl -AttestationUrl $AttestURL
42
What general steps need performed to create a guarded host using SCVMM?
- Attestation Service Url - URL of the attestation service, part of the HGS. Confirms the host is authorized to run shielded VMs
- Key Protection Service URL - URL of the key protection service, part of the HGS. Once a host passes attestation, it retrieves the key required to decrypt VMs from this service.
- Code Integrity Policy File Share Path (Only required for TPM attested mode) - TPM Attestation requires a host to have a TPM 2.0 chip. A code integrity policy restricts the software that can run at the kernel level to only what the code integrity policy has.
- Shielding Help VHD - Includes tools to convert existing non-shielded vms to shielded.
43
What are the steps to create a guarded host in SCVMM?
1. VMM Console \ Settings \ Host Guardian Service Settings.
a. Provide the attestation and Key Protection URLs (must be the same URLs across all hosts in VMM). Needs to be exactly what was entered on the hosts.
b. Add any CI Policies to VMM
c. Specify the location of the shielding helper VHD
2. For TPM-basted attestation: R-Click the Host \ Start Maintenance Mode
3. Configure Guarded Host: R-Click Host \ Host Guardian Service
a. Check "Enable the Host Guardian Service and use the URLs configured as global settings in VMM"
b. Check "Use a code integrity policy to restrict the software that can run on the host"
4. R-Click Host \ Stop Maintenance Mode
44
In which version of Windows were Shielded VMs introduced?
Server 2016
45
What generations of VMs do shielded VMs support?
Generation 2 VMs
46
What is a shielded VM?
A Generation 2 VM with virtual TPM, encrypted with BitLocker, and is restricted to run on healthy and approved hosts.
47
What assurances are offered by the Host Guardian Service?
BitLocker encrypted Disks (OS disks and data disks)
Deployment of new shiedled VMs from a trusted template
Protection of Passwords and other secrets
Tenant control of where a VM can be started
48
What are shielded template disks?
Trusted template disks for deploying shielded VMs that have computed signatures. These signatures are stored in a catalog.
When a shielded VM is provisioned the signature of the disk is computed and compared to the trusted signature. If the signatures match, the VM is deployed. If they do not match, the shielded VM is determined to be untrustworthy and the deployment fails.
49
What is a PDK File?
PDK files are known as shielding data files and are used to protect tenant keys and are uploaded to the fabric by the tenant. They protect important VM configuration data (admin password, RDP, and other certificates, domain join credentials, etc.).
50
Where are the tenant domain join credentials stored for shielded VMs?
PDK Files
| These files also store certificates, admin password, and other important secure information.
51
What types of data is protected by a PDK file?
Administrator credentials
Answer file (unattend.xml)
Security Policy that determines whether the created VMs are configured as shielded or encryption supported
RDP Certificate
Volume signature catalog
Key protector that defines which guarded fabrics a VM is authorized to run on.
52
What is the difference in function between shielded VMs and encryption-supported VMs?
Shielded VMs are encrypted and protected from access by fabric admins.
Encryption-supported VMs can be encrypted but still are accessible by fabric admins.
53
What is the use case for encryption supported VMs?
Encryption-supported VMs are intended for use where the fabric admins are fully trusted. Fabric Admins can continue to manage the VMs in a convenient way.
54
What is the use case for shielded VMs?
Shielded VMs are intended to be used on fabrics where the data and the state of the VM must be secured from the fabric admins and untrusted software.
They never permit console connections or Powershell Direct connections.
55
What are the major differences between a shielded VM and encryption-supported VMs?
- Shielded VMs require secure boot, vTPM, and that the VM state and live migration traffic be encrypted. Encryption supported VMs require these features but they are allowed to be modified.
- Shielded VMs cannot use certain VM integration components (e.g. Data Exchange and Powershell Direct). ES-VMs can use all integration services.
- Shielded VMs cannot use VM connection console and HID Devices. ES-VMs can use these (In Server 2016 1803 Shielded Vms can use some of these features)
- Shielded VMs do not allow for COM/Serial ports for debuggers to be attached to the VM process.
56
What process is performed on the guarded host before a shielded VM can be turned on?
The VM is tested to be healthy by presenting a certificate of health to the Key Protection Service (KPS)
57
What information is sent as part of the host attestation process when a shielded VM is turned on?
For TPM-Trusted Attestation:
- Identifying information about the TPM (endorsement key)
- Information about started processes (TCG Log)
- Code Integrity Policy
Host Key Attestation
- Hyper-V checks the key pair. HGS validates the key is registered
Admin-Trusted Attestation
- Hyper-V sends a Kerberos ticket identifying which security groups the host is in. HGS validates the host belongs to the correct security group.
58
What is the boot process for a shielded VM?
1. VM is powered on
2. Host requests attestation
3. Attestation is checked
4. Attestation certificate is sent to host
5. Host requests VM key
6. Key is released to host
7. Key is returned to host
59
Which versions of Windows can have shielded VMs?
Any version of Windows that supports Generation 2 VMs (2012 and newer)
60
When should you configure a shielded VM over an encryption supported VM?
Shielded VMs protect the VM from a compromised fabric.
| Shielded VMs should be used where the fabric and the fabric administrators are not trusted.
61
What is required to decrypt a shielded VM?
An owner key - Cryptographic Key maintained by the owner that is used for last-resort recovery or troubleshooting - and one or more guardians (guarded host keys) - Each guardian is a server/fabric that an owner authorizes a VM to run on
62
What is an Owner Key?
Cryptographic key maintained by the owner that is used for decrypting a shielded VM. Often used as a last resort in troubleshooting. It consists of two certificates: encryption and signing and it can be created with a private or public PKI.
Only one owner key should ever be created, but multiple are allowed.
Host guardian keys should be different from owner keys.
63
How many owner keys can be created for a shielded VM?
Many. The best practice is only one should be created.
64
Should owner keys and host guardian keys be the same keys?
No. It is best practice they be created separately.
65
What information is contained in the shielding data of a shielded VM?
- Security Level : Shielded or Encryption-supported
- Owner and list of trusted Host Guardians where the VM can run
- VM initialization data (unattend.xml, RDP Cert, etc.)
- List of trusted signed template disks for creating the VM in the virtualization environment.
66
When should new shielding data files be created?
If a given VM requires any of the four items in a data file (security level, owner, initialization data, and trusted template disks) to be different, a new data file is needed. Shielding data files can be used over and over again so a single file can be used to create multiple VMs.
67
What different options exist for creating a shielded VM?
- Create a shielded VM in the environment and upload it to the virtualization fabric.
- Create a new shielded VM from a signed template on the fabric.
- Shield an existing VM (Must be Generation 2 and running Server 2012+)
68
What options are available when using a template disk to create a shielded VM?
- Use an existing signed template disk provided by the virtualization provider. VM Provider maintains the signed template disk.
- Upload a signed template to the virtualization fabric. VM owner maintains the template.
69
What is offline mode in Shielded VMs?
Offline mode allows a shidled VM to turn on if an HGS cannot be reached as long as the configuration of the Hyper-V host has not changed. Offline mode utilizes a special version of the VM TPM key protector and requires the absolute latest version of Windows Server (not GA).
70
How do you create template disks?
Use the Shielded Template Creation WIzard
| Powershell: Protect-TemplateDisk
71
What are the requirements for a shielded template VHDX?
- Must use a GPT disk
- Disk type must be basic
- Disk must be two partitions: OS and BootLoader
- Must use NTFS
- OS must be Server 2012/Windows 8 or newer
- OS must be sysprepped
72
What must be installed to run the Shielded Template Creation wizard?
Install-WindowsFeature -Name RSAT-Shielded-VM-Tools -Restart
73
What is the process behind creating a shielded VM template?
1. Copy generalized VHDX with proper configuration to the server.
2. Install t he shielded VM tools (RSAT-Shielded-VM-Tools)
3. Obtain or create a certificate to sign the VSC for the VHDX
4. Launch the template disk wizard (TemplateDiskWizard.exe)
5. Choose the certificate
6. Provide a friendly disk name and version
7. Generate the disk
74
What steps must be performed to create a shielded VM Template in VMM?
1. Create a template disk VHDX u sing the standard creation process
2. Refresh the library server. Navigate to Library \ expand Library Servers \ R-Click the library and choose Refresh
3. Provide VMM with information about the OS on the disk
75
In VMM how do you tell a VHDX template is for a shielded machine?
The icon has a shield next to it. You can also enable the shielded column which will tell if a template is shielded or not.
76
How do you convert a shielded VM template in VMM using the prepared template disk?
1. Library \ Create VM Template
2. Choose "Use an existing VM Template or virtual hard disk stored in the library" \ Click Browse
3. Enable the shielded column for easier searching and select a prepared template disk from the library
4. Specify the VM Name
5. Specify the VM capabilities
6. Provide the correct OS Product Key
77
How do you convert a VHDX to being a protected VHDX for shielded VMs using Powershell?
Protect-TemplateDisk -Certificate $Cert -path $VhdPath -TemplateName $TemplateName -Version $VersionNum
78
How do you extract the signature catalog from a protected VHDX?
Save-VolumeSignatureCatalog -TemplateDiskPath $VhdPath -VolumeSignatureCatalogPath $VSCPath
79
What is the Volume Signature Catalog (VSC) used for?
THis file is used to provide information about the signing certificate, disk name, and version to the VM owners wanting to use a protected VM template. This file needs to be imported into the Shielding Data File Wizard to authorize someone to create template disk for them.
80
What features of a VM are locked out if Shielding is turn on the VM?
Management Features like console connection, Powershell Direct, and some integration components are disabled.
Secure Boot, TPM, and Encrypt State and Virtual Machine traffic are automatically enabled with shielding
81
Can a shielded VM be run without setting up a Host Guardian Service?
Yes. However, to move the VM to another host requires the Key Protector for the VM to authorize the host.
82
What are the steps to install and configure the Host Guardian Serivce?
1. Install HGS Feature
Install-WindowsFeature -Name HostGuardianServiceRole -IncludeManagementTools -Restart
2. Install HGS Server (possibly after reboot)
Install-HgsServer -HgsDomainName $HgsDomain -SafeModeAdministratorPassword $SecureString -Restart
3. Create a self signed cert: one for signing and one for encryption - Export them as PFX
- $Cert = New-SelfSignedCertificate -Subject "CN=Hgs Signing Certificate"
- Export-PfxCertificate -FIlePath $SignCertPath -Password $CertPass -Cert $Cert
- Remove-Item $Cert.PSPath
- $EncCert = New-SelfSignedCertificate -Subject "CN=HGS Encryption Certificate"
- Export-PfxCertificate -FilePath $EncCertPath -Password $CertPass -Cert $EncCert
- Remove-Item $EncCert.PSPath
4. Initialize HGS - Configure HGS Cluster and WebServices
- Initialize-HgsServer -LogDirectory $Directory -HgsServiceName HGS -Http -TrustActiveDirectory -SigningCertificatePath $SignCertPath -SigningCertificatePassword $SignPwd -EncryptionCertificatePath $EncCertPath -EncryptionCertificatePassword $EncPwd
5. Validate HGS Server configuration
- Get-HgsTrace -RunDiagnostics
83
What are the high-level steps to installing and configuring an HGS Server?
1. Install-WindowsFeature HostGuardianService
2. Install-HgsServer
3. Create 2 Certificates: Signing and Encryption
4. Initialize-HgsServer
5. Get-HgsTrace -RunDiagnostics
84
Since Admin-trusted attestation depends on the corporate network for some information, what are the requirements between it and the corporate network for it to work?
- The Fabric AD must trust the HGS Forest
- A DNS Conditional Forwarder must be configured in the fabric AD
- A HgsHosts group needs configured in the fabric AD
85
What are the minimum requirements for Admin-trusted attestation?
- One HGS Server running Server 2016
| - One guarded Hyper-V host running Server 2016
86
What does the attestation process look like for admin-trusted attestation?
1. Shielded VM Started
2. Attestation Client initializes the attestation
3. Host presents a Kerberos Service Ticket
4. HGS validates group membership in the AD attestation group
5. HGS issues a signed certificate encrypted to the host.
87
Since Admin-Trusted attestation depends on the corporate network for some information, what are the requirements between it and the corporate network?
- Fabric AD must trust the HGS FOrest
- DNS conditional Forwarder must be configured in the fabric ad
- A HGSHosts group needs configured in the fabric AD
88
What Powershell cmdlet willc reate a DNS Conditional Forwarder?
Add-DnsConditionalForwarderZone
89
What command will create a one way trust between two domains?
Netdom trust $DomainA /domain:$DomainB /userD:$DomainBUser /passwordD:$DomainBPassword /ad
90
With Admin-trusted attestation how do you registr the HGS server group with the attestation service?
Add-HgsAttestationHostGroup -Name $GroupName -Identifier $SID-of-Group
91
Why is TPM-trusted attestation the preferred type of attestation?
It secures the system at the hardware level.
92
How do you change the Endorsement key in TPM-trusted attestation?
You cannot. The Key is fixed into the TPM at manufacture and cannot be changed.
93
What high-level steps are required for configuring TPM-Trusted Attestation?
1. Initialize HGS Cluster in New Forest
2. Install Trusted Root TPM Certificates
3. Configure DNS on the Fabric
4. Retrieve the TPM Identifier (guarded host's TPM 2.0 EK)
5. Create CI Policy that will be used
6. Capture TPM Baseline
7. Configure Hyper-V Guarded Host's HGS Server
94
How do you retrieve the TPM identifier?
Get-PlatformIdentifier -Name $Name
95
What Powershell cmdlet copies the created TPM identifier to the HGS host?
Add-HgsAttestationTpmHost -Name $Name -Path $TPM _EK.xml
96
What Powershell cmdlet will add a CI Policy?
Add-HgsAttestationCIPolicy -Name $Policy -Path $Policy_P7B
97
What Powershell cmdlet will capture a TPM Baseline Policy?
Get-HgsAttestationBaselinePolicy - Path $BaseLinePath_Bin
98
How do you copy the TPM Baseline Policy to the HGS Server?
Add-HgsAttestationTPMPolicy -Name $TPMPolicy -Path $BaselinePath
99
What is the Key Protection Service on the HGS Server?
It provides the transport keys that are required to unlock and run shielded VMs on healthy Hyper-V hosts.
100
What is the best practice for securing Key Protection Service keys?
Use HSM-backed keys
101
What command configured the signing and encryption keys for the Key Protection Service?
Initialize-HgsServer
102
How would you add new encryption and signing keys to the HGS?
Add-HgsKeyProtectionCertificate
103
How would you add new encryption and signing keys installed into the HGS?
Get-HgsKeyProtectionCertificate
104
How would you set new signing or encryption keys for an HGS?
Set-HgsKeyProtectionCertificate
105
Which certificate store on the HGS should the signing and encryption keys be installed?
Local Computer
106
How do you configure the appropriate access to the HGS certificates?
1. Launch IIS
2. Select Application Protocols
3. Open "Local Machine Certificate Management Console" (Certlm.msc)
4. Locate encryption and signing keys
5. Right Click each certificate \ All Tasks \ Manage Private Keys \ Grant Read permissions to the KPS Service \ Choose the KeyProtection App pool
107
Do HGS nodes use different signing and encryption keys?
No. They all utilize the same keys and will need to have them exported to them and have access granted so they can all be read.
108
What Powershell cmdlet will check if a host is guarded or not?
Get-HgsClientConfiguration
109
How do you check if an HGS host is guarded or not?
Get-HgsClientConfiguration
110
How do you check if an HGS host is responding?
Open the follwoing URL in the browser: http://localhost/KeyProtection/service/metadata/2014-07/metadata.xml
111
What types of VMS can run on a Guarded Fabric?
- Normal VMs (No Protections)
- Encryption Supported VMs
- Shielded VMs
112
How do you check whether a guarded host in VMM has successfully attested with an HGS?
1. Open fabric workspace \ Find host group with guarded hosts
2. Find the host to inspect \ R-Click and choose View Status \ Find measurements under HGS Client Overall
3. Rectify any warnings.
113
What must be done to configure SCVMM to work well with guarded hosts?
Configure VMM globals with the URLs of the fabric's HGS Cluster
114
How do you prepare Nano Server for the Guarded fabric?
- Remote Powershell
| - Microsoft Scripts (e.g. PrepareNanoTP5.ps1)
115
What is the high-level process for preparing Nano for being added to a Guarded host?
1. Copy NanoServerImageGenerator to local system
2. Run Powershell
3. Navigate to the folder where NanoServerImageGenerator lives
4. Import-Module .\NanoServerImageGenerator
5. Create Media Path
6. Copy the required files to enable Nano to work with the Guarded Hosts.
116
What command should be run to create a shielded Nano Server VHDX?
New-NanoServerImage -MediaPath $MediaPath -TargetPath $NanoVHDPath -ComputerName $NanoName -OEMDrivers -Computer -DeploymentType Host -Edition Datacenter -Packages Microsoft-NanoServer-SecureStartup-Package,Microsoft-NanoServer-ShieldedVM-Package -EnableRemoteManagementPort -CopyFiles $FIlesToCopy -SetupCompleteCommands @("Powershell.exe -noninteractive -executionpolicy bypass -file C:\PrepareNanoTP5.ps1) -Domain $Domain
117
What NanoServer Packages are required for Nano Server VMs to become shielded?
Microsoft-NanoServer-SecureStartup-Package
| Microsoft-NanoServer-ShieldedVM-Package
118
How do you configure a physical server to boot to the NanoServer VHDX?
1. Mount the generated VHDx
2. Run bcdboot $VHDXDriveLetter\Windows
3. Unmount VHDX
4. Restart Computer
119
What are the requirements for encrypted or shielded VMs?
- VM must use GPT Disks (pre-req for Gen 2 VMs and UEFI)
- Basic Disks must be used (BitLocker doesn't support Dynamic Disks)
- Disks must have a least 2 partitions: Windows OS Secured with BitLocker and the unencrypted bootloader
- NTFS
- Guest OS must support Gen 2 VMs and Secure Boot
- OS must be generalized via Sysprep
- VMs must be running Server 2016 Enterprise Edition
120
Can you attach a debugger to a Generation 2 VM via a virtual COM port?
No. The ability to attach a debugger is disabled and cannot be enabled for Generation 2 VMs
121
How do you prepare a VM for shielding?
- Export HGS configuration locally
- Stop the VM
- Create a new Key Protector
- Ensure vTPM is enabled
122
How do you export the HGS configuration for a shielded VM creation?
Invoke-WebRequest Http://$HgsHost/KeyProtection/service/metadata/2014-07/metadata.xml -Outfile $FilePath
123
How do you create a new KeyProtector for a shielded VM?
$KP = New-HgsKeyProtector -Owner $Owner -Guardian $Guardian -AllowUntrustedBoot
Set-KeyProtector -VMName $VM -KeyProtector $KP.RawData
Set-VMSecurityPolicy -VMName $VMName -Shielded $True
124
How do you enable the vTPM on a VM using Powershell?
Enable-VMTPM -VMName $VM
125
When troubleshooting the shielded or encryption supported VMs, what should be checked first?
- Ensure the HGS is available and that the VMs are running on a healthy Hyper-V Host
- Make sure VMs are all Gen 2
126
How would you access a locked shielded VM that you cannot connect to?
Try one of the following
- Disable the shielded data security profile
- Copy the VM VHDX file to a secure host, create a new Gen 2 VM based on the VHDX and use the BitLocker Recovery Key to access the VM
127
What is the process of disabling the Shielding Data Security Profile?
1. Export the VM from the guarded host
2. Import the VM into Hyper-V
3. Powershell: Set-VMSecurityProfile -VMName $VM -ShieldingRequested $false
4. Hyper V \ Open VM Settings \ Security \ Security Profile \ Set "Shielded" to "No Additional Protection"
128
How do you determine if a VM is shielded?
Get-VMSecurity -VMName $VM | Select-Object ShieldedRequested,Shielded
129
How do you determine if a VM has a vTPM enabled?
Get-VMSecurity -VMName $VM | Select-Object TpmEnabled
130
What does the error "An error occured while attempting to start the selected virtual machine(s): could not initialize. The Virtual Machine cannot start because isolated user mode is off" mean?
The VM has moved from its Host Guardian and should be moved back to another HGS server with the proper configuration.
NOTE: This shows in VMM as "Error 12700 VMM cannot complete the host configuration"
131
You try to generate new HGS Keys using "New-HgsKeyProtector" and receive the following error. What do you do?
"New-HgsKeyProtector: A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider"
- Self Signed certificates are being used as the guardian keys
- Use the parameter -AllowUntrustedRoot with the New-HgsKeyProtector command to allow self signed certificates.
