Host Guardian Service (HGS) is a Windows Server role that protects virtual machines from being tampered with or read by people who should not have access. HGS works by making sure that any Hyper-V host trying to run a sensitive virtual machine proves it is trustworthy before the VM is allowed to start. This process of proving trustworthiness is called attestation. When a host passes attestation, it can run shielded VMs, which are virtual machines whose disks and memory are encrypted and cannot be inspected or modified by the host administrator or any malicious software.
A guarded fabric is the combination of HGS servers and Hyper-V hosts that work together to run shielded VMs securely. Setting up a guarded fabric requires deploying HGS clusters and connecting Hyper-V hosts to them. HGS supports two attestation modes: TPM-baseline mode checks that the host hardware matches a known good baseline configuration, while TPM-attestation mode uses the Trusted Platform Module chip to verify the exact identity and configuration of each host. Administrators configure key protection policies to manage the encryption keys that shield the VMs, and they register each Hyper-V host with HGS so the host can request attestation before launching any protected VM.
Azure uses several layers of protection to keep VMs secure. The Azure Fabric Controller manages all the physical servers and VM communications within Azure, and it only allows traffic to flow from hosts to VMs in one direction, which prevents attackers from using VMs to compromise the underlying infrastructure. Azure also uses smart VM placement to make sure that VMs owned by different customers do not end up on the same physical host if one of them might be controlled by an attacker. Memory and process separation is enforced by the hypervisor, and network traffic is kept isolated using VLANs that divide the network into separate segments for customer VMs, trusted fabric controllers, and network infrastructure devices.
When deploying shielded VMs, administrators set up attestation policies that define what requirements a Hyper-V host must meet before it can run the VM. These policies are checked regularly through continuous attestation to ensure hosts remain compliant. Azure provides built-in tools including PowerShell, the Azure CLI, and ARM templates to create and deploy shielded VMs. The benefits include continuous integrity monitoring through attestation, secure boot that ensures the VM starts with trusted software, and a virtual TPM that provides hardware-level security for the VM. Shielded VMs also integrate with Microsoft Defender for Cloud to monitor for threats and send alerts when something suspicious happens.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
Host Guardian Service (HGS) is a Windows Server role that protects virtual machines by verifying that a Hyper-V host is trustworthy through attestation before permitting a VM to start. Once a host passes attestation, HGS allows it to run shielded virtual machines with encrypted disks and memory that prevent host administrators and malicious software from inspecting or tampering with them.
TPM-baseline mode checks that the host hardware matches a known good baseline configuration, whereas TPM-attestation mode uses the Trusted Platform Module (TPM) chip to verify the exact identity and configuration of each individual host.
Shielded virtual machines provide fully encrypted disks and memory, preventing unauthorized access or tampering by host administrators and malicious software. They also include continuous integrity monitoring through attestation, secure boot to guarantee startup with trusted software, a virtual TPM for hardware-level security, and integration with Microsoft Defender for Cloud to monitor threats and generate alerts.
StudyCerts
StudyCerts