Shielded VMs, or Shielded Virtual Machines, are a security feature introduced in Windows Server 2016 for protecting Hyper-V Generation 2 virtual machines (VMs) from unauthorized access or tampering.
Hyper-V Shielded VMs are protected through a combination of Secure Boot, BitLocker encryption, Virtual Trusted Platform Module (TPM) and the Host Guardian Service.
How Hyper-V Shielded VMs Work
Shielded VMs boot from a virtual Unified Extensible Firmware Interface (UEFI) as opposed to a traditional BIOS, providing Secure Boot protection and enabling BitLocker disk encryption inside the VM’s virtual disks. The BitLocker encryption handles protecting the data both at rest and when being transmitted across the network during Live Migrations.
The Host Guardian Service, a new role in Windows Server 2016, enables shielded virtual machines, protecting them from unauthorized access by Hyper-V host administrators. As a result, any administrator without full rights to a Shielded VM will be able to power it on or off, but they won’t be able to alter its settings or view the contents of the VM in any way.
Shielded VMs require Windows Server 2012 or Windows 8 or later, and they will not run unless the Hyper-V host is on the Host Guardian Service. New Shielded Virtual Machines can be created within the Azure Pack management portal, and existing VMs can be converted to shielded VMs.
