Solve Host Guardian Service attestation problems related to hypervisor code integrity

Q. I am trying to attest with a Host Guardian Server and it is failing because hypervisor code integrity is not enabled, what can I do?

A. You can perform a test of your Hyper-V host and its readiness to attestation to enable the use of Shielded VMs using the following commands:

#Verify on the guarded hostGet-HgsTrace -RunDiagnostics#Attempt attestation on the guarded hostGet-HgsClientConfiguration 

Below is an example execution of a healthy environment (except I only have one HGS box and therefore no redundancy):

PS C:> Get-HgsTrace -RunDiagnosticsOverall Result: Warningsavdalhv07: WarningBest Practices: WarningResolves Service Hostname to Multiple Addresses: Warning>>> DNS server at 10.7.173.10 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.>>> DNS server at 10.7.173.11 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.Traces have been stored at "C:Usersadministrator.SAVILLTECHAppDataLocalTemp2HgsDiagnostics-20160820-093352".PS C:> Get-HgsClientConfiguration IsHostGuarded : TrueMode : HostGuardianServiceKeyProtectionServerUrl : http://hgs.savtechhgs.net/KeyProtectionAttestationServerUrl : http://hgs.savtechhgs.net/AttestationAttestationOperationMode : TpmAttestationStatus : PassedAttestationSubstatus : NoInformation

However if you receive errors related to Hyper-V Code Integrity not being enabled ensure Virtualization Based Security is enabled which can be viewed as follows and check the EnableVirtualizationBasedSecurity value which should be 1:

PS C:> Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlDeviceGuardRequireMicrosoftSignedBootChain : 1EnableVirtualizationBasedSecurity : 1Locked : 0RequirePlatformSecurityFeatures : 3PSPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceGuardPSParentPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPSChildName : DeviceGuardPSDrive : HKLMPSProvider : Microsoft.PowerShell.CoreRegistry

If it is not 1 you may have a local policy that is disabling hypervisor code integrity (by default no policy should be set and is not required however if a policy is set disabling the feature it will cause the problem).