Solve Host Guardian Service attestation problems related to hypervisor code integrity
Solve attestation problems related to hypervisor code integrity.
September 2, 2016
![Solve Host Guardian Service attestation problems related to hypervisor code integrity Solve Host Guardian Service attestation problems related to hypervisor code integrity](https://eu-images.contentstack.com/v3/assets/blt07f68461ccd75245/blt2c089a15ef676be2/661810d89079a9263daa357e/vatican-1473044960720_0_2.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Q. I am trying to attest with a Host Guardian Server and it is failing because hypervisor code integrity is not enabled, what can I do?
A. You can perform a test of your Hyper-V host and its readiness to attestation to enable the use of Shielded VMs using the following commands:
#Verify on the guarded hostGet-HgsTrace -RunDiagnostics#Attempt attestation on the guarded hostGet-HgsClientConfiguration
Below is an example execution of a healthy environment (except I only have one HGS box and therefore no redundancy):
PS C:> Get-HgsTrace -RunDiagnosticsOverall Result: Warningsavdalhv07: WarningBest Practices: WarningResolves Service Hostname to Multiple Addresses: Warning>>> DNS server at 10.7.173.10 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.>>> DNS server at 10.7.173.11 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.Traces have been stored at "C:Usersadministrator.SAVILLTECHAppDataLocalTemp2HgsDiagnostics-20160820-093352".PS C:> Get-HgsClientConfiguration IsHostGuarded : TrueMode : HostGuardianServiceKeyProtectionServerUrl : http://hgs.savtechhgs.net/KeyProtectionAttestationServerUrl : http://hgs.savtechhgs.net/AttestationAttestationOperationMode : TpmAttestationStatus : PassedAttestationSubstatus : NoInformation
However if you receive errors related to Hyper-V Code Integrity not being enabled ensure Virtualization Based Security is enabled which can be viewed as follows and check the EnableVirtualizationBasedSecurity value which should be 1:
PS C:> Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlDeviceGuardRequireMicrosoftSignedBootChain : 1EnableVirtualizationBasedSecurity : 1Locked : 0RequirePlatformSecurityFeatures : 3PSPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceGuardPSParentPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPSChildName : DeviceGuardPSDrive : HKLMPSProvider : Microsoft.PowerShell.CoreRegistry
If it is not 1 you may have a local policy that is disabling hypervisor code integrity (by default no policy should be set and is not required however if a policy is set disabling the feature it will cause the problem).
Open gpedit.msc
Navigate to Computer Configuration - Administrative Templates - System - Device Guard
Double click Turn on Virtualization Based Security
Ensure the Virtualization Based Protection of Code Integrity is set to Enabled without lock (the Credential Guard Configuration is optional but recommended) and click OK
This should ensure the Hypervisor code integrity is enabled
About the Author
You May Also Like