Solve Host Guardian Service attestation problems related to hypervisor code integrity

Solve attestation problems related to hypervisor code integrity.

John Savill

September 2, 2016

2 Min Read
Solve Host Guardian Service attestation problems related to hypervisor code integrity

Q. I am trying to attest with a Host Guardian Server and it is failing because hypervisor code integrity is not enabled, what can I do?

A. You can perform a test of your Hyper-V host and its readiness to attestation to enable the use of Shielded VMs using the following commands:

#Verify on the guarded hostGet-HgsTrace -RunDiagnostics#Attempt attestation on the guarded hostGet-HgsClientConfiguration 

Below is an example execution of a healthy environment (except I only have one HGS box and therefore no redundancy):

PS C:> Get-HgsTrace -RunDiagnosticsOverall Result: Warningsavdalhv07: WarningBest Practices: WarningResolves Service Hostname to Multiple Addresses: Warning>>> DNS server at 10.7.173.10 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.>>> DNS server at 10.7.173.11 cannot resolve "hgs.savtechhgs.net" to multiple IP>>> addresses. The recommended configuration is to have multiple HGS servers>>> available at "hgs.savtechhgs.net" for high availability.Traces have been stored at "C:Usersadministrator.SAVILLTECHAppDataLocalTemp2HgsDiagnostics-20160820-093352".PS C:> Get-HgsClientConfiguration IsHostGuarded : TrueMode : HostGuardianServiceKeyProtectionServerUrl : http://hgs.savtechhgs.net/KeyProtectionAttestationServerUrl : http://hgs.savtechhgs.net/AttestationAttestationOperationMode : TpmAttestationStatus : PassedAttestationSubstatus : NoInformation

However if you receive errors related to Hyper-V Code Integrity not being enabled ensure Virtualization Based Security is enabled which can be viewed as follows and check the EnableVirtualizationBasedSecurity value which should be 1:

PS C:> Get-ItemProperty HKLM:SYSTEMCurrentControlSetControlDeviceGuardRequireMicrosoftSignedBootChain : 1EnableVirtualizationBasedSecurity : 1Locked : 0RequirePlatformSecurityFeatures : 3PSPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceGuardPSParentPath : Microsoft.PowerShell.CoreRegistry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPSChildName : DeviceGuardPSDrive : HKLMPSProvider : Microsoft.PowerShell.CoreRegistry

If it is not 1 you may have a local policy that is disabling hypervisor code integrity (by default no policy should be set and is not required however if a policy is set disabling the feature it will cause the problem).

  1. Open gpedit.msc

  2. Navigate to Computer Configuration - Administrative Templates - System - Device Guard

  3. Double click Turn on Virtualization Based Security

  4. Ensure the Virtualization Based Protection of Code Integrity is set to Enabled without lock (the Credential Guard Configuration is optional but recommended) and click OK

  5. This should ensure the Hypervisor code integrity is enabled

About the Author

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like