Switch the guardian mode for a 2016 Hyper-V box.

Q. How can I switch the mode of a Hyper-V server between local guardians and a Host Guardian Server?

A. To configured a Hyper-V server to use a Host Guardian Server (HGS) for attestation and key protection the URL of those services are specified for the HGS client configuration. For example:

Set-HgsClientConfiguration -AttestationServerUrl 'http://hgs.savtechhgs.net/Attestation' `-KeyProtectionServerUrl 'http://hgs.savtechhgs.net/KeyProtection'Get-HgsClientConfiguration

To set a Hyper-V server back to use local guardians use:

Set-HgsClientConfiguration -EnableLocalMode

Once you make this change VMs that are shielded and use the HGS will not start unless the local guardian for the key protector exists on the machines local certificate store. To switch a server back to using HGS simply run the first command again specifying the attestation and key protection URLs.