Hyper-V Saved-State VM Migration Fails Due to Missing Encryption Keys

John Wilson 20 Reputation points
2026-09-12T01:29:32.3433333+00:00

Hi all,

We are migrating several Hyper-V virtual machines that were left in a Saved State to a new Hyper-V host. The VM configuration and saved-state files were copied successfully, but the new host cannot resume the VMs because it does not have the security or encryption keys used by the original host to protect the saved-state data.

The VMs can still be accessed from the original host, so the issue appears to be related specifically to the protected saved-state files and their associated host keys.

What is the supported way to export the required VM state encryption/security keys from the original Hyper-V host and import them on the new host so that the saved-state VMs can be resumed successfully? Are there any additional steps required to preserve the encryption context during the migration?

Thanks

Windows for business | Windows Server | Storage high availability | Virtualization and Hyper-V
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Harry Phan 30,960 Reputation points Independent Advisor
    2026-09-12T02:11:19.1533333+00:00

    Hello John,

    Hyper-V saved-state files are encrypted with host-specific keys that are not portable across servers. That’s why when you copy the VM configuration and saved-state files to a new host, the VM cannot resume-the encryption context is bound to the original host’s key material. Microsoft does not provide a supported mechanism to export or import those encryption keys between hosts. The saved-state is designed to be host-specific for security reasons, and there is no registry or PowerShell command that can transfer the encryption context.

    The supported way forward is to avoid migrating VMs in a saved state. You need to resume the VM on the original host, shut it down cleanly, and then perform an export/import or use Hyper-V Replica/Live Migration to move it to the new host. Once the VM is shut down, the configuration and VHDX files can be moved without dependency on host-specific encryption keys. If you attempt to move saved-state files directly, they will remain unusable on the target host.

    In short: there is no supported method to export the encryption keys from one Hyper-V host and import them into another. The only supported migration path is to resume and shut down the VM on the source host, then migrate it. If the original host is still accessible, that’s the safest and most reliable approach. If the host is permanently unavailable, the saved-state cannot be recovered, and you’ll need to restore from backups or rely on the VM’s disk files.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    HP.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-12T01:29:49.9333333+00:00

    The supported approach depends on what is protecting the VM state:

    1. If the VM is vTPM-enabled or shielded
      • Export the shielding or key protector certificates from the source host.
      • Import those certificates on the destination host.
      • The documented tools are certmgr.msc and the PowerShell cmdlets Export-PfxCertificate and Import-PfxCertificate.
      • If the VM still cannot start after moving to the new host, update the Key Protector for that VM to authorize the new host to run it.
    2. If the VM was protected with a key protector / key storage drive model
      • The VM can start only on a host that is authorized by the VM’s Key Protector, or on a host that has the private key from one of the VM’s guardians.
      • For Generation 1 VMs using a key storage drive, the key protector and the encrypted key storage drive contents are stored as part of the VM’s runtime state.
    3. If the goal is specifically to resume a copied saved state on another host
      • Saved-state data can be encrypted, and a new host may be unable to read it without the required protection material.
      • For vTPM-protected migration failures such as “The key protector for the virtual machine could not be unwrapped.”, export/import the relevant certificates from source to destination.
      • If the saved state itself cannot be restored, the supported recovery step is to delete the saved state and start the VM normally:
        • In Hyper-V Manager: select the VM, then Delete Saved State.
        • If required, manually remove the .bin and .vsv files from the VM folder. This is destructive to the suspended state and discards in-memory state.
    4. Additional migration requirement
      • A VM with vTPM enabled can be migrated to another supported host, but it might not start there until the Key Protector is updated to authorize that host.
      • For shielded VMs, the same rule applies: local operation can work without Host Guardian Service, but after moving to another host, the VM might not start until the Key Protector is updated.

    If the objective is to preserve and resume the exact saved state, the required protection material must be transferred by exporting/importing the relevant certificates and ensuring the destination host is authorized by the VM’s key protector. If that authorization or certificate chain cannot be restored, the supported fallback is to discard the saved state and boot the VM from disk.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.