Host guardian service attestation issue after update

Question

Host guardian service attestation issue after update

Ahmad Ibrahim 60

Has anyone encountered this behavior when applying a Windows Server cumulative update to a Hyper‑V host, where:

Host Guardian Service (HGS) begins rejecting host attestation attempts.

Shielded VMs automatically power down.

Communication between host and HGS appears intact, but attestation fails after the update.

Is there a recommended way to refresh or update the host baseline measurements in HGS so that attestation succeeds again ?

0 comments

2 answers

Your answer

Answer 1

Hello Ahmad Ibrahim,

What you’re seeing after applying the cumulative update is a common scenario where the host’s baseline measurements no longer match what HGS expects, causing attestation to fail and shielded VMs to shut down.

The recommended way to resolve this is to refresh the host attestation baseline in HGS. You can do this by re-running the Initialize-HgsAttestation cmdlet on the host, or by updating the attestation policies in HGS with new TPM baseline measurements. In practice, this means capturing the updated host configuration and re-registering it with HGS so that the trust relationship is restored. If you are using TPM-based attestation, ensure that the new PCR values are collected and imported into HGS. For key-based attestation, verify that the host key remains valid and re-register if necessary.

After updating the baseline, restart the Host Guardian Service and confirm that attestation succeeds by checking the event logs. It’s also a good idea to test with a non-production shielded VM first to validate that the process works as expected before applying it across the farm.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason

Answer 2

Yes. After a cumulative update, attestation can fail if HGS policy behavior changed and the updated hosts and HGS nodes are no longer aligned.

Recommended path:

Update all Hyper-V hosts first, then HGS nodes. This order is strongly recommended so hosts provide the information required by HGS attestation policies.
After all hosts and all HGS nodes are updated, activate changed HGS attestation policies by exporting and importing HGS state on any HGS node:

$password = Read-Host -AsSecureString -Prompt "Enter a temporary password"
Export-HgsServerState -Path .\temporaryExport.xml -Password $password
Import-HgsServerState -Path .\temporaryExport.xml -Password $password

If a new policy was introduced, enable it explicitly:

Get-HgsAttestationPolicy
Enable-HgsAttestationPolicy -Name <Hgs_NewPolicyName>

If the issue is specifically around memory dump encryption policies or missing default dump policies/cmdlets, install the latest cumulative update on HGS, update Hyper-V hosts to the same cumulative update, and then activate the new attestation policies. Hosts that do not have the new dump encryption capabilities can fail attestation once that HGS policy is activated.
Validate host attestation status on the Hyper-V host:
- Check Get-HgsClientConfiguration for the AttestationStatus.
- If needed, reapply HGS URLs with Set-HgsClientConfiguration using the URLs from Get-HgsServer.
- Run:

Get-HgsTrace -RunDiagnostics -Detailed

If status shows Expired, ensure host and HGS time are synchronized. If HGS time drift affected the attestation signer certificate, refresh it on an HGS node:

Start-ScheduledTask -TaskPath \Microsoft\Windows\HGSServer -TaskName AttestationSignerCertRenewalTask

This is the supported way to refresh HGS policy/baseline handling after updates. The key step is not manually rewriting host measurements, but updating all systems in the correct order and then activating changed attestation policies by exporting/importing HGS state.

Because shielded VMs can power down when attestation fails, test changes in a nonproduction environment and maintain backups before applying them broadly.

References: