{"id":2010,"date":"2018-02-09T15:43:02","date_gmt":"2018-02-09T20:43:02","guid":{"rendered":"http:\/\/www.wildow.com\/blog\/?p=2010"},"modified":"2018-02-09T15:43:02","modified_gmt":"2018-02-09T20:43:02","slug":"how-to-encrypt-your-hyper-v-guest-vms-using-the-gui","status":"publish","type":"post","link":"https:\/\/wildow.com\/?p=2010","title":{"rendered":"How to Encrypt your Hyper-V Guest VM\u2019s using the GUI"},"content":{"rendered":"
\n

How to Encrypt your Hyper-V Guest VM\u2019s using the GUI<\/a><\/h1>\n<\/header>\n
by Alex\u00a0<\/a><\/span>\u00a0\u00a027. July 2017\u00a0<\/span>\u00a0\u00a0Technical<\/a>\u00a0<\/span>\u00a0\u00a00<\/span><\/div>\n
<\/div>\n
From ITProMentor<\/div>\n
<\/div>\n
\n

Encrypting guest virtual machines is another layer of protection you can add in Hyper-V. Why would an admin want to do this? Because while encrypting the Hyper-V Host itself\u00a0can protect against stolen\u00a0physical<\/em>disks, enabling BitLocker inside your virtual machines protects\u00a0against\u00a0stolen\u00a0virtual<\/em>\u00a0disks as well (e.g. if an attacker were to gain access to an online Hyper-V host and export the VHDX files).<\/p>\n

As I mentioned in my previous post, I wouldn\u2019t recommend this option\u00a0unless you have Windows Server 2016. The reason is, Hyper-V in Windows Server 2016 is the first time we\u2019ve\u00a0been able to\u00a0enable a\u00a0virtual<\/em>TPM (vTPM) in guest virtual machines. In earlier versions, admins who wanted to encrypt their guest virtual machines had a couple of workarounds, and there were problems with each of them.<\/p>\n

2012 R2 Work-Around #1: Require a startup password \/ PIN<\/strong><\/h4>\n

Nothing inherently wrong with this I suppose, but it means that every reboot (due to updates or otherwise) would require someone to key in the password, or suspend BitLocker and then reboot. If this process were scripted, as I\u2019ve seen in a few cases, it can really put a damper on the protections BitLocker has to offer.<\/p>\n

Most people don\u2019t realize this, but when the Windows OS is booted, BitLocker is essentially off and the data on your disk is fully accessible. BitLocker is an encryption technology meant to protect against loss\/theft, and it makes it difficult or practically impossible for someone to boot the device with an alternate OS (Linux, etc.) and read\/copy the data from the disk.<\/p>\n

Therefore, by\u00a0suspending<\/em>\u00a0BitLocker, the next reboot would occur without requiring a password, meaning that disks could be taken from the host server, and booted elsewhere, without that protection kicking in. So much for full disk encryption.<\/p>\n

So if you\u2019re going to enable a startup password, that\u2019s fine, just don\u2019t do that other thing (e.g. scripting automatic reboots w\/ suspension).<\/p>\n

2012 R2 Work-Around #2: Attach a floppy disk as VHD to be your startup key<\/strong><\/h4>\n

This method is even less secure. With BitLocker, a key \u00a0can be stored on a floppy or USB disk, which is then inserted in order to allow the computer to boot. Since you can permanently affix a VHD file to the virtual server, some people have done this to get around the need for entering a password each time. Again, terrible idea. The VHD for this key is not itself encrypted, so anyone with access to this system or the small VHD key file would pwn the virtual machine in pretty short order.<\/p>\n

How Windows Server 2016 Solves this with vTPM<\/strong><\/h3>\n

Enter Windows Server 2016. Open the Hyper-V Manager and check out the settings on any VM. There is a new\u00a0Security\u00a0<\/strong>option on the left menu of choices. \u00a0Here we can enable the virtual TPM chip.<\/p>\n

\"\"<\/p>\n

Note: this is available on Gen2 virtual machines only.<\/p>\n

If you enable it, then inside your VM, you will have access to the same protection that your host server enjoys, with a real TPM. \u00a0If you try to export the VHD\u00a0and run it somewhere else, it will do you no good without the corresponding BitLocker key. Similar to if you were to remove physical drives from a computer where the TPM chip resides. Check out the Device Manager, it looks just like a physical server\/computer:<\/p>\n

\"\"<\/p>\n

Cool, huh? \u00a0Now you can setup BitLocker in your virtual machines exactly the same way you do for your host server, or other physical computers.<\/p>\n

But what about Generation 1 virtual machines, for example VHD\u2019s that were imported from a previous version of Hyper-V such as 2008 R2 or 2012 R2?<\/p>\n

Using BitLocker in Generation 1 VM\u2019s<\/strong><\/h3>\n

If you open the settings of a VM that is Gen1, you will notice the Security area is\u00a0still there, but it looks a little bit different. No vTPM option, but we can \u201cAdd Key Storage Drive<\/strong>.\u201d While this technically isn\u2019t as secure as a vTPM, it does offer admins a way to encrypt the VM using BitLocker, with better protection than just attaching a VHD as a floppy disk (which as I mentioned is a terrible idea).<\/p>\n

\"\"<\/p>\n

Even though the key storage drive gets attached to the virtual controller as though it were a VHD, you will not find any references to it on the Hyper-V host with the rest of your VHD files. Nevertheless, inside the VM, you will be able to see the small disk become available in Disk Management.<\/p>\n

Note: Since this VM does not have a TPM, you will also need to enable the Group Policy we have\u00a0talked about before<\/a>, and then select the Key Storage Drive to store your key.<\/p>\n

If you\u2019d like to see a detailed write-up on configuring this from here on out, I\u2019ll refer you to\u00a0this article<\/a>, by Microsoft MVP Aidan Finn.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

How to Encrypt your Hyper-V Guest VM\u2019s using the GUI by Alex\u00a0\u00a0\u00a027. July 2017\u00a0\u00a0\u00a0Technical\u00a0\u00a0\u00a00 From ITProMentor Encrypting guest virtual machines is another layer of protection you can add in Hyper-V. Why would an admin want to do this? Because while … Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,4],"tags":[],"class_list":["post-2010","post","type-post","status-publish","format-standard","hentry","category-hyperv","category-windows"],"_links":{"self":[{"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/posts\/2010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wildow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2010"}],"version-history":[{"count":1,"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/posts\/2010\/revisions"}],"predecessor-version":[{"id":2011,"href":"https:\/\/wildow.com\/index.php?rest_route=\/wp\/v2\/posts\/2010\/revisions\/2011"}],"wp:attachment":[{"href":"https:\/\/wildow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wildow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wildow.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}