In Windows Server 2016 Microsoft introduced a new protection for Windows virtual machines shielded v
M's utilized a host Guardian service to protect virtual machines from each other and even from admins
on the host machine.
That last one is important for two reasons.
First in a multi tenant environment it may not be up to the hosts server admin to look after the guest
machines someone running a hosting service may offer space on high power servers and various clients
would place their virtual servers on that hardware.
In this case the host machine shouldn't have rights over the guest machine.
The second reason has more to do with potential breaches in the form of someone accessing the host machine
if a hack or exploit gains remote administrative rights to a hyper v host.
The host Guardian service keeps the guest machines secure all of this was included in Windows Server
2016 but only for Windows workstations and servers as the guest v Ms sense Windows Server 2016 was released.
We've seen several moves from Microsoft that have more completely integrated Linux solutions into Windows
networks Windows Server 20 19 carries that growth into the shielded VM feature the host Guardian service
can now protect Linux virtual machines as well Ubuntu Red Hat Enterprise and Sousse enterprise servers
can be installed as type 2 virtual machines and take advantage of the host Guardian service a server
in the network configured as the host Guardian will maintain this security each time a shielded virtual
machine boots up the HD yes will verify the protected status and allow it to run behind the protected
shield but there is a potential risk with this arrangement one that has already been addressed in server
2019 if the host Guardian server is unavailable.
By default a virtual machine protected by this shield would be blocked from starting.
The alternative was to start the machine without protection at all but that erases the benefits of configuring
shielded VMs to begin with off line mode allows virtual machines that have run shielded VMS in the past
to boot up.
Even if the host Guardian service is not available they use the most recent security configurations
and so have the same protections they had the last time that they booted there may be some who write
this improvement off as unimportant because their windows network is Windows only.
I would remind you that not too many years ago we didn't think we would be integrating Android and Apple
phones into our windows networks.
But today many of us do.
Things change.
Microsoft has taken steps to make sure that hyper v will grow with you as they do.