7.7 Integration Services, Guest Components & Time Synchronization
Key Takeaways
- Hyper-V exposes six integration services per VM: Guest Service Interface, Heartbeat, Key-Value Pair Exchange, Shutdown, Time Synchronization, and VSS.
- Guest Service Interface is the only integration service disabled by default; `Copy-VMFile` fails until it is enabled with `Enable-VMIntegrationService`.
- Disable Time Synchronization on virtualized domain controllers so the AD DS time hierarchy governs, and point the forest-root PDC Emulator at an external NTP source.
- Windows Server 2016 and later hosts still resynchronize a guest clock at VM start and after a checkpoint restore, even when Time Synchronization is disabled.
- Windows Server 2012 and later guests have built-in integration services that are serviced through Windows Update; current Windows Server 2025 hosts do not provide the legacy integration-services setup disk.
Integration Services, Guest Components & Time Synchronization
Every Hyper-V guest runs a set of integration services (also called integration components, or ICs) — paravirtualized drivers and service endpoints that let the guest cooperate with the host over the VMBus instead of pretending to be physical hardware. Microsoft calls these out as their own objective ("Configure integration services"), and exam items lean on two facts candidates routinely miss: Guest Services is off by default, and Time Synchronization is the one you deliberately turn off on domain controllers.
1. The Six Integration Services
Each service is independently toggleable per virtual machine. The names below are the exact strings the PowerShell cmdlets accept.
Service (-Name value) | What it does | Default | Fails how, if disabled |
|---|---|---|---|
| Guest Service Interface | Enables host-to-guest file copy over VMBus (Copy-VMFile) | Disabled | Copy-VMFile fails even though the VM is healthy and running |
| Heartbeat | Guest periodically reports "I am alive" to the host | Enabled | Get-VM shows no heartbeat; clustering cannot detect a hung guest |
| Key-Value Pair Exchange | Two-way registry-based data channel (KVP); how the host learns the guest's IP addresses, OS build and FQDN | Enabled | Get-VMNetworkAdapter shows blank IPAddresses; WAC/Hyper-V Manager cannot show guest OS details |
| Shutdown | Host can gracefully shut the guest down (Stop-VM without -TurnOff) | Enabled | Stop-VM can only hard power off, risking dirty shutdowns |
| Time Synchronization | Host pushes its clock into the guest | Enabled | Guest clock drifts unless another time source (domain hierarchy or NTP) governs it |
| VSS (listed as Backup (volume checkpoint)) | Host-initiated Volume Shadow Copy Service freeze for application-consistent backups and production checkpoints | Enabled | Production checkpoints silently fall back to crash-consistent, or fail if fallback is turned off |
+-----------------------------------------------------------------------------------------+
| INTEGRATION SERVICES OVER THE VMBus |
| |
| [ROOT PARTITION / HOST] [CHILD PARTITION / GUEST] |
| +---------------------------------+ +----------------------------+ |
| | Virtual Machine Management Svc | | Hyper-V Guest Shutdown Svc | |
| | (vmms.exe) + VM Worker Process | | Hyper-V Heartbeat Svc | |
| | | <== VMBus ==> | Hyper-V Data Exchange Svc | |
| | Virtualization Service | (no emulated | Hyper-V Time Sync Svc | |
| | Providers (VSPs) | hardware) | Hyper-V Volume Shadow Copy | |
| | | | Hyper-V Guest Svc Interface| |
| +---------------------------------+ +----------------------------+ |
| (Virtualization Service |
| Clients / VSCs) |
+-----------------------------------------------------------------------------------------+
2. Managing Integration Services with PowerShell
# Inspect every integration service and its live health on one VM
Get-VMIntegrationService -VMName "VM-APP-01" |
Format-Table Name, Enabled, PrimaryStatusDescription, SecondaryStatusDescription
# Enable Guest Services so Copy-VMFile works (disabled by default)
Enable-VMIntegrationService -VMName "VM-APP-01" -Name "Guest Service Interface"
# Copy a file from host to guest with no network path required
Copy-VMFile -VMName "VM-APP-01" `
-SourcePath "C:\Payload\agent.msi" `
-DestinationPath "C:\Temp\agent.msi" `
-CreateFullPath -FileSource Host
# Disable host time push on a virtualized domain controller
Disable-VMIntegrationService -VMName "DC-01" -Name "Time Synchronization"
# Enable the same service across an entire fleet
Get-VM | Enable-VMIntegrationService -Name "Guest Service Interface"
Read the PrimaryStatusDescription column, not just Enabled. Enabled = True with a status of "Protocol version mismatch" or "The virtual machine is not running" means the service is switched on but is not actually functioning — a mismatch almost always means the guest's integration components are older than the host's.
3. Time Synchronization and the Domain Controller Trap
The Hyper-V time provider is a stratum-adjacent authority: it feeds the host's clock straight into the guest. That is exactly what you want on a member server and exactly what you do not want on a domain controller, because AD DS runs its own time hierarchy and Kerberos rejects tickets whose timestamps skew beyond the (default) five-minute tolerance.
The standard design is:
- The PDC Emulator in the forest root domain is the authoritative time source for the whole forest and should sync to an external NTP source, not to its Hyper-V host.
- Guest domain controllers should have Time Synchronization cleared so the AD time hierarchy — not the hypervisor — governs their clocks.
- Everything else (member servers, workstations) inherits time from the domain hierarchy via W32Time.
[!IMPORTANT] Even with Time Synchronization disabled, Windows Server 2016 and later hosts still resynchronize a guest's clock at VM start and after a checkpoint is restored. This is why reverting a domain controller to a checkpoint can produce time-skew symptoms alongside the safe-restore and non-authoritative resynchronization behavior covered in section 7.5 — and it is another reason checkpoints are not a backup strategy for DCs.
4. Keeping Integration Components Current
| Guest generation | How ICs are delivered |
|---|---|
| Windows Server 2012 and later guests | Integration services are built in; keep them current with important Windows updates. Current Hyper-V hosts do not ship an integration-services setup disk |
| Windows Server 2008 and 2008 R2 guests | Install all critical Windows updates in the guest. The setup-disk workflow belongs to Hyper-V hosts older than Windows Server 2016, not to a current Windows Server 2025 host |
| Modern Linux guests | Linux Integration Services (LIS) are built into the upstream kernel; only older RHEL/CentOS builds need the separate LIS download |
| FreeBSD guests | BIS (BSD Integration Services) shipped in-kernel from FreeBSD 10 onward |
A version mismatch is not cosmetic. On a current host, first verify the guest service is running, install important updates inside the Windows guest, restart it, and recheck both IntegrationServicesVersion and the affected service status. Out-of-date ICs can cause degraded network throughput, missing KVP data, and production checkpoints that will not take.
5. Fast Reference: Symptom → Integration Service
| Symptom reported in a scenario | Integration service to check |
|---|---|
Copy-VMFile returns "the operation failed" on a running VM | Guest Service Interface (disabled by default) |
| Hyper-V Manager shows blank IP address / OS name for a guest | Key-Value Pair Exchange |
Stop-VM only powers off instead of shutting down cleanly | Shutdown |
| Backup product produces crash-consistent images of a SQL guest | VSS |
| Cluster does not fail over a hung but powered-on VM | Heartbeat |
| Domain controller's clock is being dragged off the AD hierarchy | Time Synchronization (disable it) |
An administrator runs Copy-VMFile -VMName "VM-APP-01" -SourcePath C:\Payload\agent.msi -DestinationPath C:\Temp\agent.msi -FileSource Host against a healthy, running Windows Server 2025 guest and the command fails. The VM has a heartbeat, reports its IP address in Hyper-V Manager, and shuts down gracefully with Stop-VM. What is the most likely cause?
A virtualized domain controller that holds the PDC Emulator role in the forest root domain is drifting away from the organization's authoritative time. The DC runs as a Hyper-V guest with default integration service settings. Which configuration follows Microsoft guidance?
A Windows Server 2012 R2 guest running on a Windows Server 2025 Hyper-V host shows Enabled: True for VSS, but Get-VMIntegrationService reports a primary status of "Protocol version mismatch" and backups are only crash-consistent. What should the administrator do first?