7.2 VM Generations, Secure Boot, vTPM, Enhanced Session Mode & Direct VM Access

VM Generations, Secure Boot, vTPM, Enhanced Session Mode & Direct VM Access

1. Generation 1 vs Generation 2 Virtual Machines

When creating a virtual machine in Hyper-V, administrators must select between Generation 1 and Generation 2 architectures. This decision is immutable; once a VM is created, its generation cannot be changed in-place.

+-----------------------------------------------------------------------------------------+
|                        GENERATION 1 VS GENERATION 2 ARCHITECTURE                        |
|                                                                                         |
|   [GENERATION 1 VM (Legacy)]                     [GENERATION 2 VM (Modern)]             |
|   +------------------------------------+         +------------------------------------+ |
|   | Firmware: Legacy BIOS              |         | Firmware: UEFI 2.3.1c+             | |
|   | Boot Partition: MBR (Max 2 TB)     |         | Boot Partition: GPT (Up to 64 TB)  | |
|   | Emulated Hardware:                 |         | Pure Synthetic Architecture:       | |
|   |  - Intel 440BX Motherboard Chipset |         |  - No Emulated Chipset / Motherbd  | |
|   |  - S3 Trio Video Controller        |         |  - Synthetic SCSI Boot Controller  | |
|   |  - Emulated IDE for Boot Disk      |         |  - Synthetic Network Adapter (PXE) | |
|   |  - Legacy DEC 21140 NIC for PXE    |         |  - Virtual TPM (vTPM 2.0) Support  | |
|   |  - PS/2 Keyboard & Mouse Ports     |         |  - Secure Boot (Windows & Linux)   | |
|   +------------------------------------+         +------------------------------------+ |
+-----------------------------------------------------------------------------------------+

Architectural Comparison Matrix

# Create a new Generation 2 virtual machine with a 60 GB dynamic VHDX
New-VM -Name "VM-SVR2025-01" `
       -Generation 2 `
       -MemoryStartupBytes 4GB `
       -NewVHDPath "D:\Hyper-V\Virtual Hard Disks\VM-SVR2025-01.vhdx" `
       -NewVHDSizeBytes 60GB `
       -SwitchName "vSwitch-External"

[!IMPORTANT] AZ-800 Exam Rule: Always deploy Generation 2 virtual machines unless you have an explicit dependency on a 32-bit legacy operating system, an ancient Linux kernel lacking UEFI drivers, or disk images partitioned strictly in MBR format.

---

2. Secure Boot, vTPM & BitLocker Inside Virtual Machines

Generation 2 virtual machines unlock hardware-rooted security capabilities that protect workloads against bootkits, rootkits, and host storage theft.

Secure Boot Architecture & Templates

Secure Boot validates the digital signature of each boot component (bootloader, operating system kernel, boot-time drivers) against trusted platform keys before execution.

Hyper-V provides specific Secure Boot Templates tailored for different guest operating systems:

1. Microsoft Windows Template: Default template. Contains certificates to validate Windows bootloaders (bootmgfw.efi) and Microsoft-signed kernel drivers.
2. Microsoft UEFI Certificate Authority Template: Tailored for modern Linux distributions (Ubuntu, Red Hat Enterprise Linux, SUSE, Rocky Linux). Validates Linux bootloaders (e.g., GRUB2 / shim) signed by the third-party Microsoft UEFI CA.
3. Open Source Shielded VM Template: Used for running Linux workloads inside Shielded VMs under Host Guardian Service.

# Verify Secure Boot configuration for a virtual machine
Get-VMFirmware -VMName "VM-LINUX-01"

# Configure Secure Boot for a Linux virtual machine
Set-VMFirmware -VMName "VM-LINUX-01" `
               -EnableSecureBoot $true `
               -SecureBootTemplate "MicrosoftUEFICertificateAuthority"

Virtual TPM (vTPM 2.0) and BitLocker Deployment

A Virtual TPM (vTPM) allows a Generation 2 VM to receive a virtualized, cryptographically isolated Trusted Platform Module 2.0 device without needing a dedicated physical TPM chip on the host for each guest VM.

# Step 1: Enable Key Storage Drive / Key Protector for the VM
# Generates a localized cryptographic key protector on the Hyper-V host
Set-VMKeyProtector -VMName "VM-SVR2025-01" -NewLocalKeyProtector

# Step 2: Enable Virtual TPM on the Generation 2 VM
Set-VMSecurity -VMName "VM-SVR2025-01" -VirtualTPMEnabled $true

# Step 3: Verify security settings
Get-VMSecurity -VMName "VM-SVR2025-01"

Once vTPM is enabled, administrators can log into the guest OS and enable BitLocker Drive Encryption on the operating system volume (C:) exactly like a physical server. BitLocker encrypts the virtual hard disk transparently, ensuring that even if the .vhdx file is stolen from host storage, the data cannot be read without the recovery key.

---

3. Enhanced Session Mode

Enhanced Session Mode upgrades the standard Hyper-V Virtual Machine Connection tool (vmconnect.exe) from a basic emulated video console to a rich, high-performance administrative experience.

+-----------------------------------------------------------------------------------------+
|                         ENHANCED SESSION MODE ARCHITECTURE                              |
|                                                                                         |
|   [ADMINISTRATIVE WORKSTATION / HOST]              [GUEST VIRTUAL MACHINE]              |
|   +---------------------------------+              +----------------------------------+ |
|   | VMConnect Client (vmconnect.exe)|              | Windows / Linux Guest OS         | |
|   |  - Dynamic Display Resizing     |              |  - Guest RDP Service Endpoint    | |
|   |  - Bidirectional Clipboard      |              |    (Listening internally)        | |
|   |  - Local Drive Redirection      |              |                                  | |
|   |  - Smart Card / Audio / USB     |              |                                  | |
|   +----------------+----------------+              +------------------+---------------+ |
|                    |                                                  |                 |
|                    +============== VMBus Transport ===================+                 |
|                         (NO Network Switch / NO TCP 3389 Required)                      |
+-----------------------------------------------------------------------------------------+

How Enhanced Session Mode Operates

• Uses Remote Desktop Protocol (RDP) channels, but transmits all traffic over the VMBus in-memory channel instead of a TCP/IP network connection.
• Zero Network Dependency: Operates even when the VM has no network adapter, is attached to a Private Virtual Switch, or is completely isolated behind host firewalls.
• Capabilities:
  • Dynamic display resolution resizing and multi-monitor support.
  • Full bidirectional clipboard redirection (copying text, graphics, and files between host and guest).
  • Local drive, printer, smart card, and USB device redirection.
  • Audio input/output redirection.

Configuration Requirements

Enhanced Session Mode must be enabled at both the server/host level and configured at the user client level:

# Enable Enhanced Session Mode at the Hyper-V host level
Set-VMHost -EnableEnhancedSessionMode $true

# Query host Enhanced Session Mode status
Get-VMHost | Select-Object EnableEnhancedSessionMode

[!TIP] Host OS Differences: On Windows 10/11 Client Hyper-V, Enhanced Session Mode is enabled by default. On Windows Server, Enhanced Session Mode is disabled by default at the host level and must be explicitly enabled using Set-VMHost -EnableEnhancedSessionMode $true.

---

4. Direct VM Management: PowerShell Direct & SSH Direct

Hyper-V provides out-of-band administrative connectivity into running virtual machines without relying on traditional network routing, DNS resolution, WinRM listeners over TCP 5985/5986, or exposed firewall ports.

+-----------------------------------------------------------------------------------------+
|                        POWERSHELL DIRECT & SSH DIRECT OVER VMBUS                        |
|                                                                                         |
|   [HYPER-V HOST (Root Partition)]                  [GUEST VM (Child Partition)]         |
|   +---------------------------------+              +----------------------------------+ |
|   | PowerShell Console / Terminal   |              | Guest OS (Windows / Linux)       | |
|   |                                 |              |                                  | |
|   | Enter-PSSession -VMName <VM>    |              | - Local Security Authority (LSA) | |
|   | Invoke-Command  -VMName <VM>    |              | - Windows PowerShell / Bash      | |
|   | Copy-VMFile     -VMName <VM>    |              | - Hyper-V Integration Services   | |
|   +----------------+----------------+              +------------------+---------------+ |
|                    |                                                  |                 |
|                    +============== VMBus Direct Socket ===============+                 |
|                         (Direct Inter-Process Hypervisor Channel)                       |
+-----------------------------------------------------------------------------------------+

PowerShell Direct for Windows Guests

PowerShell Direct establishes a secure remote session from the Hyper-V host directly into a Windows guest VM over VMBus sockets (AF_HYPERV).

Prerequisites:

1. The Hyper-V host must run Windows Server 2016+ or Windows 10+.
2. The guest VM must run Windows Server 2016+ or Windows 10+.
3. The VM must be running on the local Hyper-V host.
4. Valid administrative credentials for the guest operating system must be supplied.

# Interactive administrative session into a VM using PowerShell Direct
Enter-PSSession -VMName "VM-SVR2025-01" -Credential (Get-Credential)

# Execute one-off administrative script blocks inside the guest VM
Invoke-Command -VMName "VM-SVR2025-01" -Credential (Get-Credential) -ScriptBlock {
    Get-Service -Name w3svc, winrm
    Get-Volume -DriveLetter C
    New-Item -Path "C:\Setup" -ItemType Directory -Force
}

# Copy files directly from the host into the guest VM without network shares
Copy-VMFile -VMName "VM-SVR2025-01" `
            -SourcePath "C:\Installers\agent.msi" `
            -DestinationPath "C:\Setup\agent.msi" `
            -CreateFullPath `
            -FileSource Host

SSH Direct for Linux Guests

Starting with Windows Server 2019/2022 and modern Linux integration kernels, Hyper-V supports SSH Direct over Hyper-V sockets (AF_HYPERV / vsock), allowing SSH sessions into Linux guests using the VM's unique Hyper-V GUID without configuring IP networking.

# Query the VM GUID for SSH Direct targeting
$vmGuid = (Get-VM -Name "VM-LINUX-01").Id.Guid

# Connect to the Linux guest via SSH Direct over Hyper-V socket
ssh -p 22 -o HostKeyAlgorithms=+ssh-rsa root@$vmGuid