Hyper V

How to Import and Export TPM-enabled or Shielded Hyper-V VM certificates with PowerShell

TPM requirement, which is an awesome security feature, was added to Windows 11. on the host, it is managed by the OS and UEFI, but when you create a Virtual Machine (VM) that runs an OS like Windows 11, you have to know how to manage it properly so that your VM will stay secure everywhere and you will maintain your access to your VM even if you import/export it to a different Hyper-V host or reinstall your host OS.

Here is a screenshot of my Hyper-V VM on Windows 11 with the following security features enabled:

1. Secure Boot
2. Trusted Platform Module (TPM)
3. Encrypt State and VM migration traffic
4. Shielding (this enables all of the security features above Plus more)

When a VM uses TPM or Shielding, Windows creates 2 certificates in the Local Machine Certificate Store => Shielded VM Local Certificates => Certificates

One of them is for encryption and the other one is for signing. they both contain private keys. if these 2 certificates don't exist in that folder in the Local Machine Certificate store of a Hyper-V host, your VM won't be able to start, which is great because that prevents unauthorized users from accessing your data.

What you need to do is to export those 2 certificates (with private keys) and store them in a safe place (such as OneDrive's personal Vault), then delete those 2 certificates, and then import them without private keys.

you can do all of that using the user interface, but here I'm going to show how to do it using PowerShell:

# export Host Guardian service certificates with private keys and all the extended properties

$password = ConvertTo-SecureString -String "hotcakex" -Force -AsPlainText
Get-ChildItem -Path "cert:\LocalMachine\Shielded VM Local Certificates\" | Export-PfxCertificate -FilePath "C:\Users\Admin\OneDrive\Desktop\GuardedHostCertificates.pfx" -Password $password -CryptoAlgorithmOption AES256_SHA256


# Import the certificate with private keys NOT exportable

Import-PfxCertificate -FilePath "C:\Users\Admin\OneDrive\Desktop\GuardedHostCertificates.pfx" -CertStoreLocation 'Cert:\LocalMachine\Shielded VM Local Certificates' -Password $password

Obviously, you should change the FilePath and password according to your own needs and environment.

• You can find more info about those commands here:

  • Import-PfxCertificate
  • Export-PfxCertificate

Note that this configuration is for standalone systems. an actual shielded virtual machine is a lot more secure because the host's security and health is properly attested in a Guarded Fabric, using Host Guardian Service (HGS) on a Windows Server.

• Here is an official video about the feature and how it protects your VMs:

  • https://www.youtube.com/watch?v=Vp5E1-4Ks8E

  • Microsoft Mechanics