FilePublisher, which trusts the publishers of the files instead of the more restrictive
Hash option, which requires a policy update anytime a specific file changes. The code
that follows should be run on a Hyper-V host that has been provisioned with the
common configuration expected in the environment:
New-CIPolicy –Level FilePublisher –Fallback Hash –FilePath 'C:\HW1CodeIntegrity.xml' ConvertFrom-CIPolicy –XmlFilePath 'C:\HW1CodeIntegrity.xml'
–BinaryFilePath 'C:\HW1CodeIntegrity.p7b'
Copy the generated file to the HGS server and import as a policy:
Add-HgsAttestationCIPolicy -Path 'C:\HW1CodeIntegrity.p7b' `
-Name 'StdGuardHost'
The same file should be copied to each of the Hyper-V hosts and saved as
C:\Windows\System32\CodeIntegrity\SIPolicy.p7b, and then the hosts restarted to
make the policy take effect.
If using TPM attestation, on each type of server, you need to save the TPM base policy
and import to the HGS:
#Save the TPM base policy from the Hyper-V host
Get-HgsAttestationBaselinePolicy -Path 'C:\HWConfig1.tcglog'
#Copy the file to HGS and import
Add-HgsAttestationTpmPolicy –Path 'C:\HWConfig1.tcglog' –Name 'Dell TPM'
So far we have only a single HGS instance; however, because of its criticality, you
should always deploy at least three HGS instances in a physical cluster. The Microsoft
whitepaper walks through the details of adding HGS instances to the existing HGS
instance. This process is similar to creating the initial instance, except that the new
HGS instances will use the primary HGS for its DNS service, and when performing the
initialization of the HGS server, the IP address of the existing instance will be
specified via the HgsServerIPAddress parameter. Remember, if your HGS is not
available, shielded VMs and encrypted VMs will be unable to start as their vTPM
content cannot be accessed. Thus it’s critical to make HGS highly available.
The next step is to download the script at
https://gallery.technet.microsoft.com/Script-for-Setting-Up-f8bd7f7e and execute it
on every Hyper-V host that will be part of the guarded fabric. This script takes
ownership of the Device Guard registry key and configures it to leverage IOMMU,
which ensures the memory protection of shielded VMs. Hosts will need to be rebooted
after this script is applied.
The final step is to configure the guarded host to use the HGS instance instead of local
guardians. This is done by configuring the URL for the HGS attestation service and the
key-protection service:
Set-HgsClientConfiguration -AttestationServerUrl 'http://hgs.savtechhgs.net/Attestation'
-KeyProtectionServerUrl 'http://hgs.savtechhgs.net/KeyProtection'