Skip to content

Instantly share code, notes, and snippets.

@valorad
Last active February 28, 2024 03:15
Show Gist options
  • Star 8 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save valorad/b2df10f04d5a6ab15c88f72474f3c20f to your computer and use it in GitHub Desktop.
Save valorad/b2df10f04d5a6ab15c88f72474f3c20f to your computer and use it in GitHub Desktop.
Hyper-V TPM Migration (To solve error: "The key protector could not be unwrapped" that causes VM startup failure)
$GuardianName = 'UntrustedGuardian'
$CertificatePassword = Read-Host -Prompt 'Please enter a password to secure the certificate files' -AsSecureString
$guardian = Get-HgsGuardian -Name $GuardianName
if (-not $guardian)
{
throw "Guardian '$GuardianName' could not be found on the local system."
}
$encryptionCertificate = Get-Item -Path "Cert:\LocalMachine\Shielded VM Local Certificates\$($guardian.EncryptionCertificate.Thumbprint)"
$signingCertificate = Get-Item -Path "Cert:\LocalMachine\Shielded VM Local Certificates\$($guardian.SigningCertificate.Thumbprint)"
if (-not ($encryptionCertificate.HasPrivateKey -and $signingCertificate.HasPrivateKey))
{
throw 'One or both of the certificates in the guardian do not have private keys. ' + `
'Please ensure the private keys are available on the local system for this guardian.'
}
Export-PfxCertificate -Cert $encryptionCertificate -FilePath ".\$GuardianName-encryption.pfx" -Password $CertificatePassword
Export-PfxCertificate -Cert $signingCertificate -FilePath ".\$GuardianName-signing.pfx" -Password $CertificatePassword
# Adapted from https://nathanblasac.com/error-when-migrating-hyper-v-vm-lab-to-different-host-the-key-protector-could-not-be-unwrapped-f6174f68a860
$NameOfGuardian = 'previous-host-name-unTG'
$CertificatePassword = Read-Host -Prompt 'Please enter the password that was used to secure the certificate files' -AsSecureString
New-HgsGuardian -Name $NameOfGuardian -SigningCertificate ".\$NameOfGuardian-signing.pfx" -SigningCertificatePassword $CertificatePassword -EncryptionCertificate ".\$NameOfGuardian-encryption.pfx" -EncryptionCertificatePassword $CertificatePassword -AllowExpired -AllowUntrustedRoot
# Adapted from https://nathanblasac.com/error-when-migrating-hyper-v-vm-lab-to-different-host-the-key-protector-could-not-be-unwrapped-f6174f68a860
@manikumarnune123
Copy link

It's very good. Thanks man.

@echu2013
Copy link

This is very good, you saved me thanks!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment