Windows Server Insiders Get Trusted Launch for Hyper-V VMs

Windows Server Insider Build 29621 introduces Trusted Launch support for Hyper-V virtual machines, giving administrators new tools to protect virtual machines during startup and operation.

Microsoft has released the preview build for Windows Server Insider testers. The new security feature currently targets Hyper-V Generation 2 virtual machines.

Trusted Launch Adds VM Startup Protections

Trusted Launch automatically enables Secure Boot when administrators create a supported virtual machine.

The feature also installs a virtual Trusted Platform Module, known as a vTPM. Windows Server protects the vTPM while its data remains stored at rest.

Together, Secure Boot and vTPM support can help defend virtual machines against unauthorized firmware changes, compromised boot components, and other attacks that occur before the operating system fully starts.

Microsoft Improves vTPM Availability

Trusted Launch also aims to improve how virtual machines retain access to their vTPM state when moving between nodes in a failover cluster.

During a supported live migration or failover, Windows Server can make the vTPM state available automatically on the destination node. This should allow the virtual machine to continue operating after the move.

Standard Generation 2 virtual machines that use a vTPM may fail to start after migration when administrators do not manually transfer the TPM protection key.

However, failover cluster support for Trusted Launch virtual machines is not available in Windows Server Insider Build 29621.

Boot Integrity Verification Remains Unavailable

Trusted Launch also includes a planned boot integrity verification feature.

The process compares the virtual machine’s startup path with a trusted reference stored in Microsoft Azure Attestation. It can detect unauthorized changes to firmware and boot components that traditional antivirus tools may struggle to identify.

Third-party security products can then respond when the verification process detects suspicious changes.

Microsoft has not included boot integrity verification in the current Insider build.

Trusted Launch Limitations in Build 29621

The current Windows Server Insider implementation includes several limitations:

• Trusted Launch virtual machines cannot move to another server.
• Failover cluster support is unavailable.
• Hyper-V Replica does not support Trusted Launch virtual machines.
• Boot integrity verification is unavailable.
• Windows Admin Center cannot manage Trusted Launch virtual machines.

Microsoft plans to add or improve several of these capabilities in future Windows Server Insider releases.

Trusted Launch Availability

Administrators can test Trusted Launch in Windows Server Insider Preview Build 29621.

Microsoft has also published configuration guidance for enabling the feature and creating supported Generation 2 virtual machines.

The current preview focuses on Secure Boot and protected vTPM support, while migration, replication, cluster management, and boot verification capabilities remain under development.

Microsoft has also released Extended Security Updates for Exchange Server 2016 and Exchange Server 2019.

The company separately released Windows 11 KB5101650 and KB5099414, along with Windows 10 KB5099539, as part of the July 2026 Patch Tuesday rollout.