{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
        "slug": "dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/"
        },
        "title": "Separate shielded-VM provisioning completion from guest specialization",
        "summary": "Which provisioning and specialization results should be checked after running New-ShieldedVM?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:14:58+00:00",
        "modified_at": "2026-09-08T18:23:27+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 1,
        "word_count": 194,
        "potentially_affected": "Administrators provisioning shielded VMs with the documented Guarded Fabric Tools workflow.",
        "dse_recommendation": "Have the fabric operator record the exact provisioning invocation and sanitized specialization inputs.",
        "primary_source": {
            "name": "Create a shielded VM using PowerShell",
            "url": "https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft’s guarded-host procedure installs Guarded Fabric Tools, which supplies New-ShieldedVM. The command can receive replacement specialization values when the shielding-data answer file defines them. Operating-system specialization follows VM provisioning. For a Windows Server 2016 host, Microsoft describes VM shutdown as a provisioning-completion signal and Hyper-V logs as the place to inspect unsuccessful provisioning. <a href=\"https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Begin with approved template and shielding-data artifacts already prepared. Identify the guarded-host release, guest OS, intended specialization values, and supported module workflow before interpreting any completion signal.</p>\n<h2>DSE recommendation</h2>\n<p>Have the fabric operator record the exact provisioning invocation and sanitized specialization inputs. Define separate acceptance checks for the provisioning task and the guest’s subsequent setup. Agree with the tenant on the expected guest identity and how failed provisioning evidence will be preserved.</p>\n<h2>Verification</h2>\n<p>Run the approved provisioning operation and inspect its result and applicable Hyper-V events. Then verify the guest’s specialization and authorized management access independently. Record a completed task with an unfinished or failed guest setup as incomplete delivery, and resolve that discrepancy before repeating the workflow for additional VMs.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Create a shielded VM using PowerShell</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft’s guarded-host procedure installs Guarded Fabric Tools, which supplies New-ShieldedVM. The command can receive replacement specialization values when the shielding-data answer file defines them. Operating-system specialization follows VM provisioning. For a Windows Server 2016 host, Microsoft describes VM shutdown as a provisioning-completion signal and Hyper-V logs as the place to inspect unsuccessful provisioning. Microsoft documentation.\nApplicability\nBegin with approved template and shielding-data artifacts already prepared. Identify the guarded-host release, guest OS, intended specialization values, and supported module workflow before interpreting any completion signal.\nDSE recommendation\nHave the fabric operator record the exact provisioning invocation and sanitized specialization inputs. Define separate acceptance checks for the provisioning task and the guest’s subsequent setup. Agree with the tenant on the expected guest identity and how failed provisioning evidence will be preserved.\nVerification\nRun the approved provisioning operation and inspect its result and applicable Hyper-V events. Then verify the guest’s specialization and authorized management access independently. Record a completed task with an unfinished or failed guest setup as incomplete delivery, and resolve that discrepancy before repeating the workflow for additional VMs.\nOfficial references\nMicrosoft Learn: Create a shielded VM using PowerShell. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft’s guarded-host procedure installs Guarded Fabric Tools, which supplies New-ShieldedVM. The command can receive replacement specialization values when the shielding-data answer file defines them. Operating-system specialization follows VM provisioning. For a Windows Server 2016 host, Microsoft describes VM shutdown as a provisioning-completion signal and Hyper-V logs as the place to inspect unsuccessful provisioning. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell).\n\n## Applicability\n\nBegin with approved template and shielding-data artifacts already prepared. Identify the guarded-host release, guest OS, intended specialization values, and supported module workflow before interpreting any completion signal.\n\n## DSE recommendation\n\nHave the fabric operator record the exact provisioning invocation and sanitized specialization inputs. Define separate acceptance checks for the provisioning task and the guest’s subsequent setup. Agree with the tenant on the expected guest identity and how failed provisioning evidence will be preserved.\n\n## Verification\n\nRun the approved provisioning operation and inspect its result and applicable Hyper-V events. Then verify the guest’s specialization and authorized management access independently. Record a completed task with an unfinished or failed guest setup as incomplete delivery, and resolve that discrepancy before repeating the workflow for additional VMs.\n\n## Official references\n\n[Microsoft Learn: Create a shielded VM using PowerShell](https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Separate shielded-VM provisioning completion from guest specialization",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/",
                "headline": "Separate shielded-VM provisioning completion from guest specialization",
                "description": "Which provisioning and specialization results should be checked after running New-ShieldedVM?",
                "abstract": "Which provisioning and specialization results should be checked after running New-ShieldedVM?",
                "articleBody": "Source facts\nMicrosoft’s guarded-host procedure installs Guarded Fabric Tools, which supplies New-ShieldedVM. The command can receive replacement specialization values when the shielding-data answer file defines them. Operating-system specialization follows VM provisioning. For a Windows Server 2016 host, Microsoft describes VM shutdown as a provisioning-completion signal and Hyper-V logs as the place to inspect unsuccessful provisioning. Microsoft documentation.\nApplicability\nBegin with approved template and shielding-data artifacts already prepared. Identify the guarded-host release, guest OS, intended specialization values, and supported module workflow before interpreting any completion signal.\nDSE recommendation\nHave the fabric operator record the exact provisioning invocation and sanitized specialization inputs. Define separate acceptance checks for the provisioning task and the guest’s subsequent setup. Agree with the tenant on the expected guest identity and how failed provisioning evidence will be preserved.\nVerification\nRun the approved provisioning operation and inspect its result and applicable Hyper-V events. Then verify the guest’s specialization and authorized management access independently. Record a completed task with an unfinished or failed guest setup as incomplete delivery, and resolve that discrepancy before repeating the workflow for additional VMs.\nOfficial references\nMicrosoft Learn: Create a shielded VM using PowerShell. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:14:58+00:00",
                "dateModified": "2026-09-08T18:23:27+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-133-separate-shielded-vm-provisioning-completion-from-guest-specialization/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Separate shielded-VM provisioning completion from guest specialization"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 194,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Create a shielded VM using PowerShell",
                    "url": "https://learn.microsoft.com/en-us/windows-server/security/guarded-fabric-shielded-vm/guarded-fabric-create-a-shielded-vm-using-powershell"
                }
            }
        ]
    }
}