How to Enable and Configure a Virtual TPM (vTPM) in Windows 11 Hyper-V Using PowerShell

Deploying modern enterprise operating systems within Microsoft Hyper-V on Windows 11 requires meeting strict hardware-enforced baseline security standards. Most notably, Windows 11 mandates a Trusted Platform Module (TPM 2.0) chip alongside Secure Boot to support core security features such as BitLocker drive encryption, Windows Hello for Business, Device Guard, and Virtualization-Based Security (VBS). If an administrator attempts to install Windows 11 or a security-hardened Linux distribution into a virtual machine without a hardware security device, the installer halts immediately with a compatibility failure. Hyper-V solves this requirement by providing virtual Trusted Platform Module (vTPM) architecture for Generation 2 virtual machines. By using PowerShell cmdlets such as Enable-VMTPM and Set-VMSecurity, administrators can provision and manage cryptographic chip emulation without dedicated external hardware.

Understanding the Hyper-V Virtual TPM Architecture

A virtual TPM (vTPM) is a software-synthesized security coprocessor exposed to guest operating systems within Hyper-V Generation 2 virtual machines. The guest operating system interacts with the vTPM identically to a physical physical TPM 2.0 discrete chip on a motherboard.

The vTPM architecture provides critical cryptographic isolation:

• Guest Key Sealing: Allows the guest operating system kernel to generate and seal cryptographic keys, encrypt volume master keys with BitLocker, and verify platform configuration registers (PCRs).
• Key Storage Drive (KSD): Hyper-V stores the guest VM’s encrypted TPM state inside a virtual Key Storage Drive file (.vmgs file) stored in the VM’s configuration directory.
• Host Cryptographic Binding: On standalone Windows 11 workstations, the virtual machine’s security state is protected using local machine cryptographic keys generated by the host hypervisor.

Auditing Existing VM Generation and Security Configuration

A virtual TPM can only be enabled on Generation 2 Hyper-V virtual machines. Legacy Generation 1 virtual machines rely on BIOS emulation and do not support UEFI security extensions.

To verify the generation and security configuration of your virtual machine using an elevated PowerShell session:

Get-VM -Name "Win11TestLab" | Select-Object Name, Generation, State

Ensure Generation is 2. Next, inspect the current security settings of the target VM:

Get-VMSecurity -VMName "Win11TestLab" |
    Select-Object VMName, TPMEnabled, EncryptStateAndVmMigrationTraffic, Shielded

If TPMEnabled is False, the virtual machine cannot pass Windows 11 installer checks or utilize hardware-backed credential protection.

Enabling the Virtual TPM in Hyper-V

To enable the virtual TPM, the target virtual machine must be completely powered off.

Execute the following commands to shut down the VM and activate the vTPM:

# Stop the virtual machine
Stop-VM -Name "Win11TestLab" -Force

# Enable the virtual Trusted Platform Module
Enable-VMTPM -VMName "Win11TestLab"

# Start the virtual machine
Start-VM -Name "Win11TestLab"

To verify that the vTPM is actively enabled on the VM:

(Get-VMSecurity -VMName "Win11TestLab").TPMEnabled

The command returns True, confirming that the virtual TPM 2.0 coprocessor is now visible to the guest UEFI environment.

Encrypting Virtual Machine State and Migration Traffic

For sensitive workloads, Hyper-V allows administrators to encrypt both the saved state of the virtual machine and live migration traffic across host nodes.

To enforce state encryption alongside the virtual TPM:

Stop-VM -Name "Win11TestLab" -Force

Set-VMSecurity -VMName "Win11TestLab" `
    -EncryptStateAndVmMigrationTraffic $true

Start-VM -Name "Win11TestLab"

When state encryption is active, all runtime checkpoints, saved memory state files, and virtual hard disk security certificates are encrypted, preventing host administrators or unauthorized file system access from extracting sensitive credentials directly from disk images.

Verifying the TPM Inside the Guest Operating System

Once the virtual machine powers on, log into the guest operating system to verify that the hardware security device is fully recognized by the kernel.

Inside a Windows 11 Guest:

1. Open an elevated PowerShell window inside the guest VM.
2. Execute:

   Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerVersion, SpecVersion

3. Verify that TpmPresent: True, TpmReady: True, and SpecVersion: 2.0.
4. You can now enable BitLocker encryption on drive C: without requiring USB startup keys or policy bypasses:

   Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

Inside a Linux Guest (e.g. Ubuntu 24.04):

# Verify TPM device node
ls -l /dev/tpm*

# Query TPM capability using tpm2-tools
sudo tpm2_getcap properties-fixed | grep -E "MANUFACTURER|TPM2_PT_SPEC_VERSION"

Disabling the Virtual TPM for Maintenance or Export

If you need to export a virtual machine to an older virtualization host that lacks vTPM support, or if you are resetting a lab test scenario:

# Ensure BitLocker is decrypted inside the guest first to prevent permanent data lock
Stop-VM -Name "Win11TestLab" -Force

# Disable the virtual TPM
Disable-VMTPM -VMName "Win11TestLab"

Provisioning virtual TPMs via PowerShell in Windows 11 Hyper-V bridges enterprise hardware security and virtualization agility, ensuring test environments satisfy modern operating system prerequisites and protect sensitive encryption keys.