Booting physical disk (bare metal) Windows 10 under Hyper-V with TPM2.0


tweebs

Active member
Local time
3:54 PM
Posts
1
OS
Windows 10 LTSC 1809
I think I already know my answer but maybe someone can confirm my suspicions...
My work laptop was provided with Windows 10 Enterprise but has been extremely locked down to the point where I can't even use it for development work. I've been getting around this by installing a 2nd M.2 SSD and installing Win11 Pro and using as needed. Occasionally, I'll need to access the VPN, or some other enterprise resource, so I was using Hyper-V to boot the physical Win10 bare metal drive using hypervisor. It worked fairly well, except I couldn't use Hyper-V Enhanced Session as my domain login didn't allow Remote Users, and every time I booted I had to enter the Bitlocker key.
Unfortunately, they have upgraded the Windows 10 image and now use TPM to secure the system. When I boot into Win10 in Hyper-V, Windows notifies me the security is broken and won't let me login to Enterprise functions until I shut-down and boot directly into Windows.
Turning on TPM in Hyper-V configuration results in not booting at all.
There doesn't seem to be a way to pass-thru TPM2.0 from the host to the virtualized boot, nor is there a way to 'export' a certificate from the host to use in the virtual machine (since it doesn't exist).
I've heard QMEU will use a 'real' TPM instead of a virtual certificate, but I haven't explored that option.
 

My Computer

System One

  • OS
    Windows 10 LTSC 1809
I think I already know my answer but maybe someone can confirm my suspicions...
My work laptop was provided with Windows 10 Enterprise but has been extremely locked down to the point where I can't even use it for development work. I've been getting around this by installing a 2nd M.2 SSD and installing Win11 Pro and using as needed. Occasionally, I'll need to access the VPN, or some other enterprise resource, so I was using Hyper-V to boot the physical Win10 bare metal drive using hypervisor. It worked fairly well, except I couldn't use Hyper-V Enhanced Session as my domain login didn't allow Remote Users, and every time I booted I had to enter the Bitlocker key.
Unfortunately, they have upgraded the Windows 10 image and now use TPM to secure the system. When I boot into Win10 in Hyper-V, Windows notifies me the security is broken and won't let me login to Enterprise functions until I shut-down and boot directly into Windows.
Turning on TPM in Hyper-V configuration results in not booting at all.
There doesn't seem to be a way to pass-thru TPM2.0 from the host to the virtualized boot, nor is there a way to 'export' a certificate from the host to use in the virtual machine (since it doesn't exist).
I've heard QMEU will use a 'real' TPM instead of a virtual certificate, but I haven't explored that option.

@tweebs
I'd suggest you install a decent version of linux say Fedora or archlinux with a desktop GUI. Then install KVM/QEMU to create a Windows VM of whatever flavour you like.

KVM can emulate a TPM or you can pass thru a real one --I'd use the emulation (swtpm). I've posted also (just search for it) how to attach physical disks to Windows VM's on KVM. Also you can boot the VM from a USB drive too if you have say a Windows installation iso copied to a usb stick done with say rufus.

A usb device can be also dynamically "redirected" to a running VM (use the redirect option in the virt-manager option) or can be added as fixed hardware via the add usb host device. To see usb devices on the linux system ensure lsbutils is installed and run lsusb.

Cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,7,10,11 Linux Arch Linux
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7

Latest Support Threads

Back
Top Bottom