Windows Server 2019 KVM Credentials Guard Bug

quanto11

Member
Dec 11, 2021
47
3
13
35
Hello everyone,

For a month and a half I have been looking for a bug that does not allow the September, October (KB5031361) and subsequent updates to be installed on Windows Server 2019, the updates are installed during operation, the machine is restarted so that the Windows update progress runs up to 30% and the machine resets itself. During the boot process, however, the machine no longer displays the familiar Windows loading bar (dots), but instead boots directly into WinRE. A normal boot process is no longer possible. Either you use the Windows start help, which applies a "repair", or you try to select the start mode to "Safe mode" before the WinRE. Both result in a Windows Update Rollback being started, which uninstalls the September updates and allows the VM to start normally again. (However, the SSU remains present).

After ages of LOG searching, various repair attempts etc. Hyper-V finally brought the breakthrough. A backup of the VM and copying the hard disk to Hyper-V allowed the VM to start normally, the update to start completely and without problems. From this point on, I knew that Windows could not be the actual problem.

After further searching, I finally came across the "KVM" option. After deactivating the option, the updates could be installed without any problems, the machine boots and works normally. If I activate the KVM option again after the update, the machine no longer boots.
After more back and forth, I came across the Credential Guard option. This option is used in the affected infrastructure and actually causes the error, but only from the September and October update. The August update had no problems at all.

If you delete the respective registry values, deactivate the GPO etc., everything works perfectly again with KVM and the respective updates. You can see whether Credential Guard is activated under "msinfo", for example.

The real question is, do so few people use Credential Guard in conjunction with KVM, is it possibly only your own infrastructure that is affected and where and how do you report such an error with low level debugging logs?

A very interesting aspect after deactivating Credential Guard is that the performance of the respective machine is significantly better, felt.

https://learn.microsoft.com/en-us/w...abs=reg#disable-virtualization-based-security

Proof of Concept:

Install a clean version of Windows 2019, install all updates specified by Microsoft and restart the machine. Then set the following registry value:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard
"Enabled"=dword:00000001

Restarts the machine

I have only been able to check the German image version so far. Windows 2022 is not affected by the problem
 
without KVM hw virtualization, VM are very slow because all is software emulated.
DeviceGuard require hyperv , so VM run in a nested virtualization and there is slowdown too especially with old cpu.
What is your CPU host ?
 
Fantastic - couldn´t belive it... I installed updates march 2024 and had this issue... I went back step by step to identify the failing hotfix. August 2023 worked fine - all updates after that failed.

Your blog here was one of thousands, but T H AN K S for sharing !!!!

I knew it has to be something with secure boot, vbs, Device Guard - but your entry finally solved the issue....

Go on..... Thanks again
 
Thank you for sharing your experience here. I am still very surprised that no one has really posted anything about the problem. Above all, the problem is extremely difficult to track if you are not deep enough into reverse engineering. I'm glad it helped.
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!