Microsoft has released Windows Server vNext Preview Build 29621, and one feature stands out as a major step forward for on‑premises virtualization security: Trusted Launch for Generation 2 virtual machines. This capability, long familiar to Azure users, is now arriving in Windows Server for local Hyper‑V environments.
What Trusted Launch Brings to Windows Server
Trusted Launch is a security model designed to harden virtual machines against boot‑level attacks and unauthorized tampering. In this preview, Trusted Launch enables:
- Secure Boot
- vTPM (virtual TPM)
- vTPM state protection at rest
All of this is fully manageable through PowerShell .
This marks the first time Windows Server includes an integrated, Azure‑aligned VM security baseline that protects guest state and improves trust in the VM boot process.
How to Enable Trusted Launch
Microsoft outlines a straightforward setup path:
- Install the latest Server Insider preview build.
- Enable Hyper‑V.
- Set the required registry keys.
- Enable the IsolatedGuestVm optional feature.
- Verify the IGVmAgent service is running.
- Create an external virtual switch if needed.
- Create your Trusted Launch VM using either an existing Gen2 VHDX or a new VHD + ISO.
- Confirm the VM’s isolation type is TrustedLaunch.
- Validate guest‑state protection by stopping IGVmAgent and restarting the VM.
This workflow gives administrators a hands‑on way to explore the new isolation model and understand how Trusted Launch behaves under different conditions.
Current Limitations
Because this is an early preview, several features are not yet supported:
- Moving Trusted Launch VMs between servers
- Failover clustering
- Hyper‑V Replica
- Boot integrity verification
- Windows Admin Center management
These gaps are expected to close in future builds as the feature matures.
Why This Matters
Trusted Launch brings Windows Server closer to the hardened virtualization model used in Azure. For organizations running sensitive workloads on‑premises, this means:
- Stronger protection against firmware‑level threats
- Better compliance through vTPM support
- A modern foundation for future VM security enhancements
It’s a significant milestone for administrators who want cloud‑grade security without leaving their datacenter.
Final Thoughts
Build 29621 is more than just another Insider update—it’s a preview of how Windows Server will evolve to meet modern security expectations. Trusted Launch is a welcome addition that strengthens VM isolation and aligns on‑prem Hyper‑V with Microsoft’s broader virtualization security strategy.
If you’re testing Windows Server vNext, this is absolutely a feature worth exploring.
Author: James van den Berg
I’m Microsoft Architect and ICT Specialist
and
Microsoft MVP Cloud and Datacenter Management
Microsoft MVP Windows Insider
Microsoft Tech Community Insider
Microsoft Azure Advisor