If a Hyper-V host fails Host Guardian Service (HGS) attestation, start on that host with Get-HgsClientConfiguration. Successful attestation is indicated by IsHostGuarded : True. If it is not true, run Get-HgsTrace -RunDiagnostics -Detailed and fix the failed diagnostic that matches the problem. A failure named HypervisorEnforcedCodeIntegrityPolicy specifically points to missing hypervisor enforcement or an HGS policy mismatch—not merely to code integrity being enabled in some other way.
How to identify the failure
Run these commands in an elevated Windows PowerShell session on the affected guarded host:
As an Amazon Associate I earn from qualifying purchases.
Get-HgsClientConfiguration— check whetherIsHostGuardedisTrue.- If it is
False, runGet-HgsTrace -RunDiagnostics -Detailedand note every failed diagnostic, not just the first one.
The diagnostic names help separate a host configuration problem from an HGS policy, TPM evidence, certificate, time, or connectivity problem. If the failure affects several hosts, investigate changes shared by those hosts—such as HGS policy, certificates, attestation mode, or network configuration. If it affects only one host, start with that host’s code-integrity configuration and hardware evidence.
What a HypervisorEnforcedCodeIntegrityPolicy failure means
HGS’s Hgs_HypervisorEnforcedCiPolicy requirement is that the code integrity policy be enforced by the hypervisor. A HypervisorEnforcedCodeIntegrityPolicy failure means the host is not meeting that requirement. A general indication that code integrity is enabled is not enough to establish hypervisor enforcement.
#1 Best Overall
- Compatible with TPM-M R2.0
- Chipset: Infineon SLB9665
- PIN DEFINE:14Pin
- Interface:LPC
- Please check the Pinout of mainboard at the official website and make sure it compatible with the pinout of TPM module before purchasing, thank you.
Check enforcement and HGS authorization
- Check the host’s active code integrity policy and how it is deployed; confirm that the required hypervisor-enforced configuration is in effect.
- Check that the policy is authorized among the trusted code integrity policies configured in HGS. HGS evaluates both the enforcement requirement and whether the host’s policy matches an administrator-approved policy.
- If the host’s code integrity policy changed, register the new policy with HGS before retrying attestation. A host can be correctly configured locally and still fail if HGS has not been updated to trust the current policy.
Make the host configuration and HGS policy agree, then run the diagnostics again. Avoid changing policy broadly until you know whether the failure is limited to one host or shared across the fabric.
What else TPM-trusted attestation checks
Hypervisor code integrity is only one input in TPM-trusted mode. HGS also evaluates locked policies, including Secure Boot and debugger restrictions, enabled policies such as code integrity, and the host’s TPM evidence.
Rank #2
- Nuvoton NPCT650
- TCG PC Client Platform TPM Profile (PTP) Specification; Family 2.0 (Trusted Platform Module Library; Family 2.0)
- TCG PC Client Specific TPM Interface Specification (TIS), Version 1.3 (TPM Main Specification; Family 1.2 Revision 116)
- Low Standby Power Consumption
- The host must match at least one TPM baseline configured in HGS.
- The TPM identifier must be registered with HGS.
- The code integrity policy presented by the host must be approved by HGS.
If the host was replaced, reimaged, had a firmware update, or moved to a different hardware class, check whether its registered TPM identifier and baseline still describe that machine. Recapture and register the relevant evidence when appropriate, and keep the HGS policy set aligned with the host configuration.
Recommended Free Tools
How to distinguish attestation mode and failure layer
Use the diagnostic output and the environment’s configured attestation mode to choose where to investigate. TPM-trusted attestation has additional hardware, firmware, and policy prerequisites compared with Active Directory-trusted attestation.
Rank #3
- Compatible with：TPM2.0(MS-4462)
- Chipset: INFINEON 9670 TPM 2.0
- PIN DEFINE:12-1Pin
- Interface:SPI
- Supports：MSI Intel 400 Series and 500 Series Motherboards,MSI AMD B550 and A520 Series Motherboards,Windows 10 TPM 2.0
| What the evidence points to | Where to investigate | Useful next check |
|---|---|---|
HypervisorEnforcedCodeIntegrityPolicy fails |
Host code-integrity enforcement and the HGS trusted policy configuration | Confirm hypervisor enforcement and that the active policy is registered with HGS |
| TPM baseline, identifier, or policy evidence does not match | TPM-trusted attestation inputs | Check the registered identifier, baseline, Secure Boot and other locked policies, and approved code-integrity policy |
| Certificate, endorsement trust, or time-related diagnostic fails | HGS and host certificates, TPM endorsement trust, or synchronization | Check the relevant certificate role, trust chain, and time difference |
| Unreachable host, TLS, or endpoint-related error appears | DNS, network path, endpoint configuration, and TLS settings | Test required connectivity and inspect HGS client and server event logs |
How certificates, TPM endorsement trust, and time can block attestation
HGS uses encryption and signing certificates. Microsoft’s troubleshooting guidance calls for RSA certificates with keys of at least 2048 bits and appropriate encryption or signing usages for their respective roles. Verify the certificate used for the failing role rather than assuming that any installed certificate is suitable.
Significant time drift between HGS nodes and guarded hosts can affect the attestation signer certificate. Microsoft provides the AttestationSignerCertRenewalTask scheduled task to refresh that certificate. Check time synchronization and the signer certificate when diagnostics or event logs point to a time or certificate problem.
Rank #4
- TPM 2.0 module for Asus motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x7P, 14 pin security module
- LPC 14 Pin for AsusTPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASUS
For TPM host registration, a missing or untrusted endorsement-key certificate can prevent registration. If the TPM is expected to have an endorsement certificate, run Get-PlatformIdentifier from elevated PowerShell to inspect the platform identifier. When the required trust is missing, install the TPM vendor’s root and intermediate certificates in the documented local-machine certificate stores.
How to rule out DNS, network, and TLS problems
Attestation can fail independently of code integrity if the host cannot reach HGS or if TLS and certificate settings do not match. Microsoft’s broader HGS troubleshooting guidance includes TransientError Host Unreachable, TLS mismatches, and certificate problems among causes of attestation or key-unwrapping failures.
Best Value
- Product Color: Black
- Width: 0.6"
- Depth: 0.5"
- Additional Information: Interface: SPI Features: TPM IC: Nuvoton NPCT750 TPM Version: TPM 2.0 Pin Dimension: 14-1pin System Requirements: Windows® 10, UEFI OS
- Country of Origin: Vietnam
- Verify DNS resolution and the configured HGS endpoint from the guarded host.
- Use
Test-NetConnectionto test the required connectivity for the environment. - Inspect HGS client and server event logs for the endpoint, connection, TLS, or certificate error associated with the failure.
HTTPS is optional for HGS: the Key Protection Service protocol provides message-level encryption over HTTP. If the environment is configured to use HTTPS, the certificate must contain the required Subject Alternative Names for the HGS service and nodes, and clients must trust it. Do not introduce HTTPS solely as an assumed fix for an attestation failure.
When the Code Integrity Policy Active diagnostic can be ignored
On Windows Server 2019 and Windows 10 version 1809 or later, Get-HgsTrace may report Code Integrity Policy Active as failed even when the host is otherwise usable. Microsoft says this result may be ignored only when it is the sole failing diagnostic. If any other diagnostic fails as well, investigate and resolve those failures rather than treating this exception as a general pass.
Reduce risk when changing HGS policy
Changes to HGS policy or attestation mode can affect multiple hosts. Before activating a policy change, validate the diagnostics and keep compatible cumulative updates across HGS and Hyper-V hosts, as Microsoft recommends. For a fleet-wide failure, prioritize shared policy, certificate, mode, and connectivity changes; for a single-host failure, focus first on its local configuration and TPM evidence.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
