Recommended Free Tools
A shielded virtual machine is a VM configured with security controls that help verify its boot integrity and protect it from tampering or unauthorized access. The term has no single universal implementation. Google Cloud and Microsoft both use it, but for different designs, so the vendor decides what the phrase means.
What is a shielded VM in Google Cloud?
In Google Cloud, Shielded VM is a Compute Engine capability. It aims to give you verifiable integrity for a VM instance, so you can tell whether the instance has been affected by boot-level or kernel-level threats. It rests on three mechanisms: Secure Boot, Measured Boot backed by a virtual TPM (vTPM), and integrity monitoring.
As an Amazon Associate I earn from qualifying purchases.
Secure Boot
Secure Boot uses UEFI firmware to check the signatures of boot components as they load. Its purpose is to stop untrusted boot software from running.
Free tools Windows power users keep installed
One-click scans. No signup required.
Measured Boot and the vTPM
Measured Boot records; it does not block. The vTPM stores measurements of components such as the firmware, bootloader and kernel. Those measurements can then be compared with a baseline defined by an integrity policy. Google’s documentation describes the vTPM as compatible with TPM 2.0. It is a virtualized security processor presented to the guest, not a physical chip.
#1 Best Overall
- HP Proliant DL360 G9 4-Bay LFF Server | 2x E5-2695v4 2.10GHz 18-Core CPU (36-Cores Total)
- 256GB DDR4 RAM | 4x 4TB 7.2K SATA 3.5" HDD
- Smart Array P440ar w/ 2GB FBWC | 4x1Gbe NIC
- 2x 500W PSU | Windows Server 2019 Standard Evaluation
Integrity monitoring
Integrity monitoring compares the current boot measurements with the baseline and reports whether the recent boot matches. Google reports two separate results:
- Early boot: from the UEFI firmware to the bootloader.
- Late boot: from the bootloader to the handoff to the kernel.
Defaults and recommendations
Google’s overview says Shielded VM images use UEFI-compliant firmware, vTPM-protected Measured Boot and integrity monitoring. The vTPM and integrity monitoring options are enabled by default, and Google recommends turning on Secure Boot where possible. These are Google Cloud settings, not defaults for VMs in general.
Rank #2
- HPE Proliant DL380 G11 12-Bay LFF Server | 2x Gold 6430 2.1GHz 32-Core CPU (64-Cores Total)
- 32GB DDR5 RAM | 4x 8TB 7.2K SAS 3.5" HDD
- MR408i-o Raid Controller | 12Gb/s SAS Expander | 4x1GbE NIC
- 2x 800W PSU | Windows Server 2019 Standard Evaluation
What is a shielded virtual machine in Hyper-V?
Microsoft defines a shielded VM as a VM that can run only on guarded hosts. It is protected against inspection, tampering and theft by malicious fabric administrators or by malware on the host. The model belongs to a guarded fabric. It is a Generation 2 Hyper-V VM.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Virtual TPM and BitLocker: the VM uses a virtual TPM and BitLocker-protected storage.
- Host Guardian Service (HGS): it attests hosts and protects keys. Only hosts that pass attestation are approved to receive the keys needed to start the VM.
- Key release: because keys go only to approved guarded hosts, an unapproved host cannot run the VM. This is what separates Microsoft’s design from Google’s. It adds trust in the host fabric, not just checks on boot components.
How the two meanings compare
| Axis | Google Cloud Shielded VM | Microsoft Hyper-V shielded VM |
|---|---|---|
| Where it runs | Compute Engine VM instances | Generation 2 VM in a guarded Hyper-V fabric |
| Main security idea | Verifiable boot integrity against boot- and kernel-level threats | Protect tenant VM data from malicious fabric administrators and host malware |
| Main mechanisms | UEFI firmware, Secure Boot, vTPM-based Measured Boot, integrity monitoring | Virtual TPM, BitLocker, host attestation and key protection through HGS |
| Operational signal | Current measurements compared with a baseline, with early- and late-boot results | Attestation and key release decide whether a guarded host can start or migrate the VM |
Reading integrity results correctly
A failed integrity check is a prompt to investigate. It is not proof of an attack. A legitimate change such as a system update can alter the measurements, and Google notes that you may then need to update the baseline. An unexpected failure, especially in early boot, deserves a closer look.
Rank #3
- HP Apollo 4200 G10 24-Bay LFF Server | 2x Gold 6130 2.1GHz 16-Core CPU (32-Cores Total)
- 256GB DDR4 RAM | 24x 4TB 7.2K SAS 3.5" HDD
- Smart Array P816i-a SR | 2x10GbE NIC
- 2x 800W PSU | Windows Server 2019 Standard Evaluation
Image and guest requirements
Support depends on the image. Google’s guidance for custom shielded images lists operating-system and integrity-signal requirements. For Linux, its documented example needs IMA (Integrity Measurement Architecture) support and configuration for the integrity monitoring signals to be available.
What shielding does not promise
Shielding does not make a VM uncompromisable. Each design addresses a specific threat model: boot and kernel integrity in Google’s case, host and fabric-administrator access in Microsoft’s. Application bugs, weak credentials and misconfiguration sit outside both.
Rank #4
- HP Proliant DL360 G9 4-Bay LFF Server | 2x E5-2695v4 2.10GHz 18-Core CPU (36-Cores Total)
- 768GB DDR4 RAM | 4x 4TB 7.2K SATA 3.5" HDD
- Smart Array P440ar w/ 2GB FBWC | 4x1Gbe NIC
- 2x 500W PSU | Windows Server 2019 Standard Evaluation
Sources
This article draws on Google Cloud documentation (Shielded VM overview, About Shielded VMs, Creating custom shielded images) and Microsoft Learn documentation (Guarded fabric and shielded VMs, plus its overview), checked in October 2026. The pages carry no publication dates, and details may change as the vendors update their products.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Best Value
- HP Proliant DL380 G10 8-Bay SFF Server | 2x Platinum 8164 2.0GHz 26-Core CPU (52-Cores Total)
- 768GB DDR4 RAM | 2x 1.92TB SATA III 2.5" SSD
- Smart Array S100i SR | 2x10GbE NIC
- 2x 500W PSU | Windows Server 2019 Standard Evaluation
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
