Hi Guys, we we recently bombarded by Security Team asking to implement a number of small things. Now they are asking for another bunch to be implemented on Windows Server 2022 Citrix CVAD, running on Nutanix AHV as PVS targets booting from BDM iso. Could you tell if you were successful in implementing any of these or found enough evidence that something is not supported or doesn’t work well? Bitlocker vTPM Secure boot VBS Code Integrity Credential guard Remote Credential guard from what I found som far: Bitlocker: Not supported on PVS targets. https://docs.citrix.com/en-us/provisioning/2206/manage/managing-target-device.html https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX331016 vTPM: Not clear. Surely you could create a VM with vTPM, but I couldn’t find a process where PVS target situation is mentioned. So we have VM running PVS target and currently configured without vTPM and we want to end up with vTPM attached a properly functioning. Secure boot: Supported. However I ended up with a blue screen after enbling secure boot on a target VM. Potentially missing some steps. Haven’t found info on how to to it properly for PVS target. Also I couldn’t see much value in this one for PVS. https://docs.citrix.com/en-us/provisioning/current-release/configure/configure-UEFI.html https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/security-policies/secure-boot.html VBS: Not clear There was a dedicated option for Vsphere VMs for this. For AHV seems to work differently. Code Integrity: Not clear Not sure if that works for PVS / AHV combo. This could be enabled via GPO once VBS is enabled. Known for causing performance issues. Like massive ones. Crazy IOPS and CPU for hours. we had a number of cases with Microsoft for this on persistent VDI. Credential guard: Not clear I could see there is an option on AHV VMs. but not sure if that works for PVS targets. And if that works how reliable is that. some comments here abotu VM density and Virtual Trusted Platform Modules (vTPM) to store MS policies is not supported. https://portal.nutanix.com/page/documents/details?targetId=AHV-Admin-Guide-v10_3:ahv-windows-defender-credential-guard-support-c.html#nconcept_x14_k3z_rnb__section_dbd_yyw_rbc Remote Credential guard: Supported. Seems to be just a gpo settings “Restrict delegation of credentials” and has nothing to do with PVS or AHV

Hey, that's a question for Nutanix, Citrix PVS in UEFI works with secure boot, VBS and Credguard. I use them with Hyper-V. For example none of those work with XenServer

We support vTPM, SecureBoot, VBS, Credential guard If by code integrity you are talking about memory integrity, hold off for now as there is a performance whack until an upcoming release (our engineering fixed this for upstream KVM) I'm not sure I've seen them all done with PVS, but our hypervisor supports the above

yes, code integrity AKA memory integrity or HVCI. We had it enabled for Windows 11 persistent VDIs for some time, but had to disable it because of performance issues. I see these all are available in AHV. Defender Credential Guard, vTPM, Secure Boot. And most of the guides start with enable this for VM first and then install OS. in our case we already have vdisk without all these wonderful features. Any tips on where to start in this scenario? Any of these features known for being problematic ? (except for HVCI, we already know this one is pretty heavy)

Credential Guard in AHV = VBS as an FYI only problematic one is Memory Integrity for now, that will be sorted shortly I will ping you offline and we can do a session on what's what