Shielded VM Fails to Start Due to TPM/KSP Initialization Error

Hello @Hafiz Omar

I would not clear the host TPM as the first troubleshooting step.

With a Shielded VM, the error "The Virtual Machine Subsystem failed to decrypt the VM state."

usually means Hyper-V couldn't obtain or use the cryptographic material required to unlock the protected VM state. In a guarded fabric, the Host Guardian Service (HGS) attests the Hyper-V host and its Key Protection Service releases the keys required to start the Shielded VM.

First, verify the physical TPM state on the affected Hyper-V host:

Get-Tpm

For TPM-trusted attestation, Microsoft requires TPM 2.0, and the TPM must be initialized and ready. Microsoft documents using Initialize-Tpm when the TPM isn't in the Ready state.

If initialization is actually required, use:

Initialize-Tpm

I would not jump directly to:

Clear-Tpm

because TPM-trusted HGS attestation identifies each guarded host using information derived from that physical TPM, including its unique platform identifier/endorsement key. HGS also validates the host's boot measurements and code-integrity policy.

Before changing the TPM, I would also run the guarded-host diagnostics and confirm that the host can successfully attest to HGS. Microsoft specifically recommends guarded-fabric diagnostics when the underlying HGS/attestation failure isn't known.

Also check the event logs under:

Applications and Services Logs

Microsoft

*Windows*

  *HostGuardianService-Client*

  *Hyper-V-VMMS*

  *Hyper-V-Worker*

The distinction is important:

Physical host TPM → establishes trust/attestation of the guarded Hyper-V host.

Shielded VM vTPM + Key Protector → protects the VM and its encrypted state.

Don't delete or regenerate the VM's Key Protector just to troubleshoot a host TPM/KSP problem. Shielded VMs depend on the Key Protector to define which guarded fabrics can run the VM.

If the host TPM really must be cleared, for example, because TPM provisioning itself is corrupted—I would first make sure you have:

• a tested backup/recovery path for the Shielded VM;
• access to HGS and its signing/encryption certificates;
• the VM owner's recovery material where applicable;
• the ability to re-register/re-authorize the Hyper-V host in HGS.

After TPM reinitialization, a host using TPM-trusted attestation may need its TPM identity captured and authorized in HGS again. Microsoft documents obtaining the platform identifier with Get-PlatformIdentifier and registering it using Add-HgsAttestationTpmHost.

So I wouldn't treat this as simply "clear TPM and reboot." First establish whether the failure is TPM provisioning, HGS attestation, KSP/key access, or the VM's Key Protector.

Microsoft also now has a dedicated troubleshooting guide covering vTPM, Shielded VM, HGS, TPM firmware, key protectors, and certificate-related startup failures:

Microsoft – Troubleshoot vTPM, Shielded VM, and HGS issues

Microsoft – Guarded Fabric and Shielded VMs overview

If you can share the output of Get-Tpm, the Windows Server version, whether HGS uses TPM-trusted or Host Key attestation, and the relevant HGS/Hyper-V event IDs, we can narrow this down before making any destructive TPM changes.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Hello,

The error you’re seeing is directly tied to the host’s TPM provisioning state. When the Key Storage Provider cannot properly communicate with the TPM 2.0, shielded VMs fail to decrypt their state. The recommended procedure is to clear the TPM on the host and re-initialize it, but this must be done carefully to avoid disrupting the Shielded VM configuration.

On a Hyper-V host, the supported way is to use the TPM management console. Run tpm.msc, select Clear TPM, and allow the host to reboot. This operation resets the provisioning state of the TPM without touching the Shielded VM configuration files. After the reboot, the host will automatically re-initialize the TPM and re-establish communication with the Host Guardian Service (HGS).

If you prefer PowerShell, you can use:

powershell

Clear-Tpm

This command clears the TPM ownership and resets it. Once complete, verify that the host re-registers with the HGS by running:

powershell

Get-HgsClientConfiguration

and confirm that the attestation status is healthy.

It’s important not to manually delete or alter the Shielded VM’s .vmcx or .vmrs files, nor attempt to re-provision the VM itself. The Shielded VM configuration remains intact; the reset only affects the host’s TPM state. After the TPM is re-initialized, the VMs should be able to start normally once the host attestation succeeds.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.