Shielded VM Key Storage Provider (KSP) – TPM 2.0 Communication Lockup

Fath Swift 0 Reputation points
2026-09-04T15:53:35.06+00:00

Hi all,

A Shielded VM fails to power on with the error: “The Virtual Machine Subsystem failed to decrypt the VM state.” Further diagnostics indicate that the host Key Storage Provider (KSP) has lost communication with the physical TPM 2.0 module.

What is the recommended procedure to re-initialise TPM provisioning on the Hyper-V host and restore the KSP’s communication with the TPM without affecting existing Shielded VMs?

Thanks

Windows for business | Windows Client for IT Pros | Storage high availability | Virtualization and Hyper-V
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Scott Nguyen 1,965 Reputation points Independent Advisor
    2026-09-04T16:50:53.55+00:00

    Hello,

    The error “The Virtual Machine Subsystem failed to decrypt the VM state” can occur when the Hyper-V host cannot use the cryptographic material required to unlock the Shielded VM.

    I would not clear the physical TPM as the first troubleshooting step. Start by checking the TPM and guarded-host state:

    Get-Tpm
    Get-HgsClientConfiguration
    If the TPM is not initialized or ready, use the supported TPM initialization procedure rather than immediately clearing it.

    Most importantly, don't delete or modify the Shielded VM's .vmcx/.vmrs files or its Key Protector as part of this troubleshooting. The VM configuration should be preserved while the host's TPM/KSP and HGS attestation state are investigated.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.