Windows 11 Hyper‑V support

No publicly documented, officially supported Windows 11 Hyper‑V API provides one-time cold-boot authorization of a Linux VM from a designated IGVM image.

What the supported APIs provide

Microsoft documents three principal Hyper‑V API surfaces:

• Hyper‑V WMI provider — high-level management of Hyper‑V services and conventional VMs.
• Host Compute System (HCS) API — lower-level management of local VMs and containers.
• Windows Hypervisor Platform (WHP) — lets a third-party virtualization stack create partitions, map memory, and control virtual processors.

None of the documented operations identifies an IGVM image as a Hyper‑V boot source or exposes a one-time boot-authorization token or policy. WHP also requires the application to supply its own virtualization stack; it is not an authorization extension for a Hyper‑V-managed VM.^1^

IGVM—Independent Guest Virtual Machine—describes an isolated VM’s initial state in Microsoft’s public project material. That establishes a file format and related tooling, but not a supported Windows 11 Hyper‑V management contract for loading an IGVM and authorizing exactly one cold boot.

Closest supported Hyper‑V mechanism

For protected workloads, the documented mechanism is a Generation 2 shielded VM, with:

• Secure Boot, including Linux-compatible templates
• virtual TPM and encrypted VM state
• a Key Protector
• optionally, Host Guardian Service (HGS)

HGS authorizes approved Hyper‑V hosts to start shielded VMs. A Key Protector can likewise be updated to authorize another host.^2^

That authorization is host/VM protection policy—not a documented consumable permit that authorizes one cold boot and is then invalidated. Consequently, HGS or Key Protectors should not be represented as satisfying one-time boot semantics.

Practical design choices

For an application requiring this behavior:

1. Use a conventional Hyper‑V VM and manage its lifecycle through WMI or HCS.
2. Enforce the one-time rule in the host application, such as recording authorization consumption before requesting VM start.
3. Treat that rule as an application policy, not a Hyper‑V security boundary: a sufficiently privileged host administrator can manage the VM independently.
4. If protection from host administrators is required, evaluate shielded VMs/HGS, but redesign around persistent host attestation and authorization rather than a one-use boot grant.
5. If the requested capability came from an SDK, partner specification, preview, or confidential-computing design, obtain its exact API name and support statement. The public Hyper‑V interfaces do not establish that scenario as supported.

On Windows 11, Hyper‑V itself is available in Pro, Enterprise, and Education editions.^3^ This edition support does not add an IGVM boot-authorization API.

References

1. Hyper-V APIs
2. Hyper-V Generation 2 Virtual Machine Security Features
3. Hyper-V virtualization in Windows Server and Windows