Event banner
Event details
- Heather_Poulsen
Community Manager
Welcome! Windows Server 2025 ReFS booted images for confidential VMs is starting now. If you have any questions or feedback for our product teams, please post them here in the Comments.
- Does rollback protection also "protect" from an intended rollback through backup software?
Vikas_TikooMicrosoft
Intentional rollback wouldn't look any different than malicious rollback, ReFS will detect that this is a older copy of the volume. User can however configure whether they want to block or allow boot in case rollback is detected by ReFS.
Can you please elaborate on ReFS Boot? I understood confidential computing in VMs is the motion why ReFS now has been improved to support OS boot in the first place, which wasn't possible for long time and as a base made compatible with dism? TYVM.
- Vikas_TikooAs you mentioned we extended ReFS so that it can be used as a boot volume. Earlier ReFS volumes could only be attached as data disks. This was important for the Confidential VM scenario as we wanted to have an FS with integrity protection capabilities right after boot.
- Hi, will it be also available on Windows 11? What about Windows Server 2025 installed locally on a physical machine or Hyper-V VM? Thanks
How can we ensure that
- UEFI updates
- Reset of Secure Boot keys
- changing mainboard in case of events (like BMC defect or mainboard defect)
can be compensated?
In these cases I could imagine that the root of trust (PCR / TPM) are invalidated and in result this might prevent VMs from booting.
Lately I had a similar "lesson", without confidential VM, just vTPM enabled on the Hyper-V VMs and they refused booting after an UEFI update which fussed around with my Secure Boot so I had to delete the keys and redeploy them. Can you follow me?
Understood that's is a double-edged sword and trade-offs between confidentially and unexpected things that can happen.
I suppose that CVM are likely used in areas where confidentially comes along with high costs for outages. Thanks for sharing your thoughts!- Vikas_TikooGreat question. Yes things like UEFI or key updates do require care in ensuring secure boot will still work. Secure boot is however an important primitive for Confidential VMs and generally for VMs deployed with Trusted launch. It helps ensure integrity of early boot components. Also since you mentioned UEFI state, wanted to call out that ReFS rollback protection capability relies on UEFI variable store being protected. In Confidential VMs we take measures to protect the UEFI state through authenticated encryption. Hope this helps!
- Char_Cheesman
Thank you for joining us this week for the Windows Server Summit! Q&A is now closed, but all sessions are available on demand so you can watch and learn when it is convenient for you. We hope you enjoyed the event.
