CIS Microsoft Hyper-V Benchmark

This recommendation verifies that Hyper-V Host OS Is Patched and Current on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Hyper-V Host OS Is Patched and Current:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Hyper-V Host OS Is Patched and Current:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Server Core Installation Is Used on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Server Core Installation Is Used:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Server Core Installation Is Used:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation ensures that Only Required Roles and Features Are Installed on the Microsoft Hyper-V hypervisor. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Microsoft Hyper-V hypervisor may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

In Hyper-V Manager or PowerShell, verify that Only Required Roles and Features Are Installed:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Only Required Roles and Features Are Installed:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that BitLocker Is Enabled for OS Volume on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that BitLocker Is Enabled for OS Volume:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure BitLocker Is Enabled for OS Volume:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Default Virtual Hard Disk Path Is Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Default Virtual Hard Disk Path Is Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Default Virtual Hard Disk Path Is Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Default Virtual Machine Path Is Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Default Virtual Machine Path Is Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Default Virtual Machine Path Is Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Live Migration Authentication Uses Kerberos on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Live Migration Authentication Uses Kerberos:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Live Migration Authentication Uses Kerberos:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Enhanced Session Mode Is Configured Appropriately on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Enhanced Session Mode Is Configured Appropriately:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Enhanced Session Mode Is Configured Appropriately:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Secure Boot Is Enabled for Generation 2 VMs on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Secure Boot Is Enabled for Generation 2 VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Secure Boot Is Enabled for Generation 2 VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that TPM Is Enabled for Supported VMs on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that TPM Is Enabled for Supported VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure TPM Is Enabled for Supported VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Shielded VMs Are Used for Sensitive Workloads on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Shielded VMs Are Used for Sensitive Workloads:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Shielded VMs Are Used for Sensitive Workloads:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Guest Services Integration Is Disabled When Not Required on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that Guest Services Integration Is Disabled When Not Required:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Guest Services Integration Is Disabled When Not Required:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Checkpoints Are Not Used in Production on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Checkpoints Are Not Used in Production:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Checkpoints Are Not Used in Production:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Automatic Start Action Is Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Automatic Start Action Is Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Automatic Start Action Is Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Automatic Stop Action Is Set to Shut Down on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Automatic Stop Action Is Set to Shut Down:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Automatic Stop Action Is Set to Shut Down:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Resource Controls Are Configured for VMs on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Resource Controls Are Configured for VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Resource Controls Are Configured for VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Management OS Sharing Is Disabled on VM Switches on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that Management OS Sharing Is Disabled on VM Switches:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Management OS Sharing Is Disabled on VM Switches:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that VLAN Isolation Is Configured for VM Networks on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that VLAN Isolation Is Configured for VM Networks:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure VLAN Isolation Is Configured for VM Networks:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that MAC Address Spoofing Is Disabled on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that MAC Address Spoofing Is Disabled:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure MAC Address Spoofing Is Disabled:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that DHCP Guard Is Enabled on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that DHCP Guard Is Enabled:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure DHCP Guard Is Enabled:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Private Virtual Switch Is Used for Isolated VMs on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Private Virtual Switch Is Used for Isolated VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Private Virtual Switch Is Used for Isolated VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Port ACLs Are Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Port ACLs Are Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Port ACLs Are Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that NIC Teaming Is Configured for Redundancy on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that NIC Teaming Is Configured for Redundancy:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure NIC Teaming Is Configured for Redundancy:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Virtual Hard Disks Use VHDX Format on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Virtual Hard Disks Use VHDX Format:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Virtual Hard Disks Use VHDX Format:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Pass-Through Disks Are Not Used on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Pass-Through Disks Are Not Used:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Pass-Through Disks Are Not Used:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Storage Quality of Service Is Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Storage Quality of Service Is Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Storage Quality of Service Is Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that VM Backups Are Configured via Host-Level Backup on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that VM Backups Are Configured via Host-Level Backup:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure VM Backups Are Configured via Host-Level Backup:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Hyper-V Replica Uses Certificate-Based Authentication on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Hyper-V Replica Uses Certificate-Based Authentication:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Hyper-V Replica Uses Certificate-Based Authentication:

Set-VM ... -Parameter Value
Set-VMHost ...

This setting ensures that VM Export Permissions Are Restricted on the Microsoft Hyper-V hypervisor. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Hyper-V hypervisor is essential for defense in depth.

In Hyper-V Manager or PowerShell, verify that VM Export Permissions Are Restricted:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure VM Export Permissions Are Restricted:

Set-VM ... -Parameter Value
Set-VMHost ...

This setting ensures that Hyper-V Admins Group Membership Is Minimized on the Microsoft Hyper-V hypervisor. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Hyper-V hypervisor is essential for defense in depth.

In Hyper-V Manager or PowerShell, verify that Hyper-V Admins Group Membership Is Minimized:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Hyper-V Admins Group Membership Is Minimized:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Delegation of VM Management Uses RBAC on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Delegation of VM Management Uses RBAC:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Delegation of VM Management Uses RBAC:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Remote Management Uses Constrained Delegation on the Microsoft Hyper-V hypervisor. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Hyper-V hypervisor uses the correct component aligns with industry best practices and standards.

In Hyper-V Manager or PowerShell, verify that Remote Management Uses Constrained Delegation:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Remote Management Uses Constrained Delegation:

Set-VM ... -Parameter Value
Set-VMHost ...

This setting ensures that PowerShell Direct Is Restricted on the Microsoft Hyper-V hypervisor. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Hyper-V hypervisor is essential for defense in depth.

In Hyper-V Manager or PowerShell, verify that PowerShell Direct Is Restricted:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure PowerShell Direct Is Restricted:

Set-VM ... -Parameter Value
Set-VMHost ...

This setting ensures that VM Connect Access Is Restricted on the Microsoft Hyper-V hypervisor. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Hyper-V hypervisor is essential for defense in depth.

In Hyper-V Manager or PowerShell, verify that VM Connect Access Is Restricted:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure VM Connect Access Is Restricted:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Clipboard Redirection Is Disabled for Untrusted VMs on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that Clipboard Redirection Is Disabled for Untrusted VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Clipboard Redirection Is Disabled for Untrusted VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Drive Redirection Is Disabled for Untrusted VMs on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that Drive Redirection Is Disabled for Untrusted VMs:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Drive Redirection Is Disabled for Untrusted VMs:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Hyper-V Event Logs Are Collected on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Hyper-V Event Logs Are Collected:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Hyper-V Event Logs Are Collected:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Performance Monitoring Is Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Performance Monitoring Is Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Performance Monitoring Is Configured:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that VM Health Monitoring Is Enabled on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that VM Health Monitoring Is Enabled:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure VM Health Monitoring Is Enabled:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Integration Services Are Updated on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Integration Services Are Updated:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Integration Services Are Updated:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Orphaned Resources Are Removed on the Microsoft Hyper-V hypervisor. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Hyper-V hypervisor increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

In Hyper-V Manager or PowerShell, verify that Orphaned Resources Are Removed:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Orphaned Resources Are Removed:

Set-VM ... -Parameter Value
Set-VMHost ...

This recommendation verifies that Host Failover Clustering Is Properly Configured on the Microsoft Hyper-V hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Hyper-V hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

In Hyper-V Manager or PowerShell, verify that Host Failover Clustering Is Properly Configured:

Get-VM | Get-VMSecurity
Get-VMHost | Format-List

In Hyper-V Manager or PowerShell, configure Host Failover Clustering Is Properly Configured:

Set-VM ... -Parameter Value
Set-VMHost ...