1 November 2026, 18:06Виталий Лещенко

Hyper-V. Part 2: How is Hyper-V built?

In the first part we installed the role, created a switch and a machine and installed a system in it, without thinking about what lies behind each command. Now let's work out what actually happened: what changed in the server after the role was installed, how the guest system reaches the disk and the network, what a machine's generation and its configuration version are, which files a machine consists of and how its states differ.

The hypervisor and partitions

Hyper-V is a type 1 hypervisor: it runs directly on the hardware rather than on top of an operating system. After the role is installed, the boot loader starts the hypervisor first, and it is the hypervisor that brings up Windows Server — not as the owner of the machine, but as the first virtual machine with special privileges. The documentation calls it the root or parent partition, and all other machines child partitions (Hyper-V architecture).

┌──────────────────────────┐  ┌──────────────────────────┐
│ Root partition           │  │ Child partition (VM)     │
│ Windows Server           │  │ guest OS                 │
│                          │  │                          │
│ vmms.exe   vmwp.exe ×N   │  │ VSC drivers              │
│ VSP drivers              │  │ (integration services)   │
│ device drivers           │  │                          │
└────────────┬─────────────┘  └────────────┬─────────────┘
             │            VMBus            │
             └──────────────┬──────────────┘
┌───────────────────────────┴────────────────────────────┐
│ Hypervisor: CPU, memory, interrupts                    │
└───────────────────────────┬────────────────────────────┘
┌───────────────────────────┴────────────────────────────┐
│ Hardware: CPU (VT-x/AMD-V, SLAT), RAM, disks, network  │
└────────────────────────────────────────────────────────┘

The hypervisor divides only the processor and memory: it hands out virtual processors to the partitions, isolates their address spaces and handles interrupts. Disks and network adapters are handled by the root partition — it has the real device drivers. A child partition sees virtual devices, and requests to them go to the root partition over VMBus, the communication channel between partitions. On the root partition's side the requests are accepted by the VSP (Virtualization Service Provider), on the guest's side they are sent by the VSC (Virtualization Service Consumer). A guest that knows it runs in a virtual machine and talks to the VSP directly is called "enlightened"; the VSC drivers come with the integration services — in modern Windows and in the Linux kernel they are already built in.

Two components that live in the root partition are something an administrator deals with all the time. The VMMS service (vmms.exe, Hyper-V Virtual Machine Management) stores the machines' configuration and executes PowerShell and Hyper-V Manager commands. Each running machine gets its own worker process vmwp.exe: it emulates that machine's devices, and if the machine has "hung" so badly that Stop-VM -TurnOff does not help, as a last resort it is this process that gets terminated.

Get-Service vmms
Get-CimInstance Win32_Process -Filter "Name = 'vmwp.exe'" | Select-Object ProcessId, CommandLine
Get-VM | Select-Object Name, Id

The command line of each vmwp.exe contains the machine's identifier — it is used to match the process to the Id from Get-VM.

Two practical consequences follow from this. The root partition is a virtual machine too, so nothing superfluous is installed on a Hyper-V host: everything that runs next to VMMS takes resources away from it and widens the attack surface. And for Hyper-V to work, the processor needs hardware virtualization (Intel VT-x or AMD-V) and SLAT — second level address translation (Intel EPT, AMD RVI), without which the role cannot be installed starting with Windows Server 2016 (hardware requirements). These are exactly what systeminfo checked in the first part.

Machine generation

When a machine is created, its generation is chosen, and it cannot be changed later (generation 1 or 2):

Generation 1 emulates a classic PC: BIOS, booting from an IDE disk, emulated devices. It is needed for 32-bit systems and for ready-made disks that do not boot via UEFI.
Generation 2 means UEFI, booting from a SCSI disk or from the network, Secure Boot, a virtual TPM and no emulation of legacy hardware. Microsoft recommends it by default; in Hyper-V Manager on Windows Server 2025 it is selected by default (what's new in 2025). Its limits are higher too: on Windows Server 2025 up to 2,048 virtual processors and 240 TB of memory versus 64 and 1 TB for generation 1 (limits).

Secure Boot is a UEFI mechanism that checks the boot loader's signature against a database of trusted certificates at boot. Generation 2 machines have it enabled with the Microsoft Windows template; Linux needs the MicrosoftUEFICertificateAuthority template, otherwise the Linux boot loader will not pass the check — this is the Set-VMFirmware line we ran for Linux in the first part (Set-VMFirmware).

Get-VMFirmware -VMName app1 | Format-List SecureBoot, SecureBootTemplate, BootOrder

Configuration version

The second characteristic of a machine is its configuration version. It defines the format of the machine's files, the set of features available to it and which hosts it will run on (configuration version). Which versions the host supports and which one it gives new machines by default is shown by Get-VMHostSupportedVersion (Get-VMHostSupportedVersion):

Get-VMHostSupportedVersion
Get-VMHostSupportedVersion -Default
Get-VM | Sort-Object Version | Format-Table Name, State, Version, Generation

A machine with a newer version will neither start nor import on a host that does not know that version. If a machine is going to be moved to a host with an older Windows Server, it is created with the older version — New-VM … -Version 9.0, and the version must be in the Get-VMHostSupportedVersion list of both hosts.

A machine moved or imported to a new host is not upgraded by itself: it keeps the old version and can go back. The upgrade — Update-VMVersion — requires the machine to be shut down and is irreversible: the version cannot be lowered afterwards (Update-VMVersion). When and in what order to raise the version when moving to a new Windows Server, we will cover in the parts about moving machines and about cluster maintenance.

Machine files

On disk, a machine is several files in the Virtual Machines\<GUID> folder inside the path set by Set-VMHost -VirtualMachinePath or by the -Path parameter of New-VM (table of files):

File	What it stores
`.vmcx`	configuration in binary format
`.vmrs`	state of a running or saved machine: contents of memory and devices
`.vmgs`	guest state: UEFI variables, TPM keys
`.vhdx` / `.avhdx`	disks; `.avhdx` are checkpoint differencing disks

Get-VM app1 | Format-List Name, Id, Path, ConfigurationLocation, SnapshotFileLocation
Get-ChildItem (Join-Path (Get-VM app1).ConfigurationLocation 'Virtual Machines') -Recurse

The configuration is edited only through PowerShell or Hyper-V Manager: .vmcx is a binary file, and manual changes to it are not supported. Disks are ordinary VHDX files; the next part is devoted to them, and .avhdx files are covered in the part about checkpoints.

Machine states

Get-VM | Format-Table Name, State, CPUUsage, MemoryAssigned, Uptime, Version, Generation
Stop-VM    -Name app1            # graceful shutdown via the Shutdown integration service
Stop-VM    -Name app1 -TurnOff   # "pull the plug"
Save-VM    -Name app1            # save memory to .vmrs and stop
Suspend-VM -Name app1            # pause: memory stays in the host's RAM
Resume-VM  -Name app1
Restart-VM -Name app1 -Force

The difference between the ways of stopping matters. Stop-VM without switches asks the guest to shut down by itself, as if "Shut down" were pressed inside — this requires the Shutdown integration service. If the guest does not respond to it (the system has not booted or the service is disabled), Stop-VM asks whether to turn the machine off hard — the same as -TurnOff (Stop-VM). -TurnOff turns the machine off instantly, without the guest's participation, at the risk of losing unwritten data. Save-VM writes memory and device state to .vmrs, and after Start-VM the machine continues from the same point — like a laptop after hibernation. Suspend-VM writes nothing to disk: the machine freezes but keeps all its memory on the host.

What to do with a machine when the host restarts is set by AutomaticStartAction and AutomaticStopAction (Set-VM):

Set-VM -Name app1 -AutomaticStartAction Start -AutomaticStartDelay 60 -AutomaticStopAction ShutDown
Get-VM | Format-Table Name, AutomaticStartAction, AutomaticStartDelay, AutomaticStopAction

AutomaticStartAction is Nothing, Start or StartIfRunning (start if the machine was running when the host was shut down). The start delay keeps a dozen machines from starting to boot from one volume at the same time. AutomaticStopAction is ShutDown, Save or TurnOff; Save is the default and leaves a file the size of the machine's memory on the volume.

Integration services

Integration services are a set of VMBus channels between the host and the guest (integration services):

Service	What it does
Shutdown	the host asks the guest to shut down gracefully — this is what `Stop-VM` uses
Heartbeat	the guest regularly reports that it is alive
Time Synchronization	brings the guest's clock in line with the host's clock
Key-Value Pair Exchange	exchange of key–value pairs (called Data Exchange in the documentation): from them the host knows the guest's name and addresses
VSS	the host makes consistent copies of the disks of a running machine
Guest Service Interface	copying files from the host into the guest

Each service must be enabled on both sides: in the machine settings on the host and in the guest itself. On Windows guests all of them are enabled by default except Guest Service Interface (same source).

Get-VMIntegrationService -VMName app1
Enable-VMIntegrationService -VMName app1 -Name 'Guest Service Interface'
Copy-VMFile -Name app1 -SourcePath 'D:\dist\agent.msi' -DestinationPath 'C:\Temp\agent.msi' -CreateFullPath -FileSource Host

PrimaryStatusDescription in the output of Get-VMIntegrationService shows whether the service responds on the guest side. The IPAddresses column in Get-VMNetworkAdapter and Heartbeat in Get-VM are filled in precisely through these services: without them, the host does not know what is happening inside.

A separate note on time synchronization: a virtual domain controller must not take its time from the host if the host itself takes its time from that controller — the circle closes. Domain controllers usually have the Time Synchronization service disabled and are left with the domain time hierarchy:

Disable-VMIntegrationService -VMName dc1 -Name 'Time Synchronization'

Virtual TPM

Generation 2 machines can be given a virtual TPM — Windows 11, BitLocker inside the guest and some security tools require it. The TPM keys are stored in the .vmgs file and are encrypted by a key protector; on a standalone host this is a local key protector (Enable-VMTPM):

Set-VMKeyProtector -VMName app1 -NewLocalKeyProtector
Enable-VMTPM       -VMName app1
Get-VMSecurity     -VMName app1

A machine with a local key protector will start only where the certificates of that protector are present: when it moves to another host, they must be moved along with it. In organizations with many such machines this task is handled by the Host Guardian Service, but that is a separate big topic.

Looking at it by hand

The host and its machines in one table:

Get-VM | Sort-Object Name | Format-Table Name, State, Generation, Version,
    @{n='vCPU'; e={$_.ProcessorCount}},
    @{n='MemGB'; e={[math]::Round($_.MemoryAssigned/1GB, 1)}},
    @{n='Uptime'; e={$_.Uptime.ToString('d\.hh\:mm')}}

The parameters of the host itself — default paths, number of logical processors, memory:

Get-VMHost | Format-List Name, LogicalProcessorCount, MemoryCapacity,
    VirtualMachinePath, VirtualHardDiskPath, VirtualMachineMigrationEnabled

Machines whose integration services do not respond are the first candidates for problems with Stop-VM and backup:

Get-VM | Where-Object State -eq 'Running' | Get-VMIntegrationService |
    Where-Object { $_.Enabled -and $_.PrimaryStatusDescription -ne 'OK' } |
    Format-Table VMName, Name, PrimaryStatusDescription

Sources

Hyper-V Architecture — root and child partitions, VMBus, VSP and VSC, enlightened guests;
Hyper-V host hardware requirements — hardware virtualization and SLAT;
Should I create a generation 1 or 2 virtual machine in Hyper-V? — machine generations and their differences;
What's new in Windows Server 2025 — generation 2 by default in Hyper-V Manager;
Plan for Hyper-V scalability — processor and memory limits of machines;
Set-VMFirmware — Secure Boot and its templates;
Upgrade virtual machine version in Hyper-V — configuration versions, table of machine files;
Get-VMHostSupportedVersion and Update-VMVersion — supported versions and upgrading them;
Stop-VM and Set-VM — stopping a machine and actions on host restart;
Manage Hyper-V Integration Services — list of integration services and enabling them;
Enable-VMTPM — virtual TPM and key protector.

Now it is clear what happens under each command of the first part: the hypervisor divides the processor and memory, the root partition serves the devices, and the guest talks to it over VMBus through the integration services. A machine is the .vmcx configuration, the .vmrs and .vmgs state, and disks.

Next — part 3: configuring virtual disks. The VHD and VHDX formats, fixed, dynamic and differencing disks, resizing on the fly, compacting and converting, attaching disks to the machine's controllers and to the host itself, pass-through physical disks and a shared disk for a guest cluster.