Skip to content

Instantly share code, notes, and snippets.

@valorad

valorad/Export-UntrustedGuardian.ps1

Last active November 12, 2025 19:49
Show Gist options
  • Save valorad/b2df10f04d5a6ab15c88f72474f3c20f to your computer and use it in GitHub Desktop.
Save valorad/b2df10f04d5a6ab15c88f72474f3c20f to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. valorad revised this gist Oct 10, 2021. No changes.
  2. valorad created this gist Oct 10, 2021.
    23 changes: 23 additions & 0 deletions Export-UntrustedGuardian.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    $GuardianName = 'UntrustedGuardian'
    $CertificatePassword = Read-Host -Prompt 'Please enter a password to secure the certificate files' -AsSecureString

    $guardian = Get-HgsGuardian -Name $GuardianName

    if (-not $guardian)
    {
    throw "Guardian '$GuardianName' could not be found on the local system."
    }

    $encryptionCertificate = Get-Item -Path "Cert:\LocalMachine\Shielded VM Local Certificates\$($guardian.EncryptionCertificate.Thumbprint)"
    $signingCertificate = Get-Item -Path "Cert:\LocalMachine\Shielded VM Local Certificates\$($guardian.SigningCertificate.Thumbprint)"

    if (-not ($encryptionCertificate.HasPrivateKey -and $signingCertificate.HasPrivateKey))
    {
    throw 'One or both of the certificates in the guardian do not have private keys. ' + `
    'Please ensure the private keys are available on the local system for this guardian.'
    }

    Export-PfxCertificate -Cert $encryptionCertificate -FilePath ".\$GuardianName-encryption.pfx" -Password $CertificatePassword
    Export-PfxCertificate -Cert $signingCertificate -FilePath ".\$GuardianName-signing.pfx" -Password $CertificatePassword

    # Adapted from https://nathanblasac.com/error-when-migrating-hyper-v-vm-lab-to-different-host-the-key-protector-could-not-be-unwrapped-f6174f68a860
    5 changes: 5 additions & 0 deletions Import-UntrustedGuardian.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    $NameOfGuardian = 'previous-host-name-unTG'
    $CertificatePassword = Read-Host -Prompt 'Please enter the password that was used to secure the certificate files' -AsSecureString
    New-HgsGuardian -Name $NameOfGuardian -SigningCertificate ".\$NameOfGuardian-signing.pfx" -SigningCertificatePassword $CertificatePassword -EncryptionCertificate ".\$NameOfGuardian-encryption.pfx" -EncryptionCertificatePassword $CertificatePassword -AllowExpired -AllowUntrustedRoot

    # Adapted from https://nathanblasac.com/error-when-migrating-hyper-v-vm-lab-to-different-host-the-key-protector-could-not-be-unwrapped-f6174f68a860