Guide · Virtualisation
Backing up Hyper-V: application-consistent and complete
In short: a good Hyper-V backup is based on a recovery checkpoint that is application-consistent through VSS in the guest, reads only changed areas after the first backup and captures the configuration and vTPM state along with the disks. Without the certificates of the key protector, a VM with a vTPM cannot be opened on another host – something to think about before an emergency.
Not all checkpoints are the same
Hyper-V has standard and production checkpoints for administrators and recovery checkpoints for backup programs. A recovery checkpoint freezes the state of all virtual hard disks at one point in time while the VM keeps running. If the backup integration service is active in the guest, Hyper-V uses the Volume Shadow Copy Service (VSS) in the guest to make sure that applications such as Exchange, SQL Server or Active Directory write their data cleanly to disk first. The result is application-consistent.
Without the integration service, the backup is only crash-consistent – as if the VM had been switched off at that moment. The backup program should state this openly in its log.
Only read what has changed
With Resilient Change Tracking (RCT), Hyper-V keeps track of which areas of a virtual hard disk have changed since the last reference point. After the first full backup, only a fraction then needs to be read. Everything is read again if the basis has changed – for example after enlarging a disk, after a migration or a storage move.
What a complete backup includes
| Component | Purpose |
|---|---|
| All virtual hard disks (VHDX) | The data, captured at the same point in time |
| Configuration (.vmcx) | Processors, memory, network adapters, generation, firmware |
| Guest state (.vmgs) | UEFI variables and the state of the virtual TPM |
| Runtime state (.vmrs) | State file of the checkpoint |
| Guardian certificates (optional) | So that the vTPM state can be opened on a new host |
The vTPM pitfall
Windows 11 and Windows Server with BitLocker often use a virtual TPM. Its state is encrypted with the certificates of the host's local key protector (“Shielded VM Local Certificates”). If the VM is restored on a new host that lacks these certificates, it does not start or asks for the BitLocker recovery key. That is why the certificates – with their private key and only in encrypted form – belong in the emergency planning.
Restoring without disrupting operations
- As a new VM with a new ID and its own name, switched off – so it cannot collide with the original.
- Adjusting the network: assign virtual switches, and only take over static MAC addresses if the original is definitely off.
- Single files taken straight from the backup without restoring the disk, or individual disks restored as VHDX.
How AegisGrid backs up Hyper-V
AegisGrid backs up a VM on the host as a whole: all virtual hard disks, configuration and state files including the vTPM, based on a recovery checkpoint and application-consistent through VSS in the guest by default. Thanks to RCT, subsequent backups read only changed areas. If you wish, AegisGrid includes the Guardian certificates – only in encrypted destinations – and before a restore checks whether the target host can open the VM before it creates anything. Restores are made as a new VM or disk by disk. AegisGrid currently supports single Hyper-V hosts; failover clusters with CSV, pass-through disks, shared VHDX and shielded VMs are not yet supported.
Frequently asked questions about Hyper-V backup
Does an agent have to be installed in the guest?
No. For an application-consistent backup, the Hyper-V integration services in the guest are enough; current Windows versions already include them. The backup is made on the host.
Does the VM slow down during the backup?
The VM keeps running. While the checkpoint is being created, VSS in the guest briefly prepares the applications; afterwards data is read from the checkpoint, not from the running disk.
Can I get individual files from a VM backup?
Yes, without restoring the disk first. In the management console, choose a volume of the VM under “Restore files” and tick the files and folders you need, or open the volumes of a run as read-only folders. Windows reads NTFS, ReFS, FAT and exFAT. Alternatively, restore a single virtual hard disk as VHDX and mount it.
Back up your Hyper-V environment
In a pilot project we back up your VMs and restore them as a test.