updates

Author: v-lianna

support/windows-server/high-availability/hyper-v-nested-virtualization.md

@@ -10,249 +10,275 @@ ms.custom:
 - sap:clustering and high availability\nested virtualization
 - pcy:WinComm Storage High Avail
 ---
-# Troubleshooting Guide: Hyper-V Nested Virtualization
-
-## Introduction
+# Troubleshooting guide: Hyper-V nested virtualization
 
 Nested virtualization allows you to run Hyper-V (or other hypervisors) within a virtual machine, enabling powerful development, testing, and learning scenarios where you need virtual machines inside other VMs. This is typically available on Windows Server 2016 or later, Windows 10/11 Pro and Enterprise (with Hyper-V), and supported Azure virtual machine series. Nested virtualization introduces complexity—networking, memory, CPU compatibility, host/guest configuration, and performance often require careful consideration. This guide provides a structured approach for troubleshooting nested virtualization issues in physical and cloud-based environments.
 
 ## Troubleshooting Checklist
 
 Before diving into specific issues, follow this checklist to ensure the environment is correctly set up for nested virtualization:
-1. **Verify Host Compatibility**    - Host is Windows Server 2016+ or Windows 10/11 Pro/Enterprise.
+
+1. Verify host compatibility
+
+    - Host is Windows Server 2016 and later versions, or Windows 10/11 Pro/Enterprise.
     - Host CPU supports VT-x (Intel) or AMD-V (AMD); Hardware virtualization enabled in BIOS/UEFI.
-2. **Confirm Guest VM Settings**    - Guest VM is Generation 2.
-    - Guest VM running compatible OS (Windows Server 2016+, Windows 10/11+, select Linux with Hyper-V support).
-3. **Enable Nested Virtualization**    - For Hyper-V, set via PowerShell:
 
-        ```plaintext
-        Set-VMProcessor -VMName "<VMName>" -ExposeVirtualizationExtensions $true
-        ```
+1. Confirm guest VM settings
+
+    - Guest VM is Generation 2.
+    - Guest VM running compatible OS (Windows Server 2016, and later versions, Windows 10/11, and later versions, select Linux with Hyper-V support).
+
+1. Enable nested virtualization
 
-        **Copy**
-        - VM must be powered off.
-4. **CPU, Memory & Resource Allocation**    - Assign at least two virtual CPUs to nested VM.
+    - For Hyper-V, set via PowerShell:
+
+      ```powershell
+      Set-VMProcessor -VMName "<VMName>" -ExposeVirtualizationExtensions $true
+      ```
+
+    - VM must be powered off.
+
+1. CPU, memory, and resource allocation
+
+    - Assign at least two virtual CPUs to nested VM.
     - Sufficient memory assigned (recommended ≥ 4GB for the VM hosting nested VMs).
-5. **Network Configuration**    - Use an "External" virtual switch for the guest VM to enable outbound access.
+
+1. Network configuration
+
+    - Use an "External" virtual switch for the guest VM to enable outbound access.
     - Ensure NAT/port forwarding is correctly set up if needed.
-6. **Update Host & Guest**    - Fully patch and update Windows OS for host and guest.
+
+1. Update host and guest
+
+    - Fully patch and update Windows OS for host and guest.
     - Use latest Hyper-V Integration Services and drivers.
-7. **Check Security & Policy**    - Credential Guard and Device Guard may block nested virtualization.
+
+1. Check security and policy
+
+    - Credential Guard and Device Guard might block nested virtualization.
     - No conflicting Group Policies or anti-virus blocking Hyper-V processes.
 
-## Common Issues and their Respective Solutions
+Here are common issues and their respective solutions:
 
-### 1. **Nested VM Cannot Start Hyper-V Role or Install Other Hypervisors**
+## Nested VM can't start Hyper-V role or install other hypervisors
 
-**Symptoms:**
 - Errors when enabling or installing Hyper-V in a VM.
 - "Hyper-V cannot be installed: The processor does not have required virtualization capabilities" or similar.
 - Role installation fails without detailed errors.
 
-**Root Causes:**
+### Root causes
+
 - Virtualization extensions not exposed to the guest VM.
-- Guest VM is not Generation 2 or running unsupported OS/version.
+- Guest VM isn't Generation 2 or running unsupported OS/version.
 - Insufficient resources assigned.
 
-**Resolution:**
+### Resolution
+
 1. Power off the guest VM.
 2. Run PowerShell on host:
 
-    ```plaintext
+    ```powershell
     Set-VMProcessor -VMName "<VMName>" -ExposeVirtualizationExtensions $true
     ```
 
-    **Copy**
-3. Confirm guest VM is Generation 2 (Hyper-V Manager > VM properties).
+3. Confirm guest VM is Generation 2 (**Hyper-V Manager** > **VM properties**).
 4. Ensure at least two virtual CPUs and ≥4GB RAM allocated.
 5. Reboot and retry enabling the Hyper-V role in the guest.
 
-### 2. **Network Connectivity Issues in Nested VMs**
+## Network connectivity issues in nested VMs
 
-**Symptoms:**
-- Nested VM cannot access external network.
+- Nested VM can't access external network.
 - Only internal connectivity works (Host <-> Guest), not Host <-> Physical LAN <-> Nested VM.
 - Unreachable IP, failed ping, or application connectivity.
 
-**Root Causes:**
-- Virtual Switch configured as "Internal" or "Private".
+### Root causes
+
+- Virtual switch configured as "Internal" or "Private."
 - NAT wrong configuration; port forwarding not set.
 - Windows Firewall or security software blocking traffic.
 
-**Resolution:**
+### Resolution
+
 1. In Hyper-V Manager, create or select an "External" virtual switch.
-2. Assign the external switch to the nested VM’s network adapter.
+2. Assign the external switch to the nested VM's network adapter.
 3. If using NAT with multiple guests, set up port forwarding:
 
-    ```plaintext
+    ```console
     netsh int portproxy add v4tov4 listenaddress=<host IP> listenport=<port> connectaddress=<nested VM IP> connectport=<port>
     ```
 
-    **Copy**
 4. Check Windows Firewall and disable or create rules to allow traffic.
 5. Restart VMs if network configuration changes.
 
-### 3. **Performance Degradation in Nested Virtualization**
+## Performance degradation in nested virtualization
 
-**Symptoms:**
 - Nested VM is slow, lags, or fails to install operating systems and roles.
 - Disk and network I/O bottlenecks.
 - High resource usage on host.
 
-**Root Causes:**
+### Root causes
+
 - Under-provisioned resources—CPU, RAM, disk.
 - Overcommitted host resources.
 - Outdated host/hypervisor drivers.
 - Bandwidth limitations due to virtual switch configuration.
 
-**Resolution:**
+### Resolution
+
 1. Increase guest VM vCPUs (minimum 2; recommended ≥4 for heavy workloads).
 2. Assign sufficient RAM (recommended ≥4GB for guest; ≥8GB for host).
 3. Use fixed size VHDs instead of dynamically expanding for better performance.
 4. Ensure SSD-based storage for host and guest disks.
 5. Update host and guest integration services and drivers.
 6. Avoid running resource-intensive applications in other host VMs.
 
-### 4. **Nested Hyper-V Installation or Operation Blocked by Security Policies**
+## Nested Hyper-V installation or operation blocked by security policies
 
-**Symptoms:**
 - Hyper-V role installation blocked.
-- Errors referencing "Credential Guard" or "Device Guard".
+- Errors referencing "Credential Guard" or "Device Guard."
 - "Virtualization-based security is enabled. Nested virtualization is not supported."
 
-**Root Causes:**
+### Root causes
+
 - VBS, Credential Guard, Device Guard active in host or guest.
 - Group Policies or registry settings prevent virtualization extensions.
 
-**Resolution:**
-1. Disable Credential Guard/Device Guard in host and guest.    - Use Group Policy Editor (gpedit.msc) > Computer Configuration > Administrative Templates > System > Device Guard.
-2. If controlled by registry:
+### Resolution
+
+1. Disable Credential Guard/Device Guard in host and guest.
+
+    - Use Group Policy Editor (**gpedit.msc**) > **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
+1. If controlled by registry:
 
-    ```plaintext
+    ```console
     reg delete HKLM\System\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /f
     reg delete HKLM\System\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /f
     ```
 
-    **Copy**
-3. Reboot the VM.
-4. Verify with msinfo32 that VBS is "Not enabled".
+1. Reboot the VM.
+1. Verify with **Msinfo32.exe** that VBS is "Not enabled".
 
-### 5. **NAT & Port Forwarding Problems**
+## NAT and port forwarding issues
 
-**Symptoms:**
 - Unable to reach nested VMs from external networks.
-- "Process cannot access the file because it is being used by another process" when starting NAT Driver.
+- "Process cannot access the file because it is being used by another process" when starting NAT driver.
 - WinNAT service fails to start.
 
-**Root Causes:**
+### Root causes
+
 - Incorrect static mapping of ports.
 - Conflicting NAT configuration.
 - WinNAT file lock.
 
-**Resolution:**
+### Resolution
+
 1. Remove incorrect NAT configurations:
 
-    ```plaintext
+    ```console
     netsh nat delete <incorrect mapping>
     ```
 
-    **Copy**
-2. Restart host, ensure NAT/WinNAT service is not locked.
+2. Restart host, ensure NAT/WinNAT service isn't locked.
 3. Reconfigure NAT/port proxy for required connectivity:
 
-    ```plaintext
+    ```console
     netsh int portproxy add v4tov4 listenaddress=<host IP> listenport=<port> connectaddress=<nested VM IP> connectport=<port>
     ```
 
-    **Copy**
 4. Test connectivity from external host using ping and application ports.
 
-### 6. **Snapshot/Checkpoint and Differencing Disk Issues**
+## Snapshot/Checkpoint and differencing disk issues
+
+- Snapshots disappear or can't be merged.
+- Merge operation fails: "The system cannot find the file specified (0x80070002)" or "The chain of virtual hard disks is broken (0xC03A000D)."
 
-**Symptoms:**
-- Snapshots disappear or cannot be merged.
-- Merge operation fails: "The system cannot find the file specified (0x80070002)" or "The chain of virtual hard disks is broken (0xC03A000D)".
+### Root causes
 
-**Root Causes:**
 - Parent VHD file moved or deleted.
 - Hardware failure.
 - Broken differencing disk chain.
 
-**Resolution:**
+### Resolution
+
 1. Ensure all VHD/AVHDX files are in original location.
 2. Use PowerShell to check chain and merge:
 
-    ```plaintext
+    ```powershell
     Get-VHD -Path <AVHDX path> | fl \*
     Merge-VHD -Path <child AVHDX> -DestinationPath <parent VHD>
     ```
 
-    **Copy**
 3. If data recovery needed, restore parent disk from backup, then retry merge.
 
-### 7. **VM Resource Changes Not Recognized (e.g., RAM Increase)**
+## VM resource changes not recognized (for example, RAM increase)
 
-**Symptoms:**
-- VM does not detect increased RAM after configuration.
+- VM doesn't detect increased RAM after configuration.
 - No error, but resource remains at previous allocation.
 
-**Root Causes:**
+### Root causes
+
 - Configuration not applied/committed while VM was off.
 - Platform limitations (nested, cluster, or hot-add not supported).
 
-**Resolution:**
+### Resolution
+
 1. Power off VM before resizing resources.
-2. Use Hyper-V Manager > Edit VM settings > Increase RAM.
+2. Use **Hyper-V Manager** > **Edit VM settings** > **Increase RAM**.
 3. Start VM; verify resource allocation in guest OS.
 4. Review documentation for hot-add support in nested scenarios.
 
-## Data Collection
+## Data collection
 
 Gather the following data for troubleshooting and escalation:
-- **System Information**:    - Host and guest OS versions, build numbers.
-    - CPU type, RAM configuration.
-- **Virtual Machine Configuration**:    - Hyper-V Manager details (generation, CPUs, RAM, disks).
-    - Virtual switch/network setup.
-- **Event Logs**:    - Hyper-V logs: VMMS, Worker logs, System, Application.
-    - Cluster logs if in a failover setup.
-- **PowerShell Output**:
-
-    ```plaintext
+
+- System information:
+
+  - Host and guest OS versions, build numbers.
+  - CPU type, RAM configuration.
+- Virtual machine configuration:
+
+  - Hyper-V Manager details (generation, CPUs, RAM, disks).
+  - Virtual switch/network setup.
+- Event logs:
+
+  - Hyper-V logs: VMMS, Worker logs, System, Application.
+  - Cluster logs if in a failover setup.
+- PowerShell output:
+
+    ```powershell
     Get-VM -Name <VMName> | fl \*
     Get-VMProcessor -VMName <VMName>
     Get-VHD -Path <AVHDX path> | fl \*
     ```
 
-    **Copy**
-- **Network Traces**:
+- Network traces:
 
-    ```plaintext
+    ```console
     netsh trace start capture=yes scenario=Virtualization,NetConnection tracefile=<path>
     netsh trace start capture=yes scenario=NetConnection level=5 maxsize=1024 tracefile=<path>
     ```
 
-    **Copy**
-- **Screenshots/Error Messages**:    - Installation errors, role addition failure messages, device manager status.
-- **Procmon Trace** (for install/role activation issues).
-- **MiniDump Files** (if host or VM crashes).
+- Screenshots/Error messages:
+
+    Installation errors, role addition failure messages, device manager status.
+- Procmon trace (for install/role activation issues).
+- MiniDump files (if host or VM crashes).
 
-## Common Issues Quick Reference Table
+## Common issues quick reference table
 
-| Issue | Symptoms/Errors | Root Cause | Resolution Steps |
+| Issue | Symptoms/Errors | Root cause | Resolution steps |
 | --- | --- | --- | --- |
-| Nested VM can't start Hyper-V | Role install fails; CPU extension error | Extensions not exposed; Gen1 VM | Power off VM; Set-VMProcessor -ExposeVirtualizationExtensions $true; Use Gen2 VM; Assign ≥2 vCPUs |
+| Nested VM can't start Hyper-V | Role install fails; CPU extension error | Extensions not exposed; Gen1 VM | Power off VM; `Set-VMProcessor -ExposeVirtualizationExtensions $true`; Use Gen2 VM; Assign ≥2 vCPUs |
 | Network connectivity issues | No internet/LAN in nested VM | Internal switch/NAT misconfig | Use external switch; Correct NAT config; Allow firewall rules |
 | Slow performance | Lag; high resource usage | Under-provisioned resources | Increase vCPUs/RAM; Use SSDs; Update drivers |
-| Role or Hyper-V install blocked by security | Policy or VBS/Credential Guard errors | Device/Credential Guard enabled | Disable VBS/Credential Guard; Reboot |
-| NAT/port forwarding fails | Cannot connect to nested VM; WinNAT errors | Wrong mapping/service lock | Remove/re-add NAT config; Restart host; netsh portproxy commands |
-| Snapshot/disk chain broken | Merge fails; file not found; broken chain errors | Parent disk moved/deleted | Restore parent VHD; Get-VHD/Merge-VHD PowerShell commands |
+| Role or Hyper-V installation blocked by security | Policy or VBS/Credential Guard errors | Device/Credential Guard enabled | Disable VBS/Credential Guard; Reboot |
+| NAT/port forwarding fails | Can't connect to nested VM; WinNAT errors | Wrong mapping/service lock | Remove/re-add NAT config; Restart host; `netsh` `portproxy` commands |
+| Snapshot/disk chain broken | Merge fails; file not found; broken chain errors | Parent disk moved/deleted | Restore parent VHD; `Get-VHD`/`Merge-VHD` PowerShell cmdlets |
 | VM doesn't recognize increased RAM | No error; allocation unchanged | Setting not saved/applied, platform | Power off VM; Edit settings; Start VM; check host/cluster/nested support |
 
-## References
-- [<u>Microsoft Learn: Nested Virtualization</u>](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/nested-virtualization)
-- [<u>Configure Hyper-V Nested Virtualization</u>](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/nested-virtualization)
-- [<u>Set-VMProcessor Documentation</u>](https://learn.microsoft.com/en-us/powershell/module/hyper-v/set-vmprocessor)
+Nested virtualization is a powerful but complex feature that often encounters resource, networking, configuration, and security challenges. Troubleshooting starts with verifying correct setup and continues by addressing common failure modes including role install problems, networking misconfiguration, storage chain errors, and blocked installations due to security policies. Careful data collection, step-by-step diagnosis, and understanding of platform limitations are essential for stable operation. For persistent issues or unsupported scenarios, engaging with platform support or escalation might be required.
 
-## Summary
+## References
 
-Nested virtualization is a powerful but complex feature that often encounters resource, networking, configuration, and security challenges. Troubleshooting starts with verifying correct setup and continues by addressing common failure modes including role install problems, networking misconfiguration, storage chain errors, and blocked installations due to security policies. Careful data collection, step-by-step diagnosis, and understanding of platform limitations are essential for stable operation. For persistent issues or unsupported scenarios, engaging with platform support or escalation may be required.
+- [What is Nested Virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization)
+- [Set-VMProcessor](/powershell/module/hyper-v/set-vmprocessor)

support/windows-server/toc.yml

@@ -1140,6 +1140,10 @@ items:
     items:
     - name: Error 0x80090327 when adding a node to a cluster
       href: ./high-availability/error-0x80090327-adding-node-to-cluster.md
+  - name: Nested virtualization
+    items:
+    - name: 'Troubleshooting guide: Hyper-V nested virtualization'
+      href: ./high-availability/hyper-v-nested-virtualization.md
   - name: Node removed from the cluster
     items:
     - name: Cluster IP address resources fail on both nodes when one node disconnects