Issue/Introduction

This article troubleshoots a Windows Server 2025 virtual machine in ZSphere that has VMTools installed, uses a VirtIO system disk, and blue-screens on restart after joining an AD domain. Evaluate the Windows guest version, disk driver, CPU mode, VMX feature, Credential Guard/VBS state, and blue-screen evidence together.

Symptoms

• A Windows Server 2025 VM uses the VirtIO driver bundled with VMTools after VMTools installation.
• After joining an AD domain, the VM blue-screens on a subsequent restart and might not enter the operating system.
• After restart, Windows might remain in automatic repair with the console displaying the technical literals 正在准备自动修复 or 正在加载文件....
• In some environments, after a platform restart and switch to a VirtIO system disk, the VM blue-screens or cannot identify its boot disk.
• Customer and internal reproductions occurred on 4th- and 5th-generation Intel CPU environments. Verified CPUs include Intel Xeon Gold 5418Y and 4514Y.

Environment

• Product: ZSphere
• Versions: 4.10.x and 5.x
• Components: Virtual machine, VMTools, and VirtIO disk driver
• Guest OS: Windows Server 2025
• Deployment: A Windows Server 2025 VM uses a VirtIO system disk and joins an AD domain.
• CPU conditions: 4th- or 5th-generation Intel CPU environments, or Sapphire Rapids-related CPUs

Possible causes

This symptom might have one or more causes:

• After Windows Server 2025 joins an AD domain, domain policy might enable Credential Guard. Credential Guard depends on VBS, which causes Windows to start Hyper-V-related virtualization paths inside the VM.
• With VMX exposed, Windows might start nested virtualization in the guest. Particular CPU/QEMU-KVM combinations might blue-screen during restart.
• After VMTools installation, switching the system disk from IDE to VirtIO, or failure to load the VirtIO driver during boot, might make the system disk unbootable.
• Reapplied domain policy might overwrite the local Credential Guard disablement, causing recurrence on a later restart.
• Updating only the win-virtio driver to 0.1.284 or 0.1.290 does not reliably resolve the issue.

Resolution

Perform the checks in order and confirm each current state or next action.

1. Confirm VM and Windows guest conditions

• Check: Confirm this is a ZSphere Windows Server 2025 VM.
• UI path: In ZSphere VM details, view the Guest OS type, disk type, and VMTools state; in the Windows guest, view the system version.
• Expected result: The affected VM runs Windows Server 2025 and has VMTools installed.
• Exception handling: Otherwise, follow the ordinary Windows VM blue-screen or boot-failure path.

2. Confirm the system-disk (disk 1) driver and disk type

• Check: Determine whether disk 1 uses VirtIO and whether Windows recognizes its driver.
• UI path: View VirtIO/VirtIO-SCSI in ZSphere VM details or disk configuration, and inspect the disk-driver type and VirtIO devices in Windows Device Manager.
• Expected result: Windows recognizes the VirtIO driver and boots normally after disk-type switching.
• Exception handling: If switching to VirtIO immediately makes the boot disk unavailable or causes a blue screen, first troubleshoot the disk-type switch; do not attribute it directly to AD or Credential Guard.

3. Check AD domain and Credential Guard state

• Check: Determine whether the VM joined AD and domain policy enabled Credential Guard.
• Location: In Windows, inspect domain membership, Group Policy results, and Credential Guard/VBS configuration.
• Expected result: Without Credential Guard/VBS, an ordinary restart after joining the domain should not repeatedly cause this blue screen.
• Exception handling: If GPO enables Credential Guard and restarts keep failing, confirm GPO with the domain administrator. Local temporary disablement might be overwritten when domain policy reapplies.

3.1 View Credential Guard state

In the Windows guest, run these read-only checks as administrator:

1. Open PowerShell and run:

   msinfo32

2. In System Information, inspect these technical UI literals:

• 基于虚拟化的安全性
• Credential Guard
• Device Guard 安全服务正在运行

3. If Credential Guard or 基于虚拟化的安全性 is displayed as running, the Guest has the related security feature enabled. Check whether AD GPO delivered a Credential Guard/VBS policy.

4. You can also run this read-only command:

   Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

5. Inspect SecurityServicesRunning and VirtualizationBasedSecurityStatus:

• Credential Guard in SecurityServicesRunning means it is running.
• VirtualizationBasedSecurityStatus not being disabled means VBS is enabled or running.

6. If locally disabling it is later reversed, check domain-policy results:

   gpresult /h C:\gpresult.html

Open C:\gpresult.html and check for Credential Guard, Device Guard, or VBS policies delivered by domain GPO.

4. Check CPU mode and VMX

• Check: Whether the VM CPU mode exposes VMX.
• Location: Inspect VM CPU mode and, if necessary, CPU features in VM XML.
• Expected result: Environments requiring this workaround do not expose VMX to Windows or use a verified compatible CPU mode.
• Exception handling: If host-model or host-passthrough exposes VMX, test disabling VMX in a maintenance window, or test Haswell-noTSX or Broadwell-noTSX. Assess business impact because this affects nested virtualization inside the VM.

4.1 Temporarily disable VMX

During a maintenance window, an administrator with ZSphere permissions performs:

1. Record VM UUID, CPU mode, disk type, VMTools version, and current VM XML.
2. Shut down the VM, or confirm that the current ZSphere version supports changing the XML Hook in the required state.
3. Add this feature to the VM CPU through ZSphere XML Hook or equivalent advanced configuration:

   <feature policy="disable" name="vmx"/>

4. Save and confirm the configuration applies only to the affected Windows Server 2025 VM.
5. Start the VM and inspect XML again for policy="disable" and name="vmx".
6. Restart inside Windows and confirm normal entry without a blue screen.
7. To roll back, remove the VMX disablement from the XML Hook/advanced configuration, restore the recorded CPU configuration, and restart during a maintenance window.

If XML Hook is unsupported, switch CPU mode to a verified compatible mode such as Haswell-noTSX or Broadwell-noTSX. This also affects nested virtualization and requires customer confirmation.

5. Verify the workaround

• Check: Whether the adjusted VM can restart repeatedly and enter Windows.
• Location: Restart during a maintenance window and inspect Windows Event Log, blue-screen dumps, and QEMU logs.
• Expected result: After disabling VMX, using a compatible CPU mode, or having the domain administrator disable Credential Guard/VBS policy, the VM starts normally without a blue screen or automatic-repair loading screen.
• Exception handling: If it still blue-screens or remains at the technical UI literals 正在准备自动修复 or 正在加载文件..., preserve the site and collect console screenshots, stop code, C:\Windows\Minidump\*.dmp, C:\Windows\Memory.dmp, Windows Event Log, VM XML, QEMU logs, VMTools version, and CPU model for Technical Support.

6. Confirm version and product-improvement state

• Check: Whether the environment includes Windows Server 2025, VirtIO-driver, and nested-virtualization improvements.
• Location: Check ZSphere and VMTools versions and related bug status.
• Expected result: VMTools supports Windows Server 2025 Guest OS starting with ZSphere 4.10.18.
• Exception handling: For versions earlier than a delivered fix/improvement, evaluate upgrade, patch, or workaround against the maintenance window. Do not infer resolution only from replacing win-virtio.

Additional information

• Key conditions are Windows Server 2025, a VirtIO system disk, AD policy enabling Credential Guard/VBS, VMX exposed to the VM, and a specified Intel CPU environment together.
• Temporary workarounds include disabling VMX, using Haswell-noTSX or Broadwell-noTSX, or having the domain administrator adjust GPO to avoid Credential Guard/VBS for affected VMs.
• Disabling VMX or Credential Guard/VBS affects nested virtualization or Windows security capabilities. The customer must decide according to business and security requirements.