Encryption At Host on Domain Controller VMs

Hi Richard Long,

It sounds like you're trying to enable Encryption At Host on your Domain Controller VMs in Azure and want to ensure you’re following the best practices for shutting them down properly. You're right that it's essential to shut down Domain Controllers from the Guest OS to maintain the VM-GenerationID, but this does not actually deallocate the VMs, which is necessary to apply the Encryption At Host settings.Here are the steps you can follow to handle this properly:

Shut Down the Domain Controller from the Guest OS: Log in to your Domain Controller VM and shut it down from within the operating system. This ensures that the VM-GenerationID remains intact.

Deallocate the VM: After shutting down the VM from the Guest OS, go to the Azure portal. Navigate to the VM's overview page and select “Stop” to deallocate the VM. You will need to manually deallocate it after the shutdown to enable changes like Encryption At Host.

Enable Encryption At Host: Once the VM is deallocated, you can now proceed with enabling Encryption At Host. Follow the steps in the Azure Documentation for enabling Encryption At Host based on your preference (Azure CLI, PowerShell, or Azure Portal).

https://learn.microsoft.com/en-us/azure/virtual-machines/linux/disks-enable-host-based-encryption-cli

Restart the VM: After enabling the Encryption At Host, start your VM from the Azure portal.

This method ensures that your Domain Controllers are shut down correctly while allowing for the necessary changes to be applied.

If you found information helpful, please click "Upvote" and "Accept Answer".

Thank You.