Stand the Hyper-V cluster up: two nodes to the written baseline Start this lab

Why this matters

A Hyper-V node can see, stop and copy every machine running on it, so the settings that look like housekeeping — an agreed clock, Credential Guard, attestation, restricted remote management, events sent somewhere else — are the controls that decide whether anything you later find on that cluster can be trusted. Building to a written baseline turns the state of the platform into a number instead of an argument.

Concepts

Objectives graded

• Open Hyper-V Manager and read the Baseline tab before changing a single setting.
• Work the failures in severity order, starting with the missing quorum witness.
• Set time sources, Credential Guard, attestation and restricted remote management on both nodes.
• Enable live migration, authenticate it with Kerberos and encrypt it; forward events to the collector.
• Set a witness, turn cluster-aware updating and balancing on, and add the second path to both volumes.
• Give management its own VLAN, block MAC spoofing, turn both guards on and team two adapters.
• Turn Secure Boot and a vTPM on for every generation 2 machine, switch to production checkpoints, register the machines as clustered roles and start them.
• Read the score again and name the one gap the console cannot close.

MITRE ATT&CK coverage

An unhardened Hyper-V cluster hands an intruder the management plane, the migration network and every machine on it at once. Building to the written baseline — attestation, Credential Guard, authenticated encrypted migration, forwarded events — closes the doors a hostile inventory of the nodes would walk through.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The cluster was worked in the console rather than described from the ticket.

  investigation · weight 15

• The cluster was measured before it was changed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The size of the gap was counted rather than eyeballed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Work was ordered by severity, starting with the critical gap.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The weakest area was identified from the per-area totals.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The cluster was actually configured and the improvement measured, not asserted.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The residual gap was named honestly instead of being quietly left out.

  configuration · weight 10 · T1016 System Network Configuration Discovery (Discovery)

Common mistakes

• Changing settings first and reading the score afterwards, so there is nothing to compare against.
• Leaving management on the same VLAN as the workloads because it works anyway.
• Registering machines as clustered roles without a witness, so failover has no quorum to act on.
• Calling the build finished while the check nobody could close goes unmentioned.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.