Enabling Hyper‑V Nested Virtualization on Windows Server 2022: A Practical Guide

Problem: You need a Hyper‑V host inside a VM for labs, training, or CI/CD pipelines

Many scenarios require a virtual machine that can itself run Hyper‑V workloads—for example, testing a cluster build, demonstrating nested virtualization to students, or running isolated build agents. Without nested virtualization, the inner Hyper‑V role cannot be started, forcing you to use separate physical hardware or more complex work‑arounds.

Thesis: By exposing virtualization extensions to a Generation 2 VM, you can run a fully functional Hyper‑V stack inside that VM, while understanding the performance and feature trade‑offs.

Prerequisites and hardware checks

• Host OS: Windows Server 2016/2019/2022 or Windows 10/11 (version 1607+).
• CPU with second‑level address translation (Intel VT‑x with EPT or AMD‑V with RVI).
• Hyper‑V role already installed on the host.
• Administrative rights in PowerShell.

Verify host support before proceeding:

systeminfo | findstr /R /C:"VM Monitor Mode Extensions" /C:"Virtualization Enabled In Firmware" /C:"Second Level Address Translation Extensions"

Each line should show Yes. If any line shows No, the host cannot run nested virtualization.

Configure the guest VM for nested virtualization

1. Create a Generation 2 VM (or convert an existing Generation 1 VM to Generation 2, noting that this requires a fresh OS install).
2. Ensure the VM is powered off.
3. Run the following PowerShell snippet on the host, replacing <VMName> with your VM’s name:

Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true

This command must be executed in an elevated PowerShell session. It modifies the VM’s processor settings; the VM must be off for the change to take effect.

After setting the flag, confirm it took effect:

Get-VMProcessor -VMName <VMName> | Format-List VMName, ExposeVirtualizationExtensions

The output should show ExposeVirtualizationExtensions : True.

Worked example: Installing Hyper‑V inside the guest and launching a second‑level VM

Assuming the guest VM is running Windows Server 2022:

1. Inside the guest, open PowerShell as Administrator and install the Hyper‑V role:

Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart

After the restart, verify the Hyper‑V role is present:

Get-WindowsFeature Hyper-V

Now create a second‑level VM (L2) within the guest. For a quick test, deploy a minimal Ubuntu cloud image:

1. Download an Ubuntu Server cloud image (e.g., ubuntu-22.04-live-server-amd64.iso) to the guest.
2. In the guest’s Hyper‑V Manager, create a new Generation 2 VM, attach the ISO, and start it.
3. If the VM boots and you can complete the installation, nested virtualization is functioning.

No output from these steps is guaranteed; success is observed by the ability to power on the L2 VM and interact with its console.

Trade‑offs and limitations

• Performance: Two layers of address translation and trap‑and‑emulate overhead can reduce CPU throughput by roughly 10‑30 % compared to a single‑level Hyper‑V host, depending on workload intensity.
• Feature gaps: Certain Hyper‑V capabilities are unavailable inside the nested VM, including Discrete Device Assignment (GPU passthrough), some USB redirection, and Credential Guard.
• Security baseline impact: Enabling ExposeVirtualizationExtensions disables host‑level Hyper‑V security baselines such as Host Guardian Service (HGS). Review compliance requirements before using this in production.
• Storage and networking: These pass through largely unchanged, but advanced features like SR‑IOV or VMM‑managed switches may not be fully functional in the nested stack.

Actionable closing

If you need a disposable Hyper‑V host for experimentation, follow the steps above in an isolated lab environment. Monitor host CPU usage (e.g., via Task Manager or Performance Monitor) to gauge the overhead for your specific workloads. When the nested VM is no longer needed, simply shut it down and, if desired, run Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $false to re‑enable the host’s security baselines.