Share via

Detecting The Virtualization Layer From Within A Guest / Child Instance

  • Article

A while back I responded to an internal (Microsoft) e-mail where someone had requested information about how to detect if a Windows OS is running on Hyper-V.  It was a pretty good note, and Tony Soper posted it for me on his blog back in August of this year (https://blogs.technet.com/tonyso/archive/2009/08/20/hyper-v-how-to-detect-if-you-are-inside-a-vm.aspx).

Since it was posted, I received some questions about detecting more than just Hyper-V as a virtualization layer, and revisited the topic - with some help from others (like my buddy Ben who use VMware, Robin at Citrix, and Hashir at the Microsoft / Novell Joint Integration Lab in Cambridge).  They helped by running specific WMI queries in virtual machines on various virtualization platforms, to help identify easy ways to differentiate the platforms from within a VM.

Originally, I went after baseboard (motherboard) information.  The simplest way to do it is with WMIC (command line access to WMI). the following command:

wmic baseboard get manufacturer, product, Serialnumber, version

... would show something like this on a physical system:

wmic baseboard get <lots of stuff from a physical system>

In this case you can see thattn the For a virtual machine running on top of Hyper-V,  would see the following:

wmic baseboard get <lots of stuff from a VM on Hyper-V>

Since Microsoft does not manufacture motherboards with a product type of "Virtual Machine", it's pretty safe to assume you are running on top of a Microsoft virtualization layer.

What about other virtualization layers?  It turns out that "baseboard" is not the best WMI class  to interrogate for detecting common virtualization layers, because it is not always populated by virtualization vendors

A better class to interrogate is actually Win32_BIOS, as it (apparently) is more consistently populated by popular virtualization products (Microsoft, Xen, and VMware).  Using WMIC again to save coding / time:

wmic bios get serialnumber, version

...shows usable information for a physical system:

wmic bios get serialnumber, version <from a physical system>

An instance of Windows XP running on top of Hyper-V shows the following:

wmic bios get serialnumber, version <from a VM on Hyper-V>

Xen Results

Sorry I don't have screen shots of the results, but making the same call from a VM on top of Xen returns a big long (useless?) serialnumber similar to Hyper-V, and a Version that looked like:

wmic bios get version
Version
Xen - 0s

VMware Results

For VMware (ESX) the serialnumber was the telling element.  it was prefaced with VMware      

wmic bios get serialnumber
SerialNumber
VMware-50 21 9a 15 90 33 ea fa-e8 4f 22 4a db a5 e1 33

I do not know how the serial number is created or what it represents for any of the virtualization layers, but at least I now have a one line command I can run inside my servers (wmic bios get serialnumber, version) to figure out if they are virtualized and what type of virtualization they are running on.

Comments

  • Anonymous
    January 01, 2003
    Powershell query: $Result = $null $bios = gwmi Win32_BIOS  | Select-Object "version","serialnumber" if($bios.Version -match "VRTUAL") {$Result = "Virtual - Hyper-V"} elseif($bios.Version -match "A M I") {$Result = "Virtual -  Virtual PC"} elseif($bios.Version -like "Xen") {$Result = "Virtual - Xen"} elseif($bios.SerialNumber -like "VMware") {$Result = "Virtual - VMWare"} else {$Result = "Physical"} write-host $Result