There are two types of attestation modes you can use with the host guardian service: 1  Admin-trusted attestation: Allows hosts that you have designated as guarded hosts in Active Directory to decrypt and start shielded VMs. You designate hosts as guarded by placing them in a global security group that is created in AD.