Applies to: Enterprise and Audit
License requirement
Windows Server and virtual-machine operation require an Enterprise or Audit license. Standard and Pro are blocked in these environments even when the required erasure controls would otherwise be available.
Windows Server precautions
Before erasing data on a server:
- Confirm an approved maintenance window;
- Identify services that can lock or recreate files;
- Confirm cluster, replication, backup, snapshot, and failover behavior;
- Ensure adequate free-space reserve;
- Avoid free-space wiping on production volumes without explicit approval and testing;
- Confirm the consequence of removing shared application data;
- Preserve system and application logs needed for incident or legal purposes.
A client-side success result does not prove deletion from replicas, backups, storage snapshots, or remote nodes.
Virtual-machine precautions
A guest operating system sees a virtual disk, not the underlying physical media. Guest-level overwrite can be affected by:
- Hypervisor snapshots;
- Differencing disks;
- Thin provisioning;
- Deduplication;
- Storage-array snapshots;
- Backup images;
- Host file-system allocation;
- Cloud-provider replication.
Use CertErase in a VM only when the approved objective is guest-visible logical erasure. For VM decommissioning, remove snapshots and images and use the hypervisor, storage, encryption, and provider controls required by policy.
Detection issues
Virtual-machine detection is heuristic and can vary by platform or hardware presentation. Preserve the exact environment error and system information when escalating a false positive or false negative.