@john-c As I mentioned in the release notes, @dinhngtu told me (and tested) that if Secure Boot is enforced, then Bitlocker doesn't fail on unexpected firmware changes. Maybe worth giving it a try?

According to Microsoft you need to use their built in backup feature or a software that supports AD and VSS which will tell the VM OS that it is going to be backed up. Unless you do this there might be corruption of the AD Databases according to Microsoft. ALL THO we've been backing up our AD servers with XOA snapshots (Both normal backup and incremental) and had only 1 issue since we started using XOA in 2016. Since that issue we also use a guest agent (From Ahsay CBS) that makes a Windows System State backup and Windows System Backup. More info about that can be found here: https://wiki.ahsay.com/doku.php?id=public:version_9:client:9447_system_state_backup_vs_system_backup

Since you're changing all of the underlying hardware that the guest has, Microsoft is going to force you to reactive. You could look at setting up a licensing server to manage these systems and then feed them that information so they can validate and then license. This isn't an issue presented by XCP-ng (or literally any other hypervisor), its a Microsoft restriction to ensure you aren't stealing their software.

@DustinB Those are the correct tools. As I know that you are already aware , Windows can be temperamental at times. I generally take a snapshot before ever attempting to install them so that I can restore and try again if the first attempt fails. You may need to remove them on the problematic VMs and try again.