enforce provisioning on starting VM