A system for generating a virtual machine recovery environment, the system comprising: one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: detecting that an error condition occurs relating to a virtual machine executed by a hypervisor executing on a host, the virtual machine having a particular level of access protection secured by a secure key, wherein particular level of access protection secures access to the virtual machine prior to the error condition occurring; and based on the detecting of the error condition generating a virtual machine recovery environment that is executed by the hypervisor and that enforces the particular level of access protection for the virtual machine while executing within the virtual machine recovery environment, wherein the virtual machine is reconfigured to eliminate or to reduce the particular level of access protection while executing within the virtual machine recovery environment, the virtual machine recovery environment enforcing the particular level of access protection for the virtual machine while the virtual machine undergoes a repair procedure while executing within the virtual machine recovery environment, receiving an indication that the virtual machine is at least partially recovered, and based thereon causing the at least partially recovered virtual machine to be executed by the hypervisor and not the virtual machine recovery environment; wherein the virtual machine recovery environment represents an instance of a virtual machine executed by the hypervisor, wherein the virtual machine recovery environment is executed to wrap a damaged virtual machine to enable the damaged virtual machine to be repaired. one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: detecting that an error condition occurs relating to a virtual machine executed by a hypervisor executing on a host, the virtual machine having a particular level of access protection secured by a secure key, wherein particular level of access protection secures access to the virtual machine prior to the error condition occurring; and based on the detecting of the error condition generating a virtual machine recovery environment that is executed by the hypervisor and that enforces the particular level of access protection for the virtual machine while executing within the virtual machine recovery environment, wherein the virtual machine is reconfigured to eliminate or to reduce the particular level of access protection while executing within the virtual machine recovery environment, the virtual machine recovery environment enforcing the particular level of access protection for the virtual machine while the virtual machine undergoes a repair procedure while executing within the virtual machine recovery environment, receiving an indication that the virtual machine is at least partially recovered, and based thereon causing the at least partially recovered virtual machine to be executed by the hypervisor and not the virtual machine recovery environment; <EOS>