Update trusted-launch-faq.md

Update Trusted Launch --- deployment failures

Author: Howie425

articles/virtual-machines/trusted-launch-faq.md

@@ -390,6 +390,29 @@ VM Guest State (VMGS) is specific to Trusted Launch VMs. It's a blob managed by
 
 In a Secure Boot chain, each step in the boot process checks a cryptographic signature of the subsequent steps. For example, the BIOS checks a signature on the loader, and the loader checks signatures on all the kernel objects that it loads, and so on. If any of the objects are compromised, the signature doesn't match and the VM doesn't boot. For more information, see [Secure Boot](/windows-hardware/design/device-experiences/oem-secure-boot).
 
+### What should I do when my Trusted Launch VM has deployment failures ? 
+This section provides additional details on Trusted Launch deployment failures for you to take proper action to prevent them. 
+
+```
+Virtual machine <vm name> failed to create from the selected snapshot because the virtual Trusted Platform Module (vTPM) state is locked. To proceed with the VM creation, please select a different snapshot without a locked vTPM state. For more assistance, please refer to “Troubleshooting locked vTPM state” in FAQ page at https://aka.ms/TrustedLaunch-FAQ. 
+```
+This deployment error happens when the snapshot or restore point provided is inaccessible or unusable for the following reasons: 
+1. Corrupt virtual machine guest state (VMGS) 
+2. vTPM in a locked state  
+3. One or more critical vTPM indices are in an invalid state. 
+
+The above can happen if a user or workload running on the virtual machine sets the lock on vTPM or modifies critical vTPM indices that leaves the vTPM in an invalid state. 
+
+Retrying with the same snapshot/restore point will result in the same failure. 
+
+To resolve this: 
+
+1. On the source Trusted Launch VM where the snapshot or restore point was generated, the vTPM errors must be rectified.  
+a. If the vTPM state was modified by a workload on the virtual machine, you need to use the same to check the error states and bring the vTPM to a non-error state.  
+b. If TPM tools were used to modify the vTPM state, then you should use the same tools to check the error states and bring the vTPM to a non-error state.  
+
+Once the snapshot or restore point is free from these errors, you can use this to create a new Trusted Launch VM.  
+
 ### Why is the Trusted Launch VM not booting correctly?
 
 If unsigned components are detected from the UEFI (guest firmware), bootloader, OS, or boot drivers, a Trusted Launch VM won't boot. The [Secure Boot](/windows-server/virtualization/hyper-v/learn-more/generation-2-virtual-machine-security-settings-for-hyper-v#secure-boot-setting-in-hyper-v-manager) setting in the Trusted Launch VM fails to boot if unsigned or untrusted boot components are encountered during the boot process and reports as a Secure Boot failure.