{"id":350,"date":"2025-04-03T14:26:56","date_gmt":"2025-04-03T13:26:56","guid":{"rendered":"https:\/\/vtom.uk\/?page_id=350"},"modified":"2025-04-03T14:26:56","modified_gmt":"2025-04-03T13:26:56","slug":"esxi-backup-restore-tpm-key","status":"publish","type":"page","link":"https:\/\/vtom.uk\/index.php\/esxi-backup-restore-tpm-key\/","title":{"rendered":"ESXi &#8211; Backup &amp; Restore TPM key"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This document details the procedure for backing up the TPM Key from a new ESXi server with VMware ESXi installed. It also covers restoring the TPM Key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a TPM fails, or if you clear a TPM, you must recover the secure ESXi Configuration. Until you recover the configuration, the ESXi host cannot boot.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Recovering the secure ESXi configuration refers to the following situations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You cleared the TPM (that is, the seeds in the TPM were reset).<\/li>\n\n\n\n<li>The TPM failed.<\/li>\n\n\n\n<li>You replaced the motherboard or the TPM device, or both.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Process<\/strong> <strong>&#8211; Backup<\/strong><br>Enable SSH Access to the server (via vCenter): (From vCenter Hosts and Clusters view, select the server. Select \u201cServices\u201d (in the middle menu). Select \u201cSSH\u201d. Select \u201cSTART\u201d.)<br><br>SSH to the ESXi server<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enter the command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> esxcli system settings encryption recovery list <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Store the recovery key in an appropriate password management tool (Azure Keyvault\/PasswordState\/etc).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Disable SSH access to the server: (From vCenter Hosts and Clusters view, select the server. Select \u201cServices\u201d (in the middle menu). Select \u201cSSH\u201d. Select \u201cSTOP\u201d.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Process &#8211; Restore<\/strong><br>Start the ESXi host. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the ESXi installer window appears, press Shift+O to edit boot options.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To recover the configuration, at the command prompt, append the following boot option to any existing boot options.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>encryptionRecoveryKey=recovery_key<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The secure ESXi configuration is recovered and the ESXi host boots.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To persist the change, enter the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/sbin\/auto-backup.sh<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>This document details the procedure for backing up the TPM Key from a new ESXi server with VMware ESXi installed. It also covers restoring the TPM Key. If a TPM fails, or if you clear a TPM, you must recover the secure ESXi Configuration. Until you recover the configuration, the ESXi host cannot boot. Recovering &hellip; <a href=\"https:\/\/vtom.uk\/index.php\/esxi-backup-restore-tpm-key\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">ESXi &#8211; Backup &amp; Restore TPM key<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-350","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/pages\/350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/comments?post=350"}],"version-history":[{"count":1,"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/pages\/350\/revisions"}],"predecessor-version":[{"id":351,"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/pages\/350\/revisions\/351"}],"wp:attachment":[{"href":"https:\/\/vtom.uk\/index.php\/wp-json\/wp\/v2\/media?parent=350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}