When backing up VMs that have been enabled with vTPM (recommended for Windows 11 Guest OS), the backup may fail with the message "Error downloading config files
"
This can occur if the backup solution user ID is assigned a vCenter role other than the 'Administrator' role.
ESXi 6.7
ESXi 7.x
ESXi 8.x
After a VM has configured with vTPM support, the configuration files on the VM are encrypted by the vCenter using the configured KMS.
For vTPM only configurations, only the config files are encrypted. The vTPM VM's vmdk disks are not encrypted unless other actions are taken to encrypt the entire VM.
Web UI shows VM Details show VM encryption is in use:
A VADP backup of a vTPM/encrypted VM will fail with an error message "Error downloading config files
" unless the vCenter role assigned to the user ID for backup solution is configured with specific cryptographic privileges.
Verify the vCenter Role assigned to the backup user ID has the following cryptographic privileges:
Cryptographic Operations > Direct Access
Cryptographic Operations > Encrypt
Cryptographic Operations > Add Disk
Cryptographic Operations > Register VM