Backups of vTPM enabled VMs fail with 'Error downloading config files" - vTPM Privilege Requirements for VM Backup and Restore Tasks
search cancel

Backups of vTPM enabled VMs fail with 'Error downloading config files" - vTPM Privilege Requirements for VM Backup and Restore Tasks

book

Article ID: 378811

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

When backing up VMs that have been enabled with vTPM (recommended for Windows 11 Guest OS), the backup may fail with the message "Error downloading config files"
This can occur if the backup solution user ID is assigned a vCenter role other than the 'Administrator' role. 

Environment

ESXi 6.7
ESXi 7.x
ESXi 8.x

Cause

After a VM has configured with vTPM support, the configuration files on the VM are encrypted by the vCenter using the configured KMS. 
For vTPM only configurations, only the config files are encrypted. The vTPM VM's vmdk disks are not encrypted unless other actions are taken to encrypt the entire VM.

Web UI shows VM Details show VM encryption is in use:

A VADP backup of a vTPM/encrypted VM will fail with an error message "Error downloading config files" unless the vCenter role assigned to the user ID for backup solution is configured with specific cryptographic privileges.

 

Resolution

Verify the vCenter Role assigned to the backup user ID has the following cryptographic privileges:



  • In vCenter Web UI, navigate to 'Administration | Roles'

  • Verify/Add the following cryptographic permissions for the backup ID's assigned role as needed:


    • Cryptographic Operations > Direct Access

    • Cryptographic Operations > Encrypt

    • Cryptographic Operations > Add Disk


      • This privilege is needed for hot-add VADP backup solutions. The backup software must also support encryption of the proxy VM. Verify VADP encrypted backup compatibility with the backup solution vendor as needed.



    • Cryptographic Operations > Register VM


      • This privilege is needed to restore an encrypted VM.





Additional Information