Quiesced snapshot fails on encrypted VMs with error: "DecryptWithPadding: Failed because padding is too short or too long"
search cancel

Quiesced snapshot fails on encrypted VMs with error: "DecryptWithPadding: Failed because padding is too short or too long"

book

Article ID: 382277

calendar_today

Updated On:

Products

VMware vSphere ESXi VMware vCenter Server

Issue/Introduction

When attempting to run a backup or take a snapshot of an encrypted Virtual Machine (VM), the operation fails during the quiescing phase with the following behavior:

  • Backup software reports a failure during application-consistent/VSS quiescing.

  • The backup software falls back to a non-quiesced (file system-consistent) snapshot, which completes successfully.

  • The vmware.log file for the affected VM contains the following error messages:

2026-08-06T14:09:56.960Z In(05) vmx 4082998a-ce-f81a SnapshotVMX_TakeSnapshot start: 'Image_23536652b', deviceState=0, lazy=0, quiesced=1, forceNative=0, tryNative=1, saveAllocMaps=0
2026-08-06T14:09:56.960Z In(05) vmx 4082998a-ce-f81a 49456522:VVOLLIB : VVolLib_IsVectoredSnapSupported:14372: VVolLib_IsVectoredSnapSupported: vvolVectoredSnapEnabled: 1
2026-08-06T14:09:56.960Z In(05)+ vmx 4082998a-ce-f81a
2026-08-06T14:09:56.960Z In(05) vmx 4082998a-ce-f81a VVolObjNotifySnapshotPrepare: Changing state to VEC_SNAP_PREPARE_IN_PROG.
2026-08-06T14:09:56.960Z In(05) vmx 4082998a-ce-f81a OBJLIB-VVOLOBJ :VVolObjNotifySnapshotPrepare: Building in-mem cache
2026-08-06T14:09:57.014Z Er(02) vmx 4082998a-ce-f81a DecryptWithPadding: Failed because padding is too short or too long
2026-08-06T14:09:57.067Z Er(02) vmx 4082998a-ce-f81a DISKLIB-LIB_CREATE   : DiskLib_NotifySnapshotPrepare: FiltLib failed to notify snapshot prepare: Operation completes asynchronously
2026-08-06T14:09:57.389Z In(05) vmx 4082998a-ce-f81a DISKLIB-CBT   :ChangeTrackerESX_CreateMirror: Created mirror node /vmfs/devices/svm/b17cb04c-1117c8871-cbtmirror.
2026-08-06T14:09:57.435Z Er(02) vmx 4082998a-ce-f81a DISKLIB-LIB_CREATE   : DiskLib_NotifySnapshotPrepare: FiltLib failed to notify snapshot prepare: Operation completes asynchronously
2026-08-06T14:09:57.861Z In(05) vmx 4082998a-ce-f81a DISKLIB-CBT   :ChangeTrackerESX_CreateMirror: Created mirror node /vmfs/devices/svm/baa6b053-107345690-cbtmirror.
2026-08-06T14:09:57.911Z Er(02) vmx 4082998a-ce-f81a DISKLIB-LIB_CREATE   : DiskLib_NotifySnapshotPrepare: FiltLib failed to notify snapshot prepare: Operation completes asynchronously
2026-08-06T14:09:58.042Z In(05) vmx 4082998a-ce-f81a DISKLIB-CBT   :ChangeTrackerESX_CreateMirror: Created mirror node /vmfs/devices/svm/b831b05a-116c2887f-cbtmirror.
2026-08-06T14:09:58.069Z Er(02) vmx 4082998a-ce-f81a DISKLIB-LIB_CREATE   : DiskLib_NotifySnapshotPrepare: FiltLib failed to notify snapshot prepare: Operation completes asynchronously
2026-08-06T14:09:58.104Z In(05) vmx 4082998a-ce-f81a DISKLIB-CBT   :ChangeTrackerESX_CreateMirror: Created mirror node /vmfs/devices/svm/c1d3b064-1054a8882-cbtmirror.
2026-08-06T14:09:58.204Z In(05) vmx 4082998a-ce-f81a SNAPSHOT: SnapshotPrepareTakeDoneCB: Prepare phase complete (The operation completed successfully).
2026-08-06T14:09:58.209Z Er(02) vmx 4082998a-ce-f81a DecryptWithPadding: Failed because padding is too short or too long
2026-08-06T14:09:58.315Z In(05) vcpu-0 - [msg.snapshot.quiesce.startfail] Failed to start quiescing operation in the virtual machine.
2026-08-06T14:09:58.315Z In(05)+ vcpu-0 - The error message was: Error initializing quiesce operation.
2026-08-06T14:09:58.315Z In(05) vcpu-0 - ----------------------------------------
2026-08-06T14:09:58.317Z In(05) vcpu-0 - ToolsBackup: changing quiesce state: IDLE -> DONE
2026-08-06T14:09:58.317Z In(05) vcpu-0 - SnapshotVMXTakeSnapshotComplete: Done with snapshot 'Image_23536652b': 0

 

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x
VMware ESXi Server 7.x
VMware ESXi Server 8.x

Cause

  • Application-level consistent quiescing (Microsoft VSS application freeze) is not supported on virtual machines with VM Encryption enabled.

  • When a quiesced snapshot (quiesced=1) is requested on an encrypted VM, the VMX process attempts to process encrypted metadata payloads for the guest VSS application context. Because application-level quiescing is incompatible with VM Encryption, the cryptographic layer throws a DecryptWithPadding exception, causing the quiesce initialization to abort

    Refer the below documentation 

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-sdks-tools/8-0/virtual-disk-development-kit-programming-guide.html

 

Resolution

To resolve this issue, the backup job policy must be reconfigured to align with supported snapshot modes for encrypted virtual machines:

  1. Open the backup management console (e.g., Veeam, Commvault, Dell PowerProtect, Cohesity).

  2. Locate the backup job or policy managing the encrypted virtual machines.

  3. Disable Application-Aware Processing / VSS Application Quiescing.

  4. Set the snapshot processing mode to Crash-Consistent (or File-System Consistent without application VSS integration).

  5. Save the policy and retry the backup job.

Additional Information

App-quiescing is disabled in ESXi host side for encrypted VM and filesystem quiescing is forcibly requested (which requires VMware snapshot provider working well) when taking quiesced snapshot

Powered by Wolken Software