Unable to Change VM Encryption State When Snapshots Are Present

Products

• VMware vSAN

Issue/Introduction

Attempting to change a VM's encryption state (encrypting, decrypting, or re-encrypting) when snapshots are present fails 

We see errors in vpxd similar to:

2025-04-15T17:45:31.109Z info vpxd[40574] [Originator@6876 sub=CryptoManager opID=########-#######-auto-1bl82-h5:70324484-dd-01] Key info for VM enkrypt after reconfigure operation:
-->   Fault      : (vim.fault.InvalidVmConfig) {
-->    faultMessage = (vmodl.LocalizableMessage) [
-->       (vmodl.LocalizableMessage) {
-->          key = "msg.hostd.configSpec.enc.snapshots",
-->          message = "Cannot change encryption state with virtual machine snapshots present."
-->       }
-->    ],
-->    property = "config.crypto"
-->    msg = "Invalid virtual machine configuration."
--> }

Environment

vSphere 7.x 

vSphere 8.x 

Cause

VM encryption does not support modifying encryption settings on VMs with existing snapshots.

Resolution

Remove all snapshots before changing encryption state