Creating a Windows 11 VM in vCenter fails with error: "Microsoft Windows 11 requires a Virtual TPM device, which cannot be added to this virtual machine..."

Products

• VMware vCenter Server

Issue/Introduction

When attempting to deploy or create a Windows 11 virtual machine in a vSphere environment, the task fails during the guest OS selection or hardware customization phase.
 

An error is encountered stating:

"Microsoft Windows 11 (64-bit) requires a Virtual TPM device, which cannot be added to this virtual machine because the vSphere environment is not configured with a key provider."

or,

"Microsoft Windows 11 requires a Virtual TPM device, which cannot be added to this virtual machine because the vSphere environment is not configured with a key provider."

When deploying Windows 11 virtual machines (VMs) in VMware vSphere, a Virtual Trusted Platform Module (vTPM) is a mandatory requirement. vTPM provides enhanced security by allowing guest operating systems to store sensitive cryptographic information, such as encryption keys.

Environment

 VMware vCenter Server 8.0.x / 7.0.x

 VMware vSphere ESXi 8.0.x / 7.0.x

Cause

Windows 11 mandates a Virtual Trusted Platform Module (vTPM) 2.0. In vSphere, a vTPM requires an active Key Provider (Native or Standard) to manage encryption keys for the VM's security data.

Resolution

Step 1: Configure a Native Key Provider (NKP)  (see vSphere Native Key Provider Overview)

1. Log in to the vSphere Client.
2. Navigate to vCenter Server > Configure > Security > Key Providers.
3. Click Add > Add Native Key Provider.
4. Enter a Name for the provider.
5. If physical ESXi hosts do not contain hardware TPM 2.0 chips, uncheck Use key provider only with TPM-protected ESXi hosts.
6. Select the new provider and click Back Up.
7. Download and securely store the .p12 backup file. The Key Provider transitions to Active only after this backup is complete.

Step 2: Add vTPM to the Virtual Machine (Create a Virtual Machine with a Virtual Trusted Platform Module)

1. Initiate the New Virtual Machine workflow or edit settings of a powered-off VM.
2. In the Customize Hardware step, select Add New Device > Trusted Platform Module.
3. Navigate to VM Options > Boot Options.
4. Set Firmware to EFI and ensure Secure Boot is enabled.
5. Complete the VM creation and proceed with the Windows 11 installation.

 

Additional Information

If you require further assistance,  Contact Broadcom Support