Error: "The selected virtual machine cannot be exported because it is encrypted" when cloning Windows 11 VMs to Content Library

Products

• VMware vCenter Server

Issue/Introduction

The following operations will fail when working with any VM encrypted with a vTPM module:

• Right clicking the VM > Clone > Clone as Template to Library... operation from existing vTPM enabled Windows 11 VM to the Content Library
• Right clicking the VM > Template > Export OVF Template

You may see the following messages when attempting the above operations:

• The operation is not supported on the object. The operation is not supported on encrypted VM The operation failed due to The operation is not supported on the object.
• The selected virtual machine cannot be exported because it is encrypted

Environment

• VMware vCenter Server 7.x
• VMware vCenter server 8.x
• Windows 11

Cause

Virtual machines with a vTPM device do not support the OVF/OVA template format directly.

Resolution

It is not supported to export a virtual machine with a vTPM device to an OVF/OVA file using the vSphere Client. The vTPM device must be first removed before you can export the VM as an OVF/OVA template.

1. Prepare the guest VM for vTPM removal by ensuring that none of its applications are using the vTPM device, such as BitLocker, etc.
   
   
2. Remove the vTPM device from the VM. The VM home will be decrypted unless there is a feature or policy that requires encryption.
   
   
3. If it was encrypted, decrypt the VM. OVF export does not work on encrypted VMs, so the VM must be decrypted before export.
   
   
4. Export the VM.

Additional Information

If you want a VM to contain a vTPM device, you can either create it as a placeholder in the OVF and have it auto configured, or you add the vTPM device after OVF import. See: TPM as a Virtual Device in OVF

Deploy and Export OVF and OVA Templates

vSphere Virtual TPM (vTPM) Questions & Answers