After converting a template to a VM the vmxt file is deleted

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• When performing task like converting template to VM, you get the below error-

 

An encryption key is required. The required key is located on 'KMS'. A key with identifier '#################################################' is required to unlock this virtual machine. The virtual machine is locked.

 

• When attempting the same thing again we notice the vmx file is gone and we get the task error-

File [<Foldername>] Example/ExampleVM.vmxt was not found

 

• On vCenter the vpxd.log you will see following similar entries-

DD-MM-YYYY HH:MM info vpxd[20062] [Originator@6876 sub=Default opID=lf2eyxn9-14481775-auto-8me7k-h5:71633895-e2] [VpxLRO] -- ERROR task-3915483
-- vm-1149843 -- vim.VirtualMachine.relocate: vim.fault.EncryptionKeyRequired:
--> Result:
--> (vim.fault.EncryptionKeyRequired) {
-->  faultCause = (vmodl.MethodFault) null,
-->  faultMessage = (vmodl.LocalizableMessage) [
-->    (vmodl.LocalizableMessage) {
-->     key = "msg.hostd.vmState.locked",
-->     arg = <unset>,
-->     message = "The virtual machine is locked."
-->    },
-->    (vmodl.LocalizableMessage) {
-->     key = "msg.hostd.vmState.lockedKeyId",
-->     arg = (vmodl.KeyAnyValue) [
-->       (vmodl.KeyAnyValue) {
-->        key = "1",
-->        value = "##############################################################"
-->       }
-->     ],
-->     message = "A key with identifier '##############################################################' is required to unlock this virtual machine."
-->    },
-->    (vmodl.LocalizableMessage) {
-->     key = "msg.hostd.vmState.lockedProviderId",
-->     arg = (vmodl.KeyAnyValue) [
-->       (vmodl.KeyAnyValue) {
-->        key = "1",
-->        value = "NameOfKMS"
-->       }
-->     ],
-->     message = "The required key is located on 'NameOfKMS'."
-->    }
-->  ],
-->  requiredKey = (vim.encryption.CryptoKeyId) [
-->    (vim.encryption.CryptoKeyId) {
-->     keyId = "##################################################",
-->     providerId = (vim.encryption.KeyProviderId) {
-->       id = "NameOfKMS"
-->     }

Here "######################################################" differs based on customer environment key. NameOfKMS is the name given to KMS server on vCenter. 

 

 

Environment

VMware vSphere 7.0x

Cause

The virtual machine enters a locked state because the destination host does not have TPM enabled. This causes vmx file to be locked. When attempted again the vmx file is not able to be found .

Resolution

Currently the suggestion is to not use hosts that do not have TPM enabled or upgrade to vCenter 8.0 which will not let you select these hosts.

Additional Information

Similar situation if attempting to vMotion a vm and hitting this error: https://knowledge.broadcom.com/external/article/312389/vmotion-failing-with-error-an-encryption.html