Disable and Ensure Complete Data Erasure from Datastore (Disk Groups)

Products

• VMware vSAN

Issue/Introduction

 

1. When decommissioning a vSAN cluster, it’s crucial to ensure that no data is left on the vSAN datastore, as it could potentially be retrieved later.  
2. The process involves disabling the vSAN feature, evacuating all data from the vSAN datastore, and properly erasing data to ensure it cannot be recovered.
3. The VMware infrastructure was impacted by a ransomware attack and the environment was compromised.

Cause

VMware vSAN 7.x
VMware vSAN 8.x

Resolution

 

Follow the steps below to safely disable vSAN and wipe the data from vSAN datastore

• Ensure that all virtual machines (VMs) on the vSAN datastore are migrated to other storage as the data will be completely erased.
   
• Delete the Disk Groups on all the hosts which are part of vSAN cluster by using the below article: 
  • How to remove a disk from a vSAN disk group/host 
    
    
• After all the Disk Groups are deleted, the vSAN cluster can be disabled by following the below article for all the hosts in vSAN cluster:
  • Permanently Decommissioning a node from a vSAN Cluster 

NOTE: Data deletion is permanent and cannot be reversed. Please proceed with caution.