Degraded Storage Array Data Reduction Ratio (DRR) after enabling vTPM on Windows 11 VMs due to BitLocker

Products

• VMware vSphere ESXi

Issue/Introduction

A high amount of irreducible data and a severely degraded Data Reduction Ratio (DRR) is observed on the storage array. This behavior correlates with the enablement of a virtual Trusted Platform Module (vTPM) on Windows 11 virtual machines. Initial validation confirms that vSphere-level VMDK encryption via VM Storage Policies is not enabled.

Environment

VMware vSphere 7.x / 8.x
Storage Arrays with Data Reduction capabilities (e.g., vSAN, Dell PowerStore)
Windows 11 Guest OS

Cause

The root cause is Guest OS-level encryption. When a vTPM device is added to a Windows 11 VM, Microsoft BitLocker Drive Encryption may be automatically or manually initialized. BitLocker encrypts the data payload before it is written to the VMDK and sent to the underlying storage. 

Data reduction technologies (compression and deduplication) rely on identifying predictable patterns and redundant data blocks. 

Encryption algorithms intentionally randomize data, creating high-entropy blocks that appear completely unique. Because the storage array cannot identify repeating patterns in this encrypted payload, the data cannot be reduced, resulting in a 1:1 footprint on the physical storage media.

Resolution

Verifying vSphere-Level Encryption Status
Before addressing the Guest OS, verify that the vSphere layer is not encrypting the disks via Storage Policies:
1. Log in to the vSphere Client and locate the affected VM.
2. Navigate to the Summary tab. Under the VM Hardware pane, check the Encryption field status.
3. Right-click the VM and select Edit Settings.
4. Expand the Hard disk** entry and check the VM Storage Policy. If it is set to a standard policy (e.g., "Datastore Default") and not an "Encryption Policy", vSphere VMDK encryption is not active.
The following screen shot is an example of a vSphere-Level Encrypted VMDK 



Disabling Guest OS Encryption (BitLocker)
To restore data reduction capabilities on the storage array, the data must be written by the Guest OS in plaintext.
1. Open an elevated Command Prompt within the Windows 11 Guest OS.
2. Verify the BitLocker encryption status by running: `manage-bde -status`
3. If the drive is encrypted and array-level data reduction is prioritized, disable BitLocker by running: `manage-bde -off C:` (modify the drive letter as needed).
4. Monitor the decryption progress. Once fully decrypted, newly written data will be processed successfully by the storage array's reduction engine.

Workaround
If corporate compliance mandates data-at-rest encryption:
1. Evaluate utilizing Array-Level Encryption, which typically encrypts data *after* the array performs deduplication and compression.
2. Accept the storage capacity tradeoff. Any encryption applied above the storage array level (including Guest OS BitLocker, vSphere VM Encryption, or vSAN Encryption) will natively bypass downstream array DRR capabilities.

Additional Information

For information on the usages of vSphere Storage Polices review the VMware vSphere document Creating and Managing vSphere VM Storage Policies (8.0 version) 

For specific architectural behaviors regarding encrypted payloads and DRR (e.g., Dell PowerStore), review the following vendor documentation:
PowerStore: What to Do if the Data Reduction Ratio is Less Than Expected