PSOD "Unable to restore the system configuration. A security violation was detected" occurred after TPM and motherboard replacement.

Products

• VMware vSphere ESXi
• VMware Telco Cloud Platform

Issue/Introduction

1. The ESXi host fails to boot into the hypervisor and triggers a PSOD displaying the error message: "The system has found a problem on your machine and cannot continue. Unable to restore the system configuration. A security violation was detected."
   
   
   
   
2. The following error messages are visible in the `vmkernel.log` when the TPM is in a failed state:
   
   

   ####-##-##T##:##:##.####Z cpu##:################ opID=########) World: ####: VC opID ************ maps to vmkernel opID ######
   ####-##-##T##:##:##.####Z cpu##:################ opID=##########) tpmDriver: TpmWrite:####: still expects data after 22 bytes transfered
   ####-##-##T##:##:##.####Z cpu##:################ opID=########) tpmDriver: Tpm_Transmit:###: Send to TPM failed: Failure (0xbad0001)
   ####-##-##T##:##:##.####Z cpu##:################ opID=########) tpmDriver: Tpm2TransmitWithTransmitter:#####: Command transmission failed: Failure (0xbad0001)
   ####-##-##T##:##:##.####Z cpu##:################ opID=########) tpmDriver: Tpm2_GetCapabilityNoResMgr:#####: Failed to get capability: Failure (0xbad0001)
   ####-##-##T##:##:##.####Z cpu##:################ opID=########) tpmDriver: TpmDriver_GetVendor:####: Vendor ID retrieval failed: Failure (0xbad0001)
   ####-##-##T##:##:##.####Z cpu##:###########) Vol#: ####: Unable to register file system #####-#####-####-####-########## for quesce timeout notifications: Inappropriate ioctl for device

Environment

ESXi : 8.0 U3x

TCP : 5.0

Cause

The single verified root cause is an underlying hardware fault associated with the Trusted Platform Module (TPM) or the motherboard.

Resolution

1. If the reinstallation continues to fail while this issue persists, please engage your hardware vendor to perform comprehensive diagnostics on the affected host.
   
   
2. Replace faulty components, specifically the TPM & motherboard, as necessary per the hardware vendor's assessment to restore stable ESXi operation.
   
   
3. Even after replacing the TPM and motherboard, if the issue persists, a reinstallation of the ESXi host will be required.
   
   

Note: You will need the specific "recovery key" to restore the ESXi host; please note that these keys are unique to each host.

Additional Information

ESXi boot failures due to system configuration issues - restore security configuration, decrypt system configuration, recover system configuration

How to back up and restore the ESXi host configuration