Virtual Machine Locked Alarm

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• vCenter Alarm for Virtual Machine:
  
  "Virtual machine <Virtual_Machine_Name> is locked. Before unlocking the virtual machine, manually recover the missing key(s) /<KEY_PROVIDER_NAME> to the key provider(s) <KEY_PROVIDER_NAME>. 
  
  
• KMS Key provider had been changed and old Key provider decommissioned.
  
  
• Not all Virtual Machines are re-keyed with the correct Key Provider.

Environment

vCenter Server

vSphere ESX

Cause

If the virtual machine key is not available, a  vCenter Server alarm notifies you and the state of the virtual machine displays as invalid. The virtual machine cannot power on. If the virtual machine key is available, but a key for an encrypted disk is not available, the virtual machine state does not display as invalid. However, the virtual machine cannot power on and the following error results:

The disk [/path/to/the/disk.vmdk] is encrypted and a required key was not found.

Resolution

The following procedure illustrates the situations that can cause a virtual machine to become locked, the corresponding alarms and event logs that appear, and what to do in each case.

Resolve Missing Encryption Key Issues, if the ESXi host cannot get the key (KEK) from vCenter Server for an encrypted virtual machine or an encrypted virtual disk, the encrypted virtual machine becomes locked. After you make the keys available on the key server (KMS), you can unlock a locked encrypted virtual machine.

Additional Information

• Activate and Deactivate Key Persistence on an ESXi Host.
  
  
• Quick Tip - Which vCenter Server Key Provider (KMS) is a VM using?
  
  Use a simple PowerCLI script called vm-to-kms-association.ps1 which will list all registered KMS key providers for the connected vCenter Server and then list all applicable VMs and their associated KMS key provider as well as KeyID
  

  Updated script (updates bolded) to query all VMs and get power state.

vm-to-kms-association_2.ps1

#Updated to query all VMs and include PowerState.

$cryptoManager = Get-View $global:DefaultVIServer.ExtensionData.Content.CryptoManager

$kmsServers = @{}

foreach ($i in $cryptoManager.KmipServers) {

    if($i.ManagementType -eq "nativeProvider") {

        $type = "NKP"

    } else { $type = "SKP"}

    $kmsServers.add($i.ClusterId.id,$type)

}

$vms = Get-View -ViewType VirtualMachine -Property Name, summary, Config

$kmsVms = @()

foreach ($vm in $vms | Sort-Object -Property Name) {

    #if($vm.Config.KeyId -ne $null) {

        $tmp = [pscustomobject]@{

            Name = $vm.Name

           PowerState=$vm.summary.runtime.powerstate

            KMS = $vm.Config.KeyId.ProviderId.id

            KeyId = $vm.Config.KeyId.keyId

        }

        $kmsVms+=$tmp

    #}

}

Write-Host -ForegroundColor Cyan "`n==== vCenter Key Providers ===="

$kmsServers

Write-Host -ForegroundColor yellow "`n==== VM Key Provider Mapping ===="


$kmsVms | ft