Virtual Machine Locked Alarm after migrating encrypted VMs between vCenter Servers

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

This article provides steps to resolve a 'Virtual Machine Locked' alarm and an Invalid VM state following migration to a vCenter Server with a different Key Provider.

Symptoms:

• VM becomes Invalid state after reregistered by the different vCenter Server.
• You might see Virtual Machine Locked Alarm on the summary page.

Environment

Environment:

• VMware vCenter Server
• VMware vSphere ESXi

Cause

This happens when the system doesn't have the Key Provider that originally encrypted the VM.

Typically, it happens in the below situation.

• vCenter Server A has Key Provider 1.
• vCenter Server B has Key Provider 2.
• The VM originally was registered by vCenter Server A and encrypted by Key Provider 1.
• After unregistered the VM and then registered it using vCenter Server B, the VM became Invalid state and it cannot be operated.

Resolution

vCenter Server need to have the same Key Provider that originally used to encrypt the VM.

If using Native Key Provider, the below procedure is required to unlock the VM.

1. Login vSphere Client of the vCenter Server A and select vCenter Server at the top of the inventory.
2. Navigate [Configure] -> [Security] -> [Key Provider] and backup the Key Provider used to encrypt the VM.
3. Login to the vSphere Client of vCenter Server B, and navigate [Configure] -> [Security] -> [Key Provider] and then [Restore] using the exported file in 2.
4. Set the Key Provider for the cluster or set it default.
5. Click the VM on the vSphere Client page and check the url like below to check moid of vm. In this case, moid is 25 from vm-25.
   

   https://#####/ui/app/vm;nav=h/urn:vmomi:VirtualMachine:vm-25:########/summary

6. Using moid (in this case, 25), login to the url https://<ip_or_fadn_of_vc>/mob/?moid=vm-<vmid> using SSO administrator credential.
7. Click [CryptoUnlock_Task] -> [Invoke Method]
8. Return to the vSphere Client page, right click the VM and then [VM Policies] -> [Re-encrypt].

If using an external Key Provider, register the same Key Provider to vCenter Server B in place of 1.~4. procedure.

Additional Information

Rekey an Encrypted Virtual Machine Using the vSphere Client