Regenerating Unique vTPM Endorsement Keys for Cloned Virtual Machines (VMware vSphere)
Article ID: 452119
Updated On:
Products
Issue/Introduction
When virtual machines (VMs) are cloned and the TPM provision policy is set to "Copy", the Trusted Platform Module (vTPM) and its associated Endorsement Key (EK) are duplicated from the template.
This can cause identity collisions in third-party applications or security software that rely on hardware-based uniqueness. This article provides the procedure to regenerate a unique vTPM device and Endorsement Key for already-cloned virtual machines.
Environment
VMware vSphere 8.0, VMware vSphere 9.0
Cause
During the cloning process, the vTPM device hardware layer—including the cryptographic identity and Endorsement Key—is copied exactly from the source VM template to the clone, resulting in identical hardware signatures.
Resolution
For future clone operations ensure to select Replace when cloning.
To resolve identity collisions, remove and re-add the vTPM device on each affected clone.
This forces the hypervisor to generate a new, unique vTPM device.
Critical Warning: This operation replaces the vTPM hardware layer. Any cryptographic secrets sealed to the original vTPM (e.g., BitLocker keys, Windows Hello PINs, application credentials) will be permanently lost. Suspend BitLocker or decrypt all disks before proceeding. Re-initialize software or encryption services after the vTPM is regenerated.
- Power off the cloned virtual machine.
- Right-click the virtual machine in the vSphere Client inventory and select Edit Settings.
- Under the Virtual Hardware tab, locate the Trusted Platform Module device.
- Click the Remove (X) icon next to the vTPM device to delete it.
- Click OK to apply the configuration change.
- Right-click the virtual machine again and select Edit Settings.
- Click Add New Device and select Trusted Platform Module.
- Click OK to save the changes.
- Power on the virtual machine.
Additional Information
Feedback
