Introduction

Security-sensitive workloads often require encryption at rest and support for virtual TPM (vTPM) devices. These features are built into vSphere and can be automated using PowerCLI. This article shows how to encrypt virtual machines, manage encryption policies, configure vTPM devices, and validate encryption status programmatically.

Topics include:

• Enabling VM encryption
• Assigning KMS-based storage policies
• Adding virtual TPM devices to VMs
• Auditing encryption and vTPM compliance
• Error handling and operational guidance

Prerequisites

Before automating encryption:

• vCenter must be configured with a trusted KMS cluster
• You must have administrator privileges
• PowerCLI 13 or newer is recommended

Connect to vCenter:

Connect-VIServer -Server "vcenter.lab.local"

Step 1: Identify or Create Encrypted Storage Policy

List available policies:

Get-SpbmStoragePolicy | Where-Object {$_.Name -like "*Encrypt*"}

Example policy name: VM Encryption Policy

If no policy exists, create one in vSphere Client that uses KMS-backed encryption rules.

Step 2: Encrypt an Existing VM

$vm = Get-VM -Name "SQLSecure01"
$policy = Get-SpbmStoragePolicy -Name "VM Encryption Policy"

Set-SpbmEntityConfiguration -Entity $vm -StoragePolicy $policy

PowerCLI automatically migrates the VM to an encrypted storage policy if supported.

Step 3: Deploy a New Encrypted VM

New-VM -Name "SecureApp01" `
       -Template "Win2019-Base" `
       -Datastore "Encrypted-DS" `
       -VMHost "esxi01.lab.local" `
       -StoragePolicy $policy

Step 4: Add vTPM to a VM

Virtual TPM devices require:

• Hardware version 14 or newer
• Encrypted VM home files

$vm = Get-VM -Name "SecureApp01"

New-VTpm -VM $vm

You can also verify TPM status:

$vm.ExtensionData.Config.VAppConfig.Properties | Where-Object {$_.Label -eq "TPM Enabled"}

Step 5: Verify Encryption and TPM Status

Get-VM | Select Name, @{N="Encrypted";E={$_.ExtensionData.Config.VmEncryptionInfo.EncryptionPolicyId}}, @{N="vTPM";E={($_.ExtensionData.Hardware.Device | Where-Object {$_.DeviceInfo.Label -like "*Trusted Platform Module*"}).DeviceInfo.Label}}

Export to CSV:

Get-VM | Select Name, PowerState, @{N="Encrypted";E={$_.ExtensionData.Config.VmEncryptionInfo}}, VMHost | Export-Csv "C:ReportsVM_Encryption_Status.csv" -NoTypeInformation

Diagram: Encryption and TPM Workflow

Use Case: Secure Workload Baseline for New App Tier

Use encrypted VM template and vTPM by default:

New-VM -Name "NewFinanceVM" `
       -Template "Encrypted-Win2022-Base" `
       -VMHost "esxi02.lab.local" `
       -Datastore "SecureDS" `
       -StoragePolicy (Get-SpbmStoragePolicy -Name "VM Encryption Policy")

Add vTPM immediately after:

New-VTpm -VM (Get-VM -Name "NewFinanceVM")

Troubleshooting

What’s Next

The next article will focus on:

• Disaster recovery automation using PowerCLI
• Snapshots, exports, and failover preparation scripting

The post PowerCLI for VM Encryption and TPM Configuration: Secure Workload Provisioning at Scale appeared first on Digital Thought Disruption.