Skip to main content

Migrating Encrypted Windows VMs from vSphere

This guide prepares an encrypted Windows VM for export from VMware vSphere and import into eEVOS.

The screenshots illustrate the English user interface. Names and addresses shown are examples; use the values defined for your environment.

Saved vSphere connections in eEVOS
Use the normal vSphere Import connection after removing Windows and vSphere encryption.

Understand the security layers

  1. BitLocker or Device Encryption encrypts Windows volumes.
  2. VBS provides features such as Credential Guard and Memory Integrity.
  3. vTPM presents TPM 2.0 to Windows and stores security state.
  4. vSphere VM Encryption encrypts VM Home and, depending on policy, virtual disks.

Decrypt BitLocker completely before removing the vTPM. Removing the vTPM first can require a recovery key or prevent Windows from booting.

Before you begin

  • Verify an independently restorable backup.
  • Retrieve and verify every BitLocker recovery key.
  • Record firmware, controllers, NICs, VLANs, boot order and storage policies.
  • Keep the vCenter key provider or KMS available until export finishes.
  • Schedule downtime and retain the source VM until acceptance.

1. Check Windows

Run as Administrator:

manage-bde -status
Get-BitLockerVolume | Format-Table MountPoint,VolumeStatus,ProtectionStatus,EncryptionPercentage,KeyProtector -AutoSize
manage-bde -protectors -get C:
Get-Tpm

Use msinfo32.exe to record Secure Boot, VBS, Credential Guard and Memory Integrity. VBS is not disk encryption; disable it only when the destination cannot provide the required virtual hardware.

2. Fully decrypt every volume

manage-bde -off C:
manage-bde -off D:
manage-bde -status

Continue only when every migrated volume reports Fully Decrypted, 0.0% and Protection Off. Suspending BitLocker is not enough.

3. Remove vTPM and vSphere encryption

  1. Shut down Windows and confirm the VM is powered off, not suspended.
  2. In Actions → Edit Settings, remove Trusted Platform Module.
  3. Open Configure → Policies → Edit VM Storage Policies.
  4. Assign a non-encrypted policy to VM Home and every virtual disk.
  5. Wait for all tasks to finish successfully.

If Export OVF Template still reports encryption, recheck the vTPM, VM Home and every disk. One encrypted component blocks export.

4. Export and import

  1. Keep the source VM powered off and export the complete OVF/OVA set.
  2. Retain the OVF, every VMDK and the manifest; verify sizes and hashes.
  3. In eEVOS, open VM Tools → vSphere Import.
  4. Preserve UEFI and Secure Boot when Windows requires them.
  5. For Windows 11 or VBS, configure the destination TPM and security options.
  6. Keep networking disconnected for the first boot if identity or IP conflicts are possible.

5. Validate before cutover

  • Windows boots without recovery or repair loops.
  • All disks are online and manage-bde -status remains fully decrypted.
  • Firmware, Secure Boot, TPM and VBS have the intended state.
  • Networking, DNS, domain trust, time and applications work.
  • A clean shutdown and second boot succeed.
  • A destination-native backup and restore test succeeds.

Reconnect production networking and retire the source only after acceptance testing.

Rollback

Keep a failed import isolated. Never run source and clone simultaneously on the same production network. Restore service from the verified backup or untouched source. A newly added vTPM does not recreate the old TPM state.

See vSphere Import for connection setup, network mapping and job monitoring.

Back to top