{"id":3790,"date":"2025-03-23T15:24:13","date_gmt":"2025-03-23T13:24:13","guid":{"rendered":"https:\/\/vpxd.dc5.cz\/?p=3790"},"modified":"2025-03-23T15:24:14","modified_gmt":"2025-03-23T13:24:14","slug":"how-to-quickly-check-backup-esxi-host-tpm-encryption-recovery-key-using-powercli","status":"publish","type":"post","link":"https:\/\/vpxd.dc5.cz\/index.php\/2025\/03\/23\/how-to-quickly-check-backup-esxi-host-tpm-encryption-recovery-key-using-powercli\/","title":{"rendered":"How to Quickly Check\/Backup ESXi Host TPM Encryption Recovery Key Using PowerCLI"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Managing encryption across multiple ESXi hosts can be a bit of a hassle. But don’t worry. I’ve got a simple PowerCLI script that’ll save you time and headaches by quickly retrieving encryption status and recovery keys from your VMware environment.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Why Do You Need This?<\/strong><\/h2>\n\n\n\n

Ensuring your ESXi hosts are correctly encrypted is essential for security. Regular checks help prevent surprises later, especially during troubleshooting or audits.<\/p>\n\n\n\n

Getting Started<\/h2>\n\n\n\n

First, make sure you’re connected to your vCenter:<\/p>\n\n\n\n

Connect-VIServer -Server<\/code><\/pre>\n\n\n\n
Replace with your vCenter IP or FQDN.<\/p>\n\n\n\n
The Script Breakdown<\/h2>\n\n\n\n
Here’s a quick rundown of the PowerCLI script to verify encryption settings across all ESXi hosts and who Recovery key for each ESXi host. (link to GitHub repository<\/a>  and file tpm_recovery_key_backup.ps1<\/a>):<\/p>\n\n\n\n
# Connect to your vCenter server (if not already connected)\n# Connect-VIServer -Server <VCENTER_IP_OR_FQDN>\n\n$esxis  = get-vmhost | Sort-Object\n\nforeach ($esx in $esxis) {\n    $key= @()\n    $enc = @()\n    if ($esx.ConnectionState -ne \"Connected\" -and $esx.ConnectionState -ne \"Maintenance\") {\n        Write-Host \"\"\n        Write-Host \"================================================================================\" -ForegroundColor Yellow\n        Write-Host \"\ud83d\udeab SKIPPED HOST\" -ForegroundColor Yellow\n        Write-Host \"Host                : $($esx.Name)\" -ForegroundColor DarkYellow\n        Write-Host \"Reason              : Not powered on or disconnected.\" -ForegroundColor DarkYellow\n        Write-Host \"================================================================================\" -ForegroundColor Yellow\n        Write-Host \"\"\n        continue\n    }\n    $esxcli = Get-EsxCli -VMHost $esx -V2\n    try {\n        $key = $esxcli.system.settings.encryption.recovery.list.Invoke()\n        $enc =  $esxcli.system.settings.encryption.get.Invoke()\n\n        Write-Host \"================================================================================\" -ForegroundColor DarkCyan\n        Write-Host \"\ud83d\udd39 ESXi Host        : $($esx.Name)\" -ForegroundColor Cyan\n        Write-Host \"\ud83d\udd10 Recovery ID      : $($key.RecoveryID)\" -ForegroundColor Green\n        Write-Host \"\ud83d\udddd\ufe0f  Recovery Key     : $($key.Key)\" -ForegroundColor Yellow\n        Write-Host \"\ud83d\udd12 Encryption Mode  : $($enc.Mode)\" -ForegroundColor Magenta\n        Write-Host \"================================================================================\" -ForegroundColor DarkCyan\n        Write-Host \"\"\n    }\n    catch {\n        Write-Host \"\"\n        Write-Host \"================================================================================\" -ForegroundColor DarkGray\n        Write-Host \"\u274c ERROR for host    : $($esx.Name)\" -ForegroundColor Red\n        Write-Host \"\u26a0\ufe0f  Failed to get encryption key for $($esx.Name) .\"\n        Write-Host \"\ud83e\udde8 Error details     : $_\"\n        Write-Host \"================================================================================\" -ForegroundColor DarkGray\n        Write-Host \"\"\n    }\n}<\/code><\/pre>\n\n\n\n
What the Script Does<\/h2>\n\n\n\n