6.7

n
Virtual machine encryption (to encrypt the virtual machine home files).
n
Key Management Server (KMS) configured for vCenter Server (virtual machine encryption
depends on KMS). For more details, see the vSphere Security documentation.
n
Guest OS support:
n
Windows Server 2016 (64 bit)
n
Windows 10 (64 bit)
Dierences Between a Hardware TPM and a Virtual TPM
You use a hardware Trusted Platform Module (TPM) as a cryptographic coprocessor to provide secure
storage of credentials or keys. A vTPM performs the same functions as a TPM, but it performs
cryptographic coprocessor capabilities in software. A vTPM uses the .nvram file, which is encrypted
using virtual machine encryption, as its secure storage.
A hardware TPM includes a preloaded key called the Endorsement Key (EK). The EK has a private and
public key. The EK provides the TPM with a unique identity. For a vTPM, this key is provided either by the
VMware Certificate Authority (VMCA) or by a third-party Certificate Authority (CA). Once the vTPM uses a
key, it is typically not changed because doing so invalidates sensitive information stored in the vTPM. The
vTPM does not contact the CA at any time.
Enable Virtual Trusted Platform Module for an Existing Virtual
Machine
You can add a Virtual Trusted Platform Module (vTPM) to an existing virtual machine to provide enhanced
security to the guest operating system. You must set up the KMS before you can add a vTPM.
You can enable a vTPM for virtual machines running on vSphere 6.7 and later. The VMware virtual TPM
is compatible with TPM 2.0, and creates a TPM-enabled virtual chip for use by the virtual machine and
the guest OS it hosts.
Prerequisites
n
Ensure your vSphere environment is configured for virtual machine encryption. See the vSphere
Security documentation.
n
The guest OS you use must be either Windows Server 2016 (64 bit) or Windows 10 (64 bit).
n
Verify that the virtual machine is turned off.
n
The ESXi hosts running in your environment must be ESXi 6.7 or later.
n
The virtual machine must use EFI firmware.
Procedure
1 Connect to vCenter Server by using the vSphere Client.
2 Right-click the virtual machine in the inventory that you want to modify and select Edit Settings.
3 In the Edit Settings dialog box, click Add New Device and select Trusted Platform Module.
vSphere Virtual Machine Administration
VMware, Inc. 165