6.5.1

You can use the vSphere API to perform either a shallow recrypt operation
with a new KEK or deep recrypt operation with a new internal key.
Core dumps Core dumps on an ESXi host that has encryption mode enabled are always
encrypted. See vSphere Virtual Machine Encryption and Core Dumps.
Note Core dumps on the vCenter Server system are not encrypted. Be
sure to protect access to the vCenter Server system.
Note For information on some limitations concerning devices and features that vSphere Virtual Machine
Encryption can interoperate with, see Virtual Machine Encryption Interoperability.
What Is Not Encrypted
Some of the files that are associated with a virtual machine are not encrypted or partially encrypted.
Log files Log files are not encrypted because they do not contain sensitive data.
Virtual machine
configuration files
Most of the virtual machine configuration information, stored in the VMX
and VMSD files, is not encrypted.
Virtual disk descriptor
file
To support disk management without a key, most of the virtual disk
descriptor file is not encrypted.
Who Can Perform Cryptographic Operations
Only users that are assigned the Cryptographic Operations privileges can perform cryptographic
operations. The privilege set is fine grained. See Cryptographic Operations Privileges. The default
Administrator system role includes all Cryptographic Operations privileges. A new role, No
Cryptography Administrator, supports all Administrator privileges except for the Cryptographic
Operations privileges.
You can create additional custom roles, for example, to allow a group of users to encrypt virtual machines
but to prevent them from decrypting virtual machines.
How Can I Perform Cryptographic Operations
The vSphere Web Client supports many of the cryptographic operations. For other tasks, you can use the
vSphere API.
vSphere Security
VMware, Inc. 143