Understanding the Error Context
The Get-Tpm2EndorsementKey cmdlet is part of the VMware PowerCLI module used to interact with the vSphere API. It retrieves the unique cryptographic identity stored on the TPM chip of an ESXi host. This key is essential for features like Secure Boot, Host Encryption, and certain aspects of vSphere Trust Authority. When this command fails, it usually indicates a breakdown in the chain of trust between the operating system, the hypervisor, and the physical hardware.
Common error messages include "Operation not supported" or "TPM not found." These errors suggest that either the TPM hardware is disabled at the firmware level, the driver is not loaded correctly, or the TPM has been locked by a previous failed operation. Before diving into complex troubleshooting, it is crucial to ensure that the environment meets the basic requirements for TPM 2.0 support.
Verifying Hardware and Firmware Compatibility
The first step in resolving this issue is to confirm that the server hardware actually supports TPM 2.0. Many older servers only have TPM 1.2, which may not be fully compatible with newer vSphere versions or specific PowerCLI commands expecting TPM 2.0 endpoints. Check the server manufacturer’s documentation to verify the TPM version. If the hardware is outdated, you may need to upgrade the motherboard or use a compatible add-on card.
Firmware updates are another critical factor. Outdated BIOS or BMC (Baseboard Management Controller) firmware can cause communication failures with the TPM. Visit your server vendor’s support page and download the latest firmware for your specific model. Apply these updates during a maintenance window, as they often require a reboot. After updating, check if the issue persists.
Checking BIOS Settings
Once firmware is current, access the server’s BIOS/UEFI setup utility. Navigate to the security or advanced chipset settings and look for the TPM option. Ensure that TPM 2.0 is explicitly enabled. In some systems, this setting might be labeled as "Intel PTT," "AMD fTPM," or simply "Trusted Computing." If it is disabled, enable it and save the changes. Additionally, verify that the TPM state is set to "Clear" or "Reset" if you suspect corruption, but note that this will delete existing keys.
Updating VMware ESXi Microcode
VMware regularly releases patches that include updated microcode for various CPU and chipset components, including TPM controllers. An outdated ESXi build might lack the necessary drivers to interface with newer TPM chips. Use the VMware Compatibility Guide to check if your specific ESXi version supports your hardware. If you are running an older release, consider upgrading to the latest GA (General Availability) build of vSphere. This process involves downloading the update bundle from VMware’s website and applying it via the vSphere Client or command line.
PowerCLI Troubleshooting Steps
If hardware and firmware are confirmed to be correct, the issue may lie within the PowerCLI session or the vCenter connection. Start by ensuring you are connected to the correct vCenter Server instance. Use the Connect-VIServer cmdlet to establish a fresh session. Sometimes, stale sessions can cause authentication or permission errors that manifest as TPM retrieval failures.
- Verify permissions: Ensure the user account has the "Host.Config.TPM" privilege. Without this, the cmdlet will fail silently or return an access denied error.
- Check host status: Confirm that the ESXi host is in a normal operational state and not in maintenance mode or disconnected. A host in maintenance mode may restrict certain configuration operations.
- Test connectivity: Run a simple ping or network test to ensure there are no firewall issues blocking communication between the machine running PowerCLI and the vCenter/ESXi hosts.
Resolving Corrupted TPM State
In rare cases, the TPM itself may be in a corrupted or locked state. This can happen after a power failure or a crash. To resolve this, you may need to clear the TPM through the BIOS/UEFI interface. Be aware that clearing the TPM will remove all associated encryption keys, which could impact encrypted VMs if they rely on local storage encryption. After clearing, reboot the host and attempt to run the Get-Tpm2EndorsementKey cmdlet again. If the problem persists, consider re-imaging the ESXi host as a last resort.
For more detailed guidance on managing virtual machine security, see our guide on VMware VM Encryption Best Practices. Additionally, understanding how to manage host configurations effectively can prevent many common errors, as discussed in ESXi Host Configuration Troubleshooting.
Frequently Asked Questions
What does the TPM endorsement key represent?
The TPM endorsement key is a unique, factory-installed RSA key pair that serves as the root of trust for the device. It is used to authenticate the hardware to remote services like vSphere Trust Authority and ensures that the host has not been tampered with physically.
Can I use TPM 1.2 with modern vSphere versions?
While vSphere still supports TPM 1.2 for backward compatibility, new features such as vSphere Trust Authority and enhanced secure boot require TPM 2.0. If you are using older hardware, you may need to upgrade to meet these requirements.
Why is my TPM showing as disabled in BIOS?
Manufacturers often ship servers with TPM disabled by default for security reasons or to reduce costs. You must manually enable it in the BIOS/UEFI settings under Security or Advanced Chipset options to make it accessible to the OS.
Does clearing the TPM affect running virtual machines?
Clearing the TPM affects the host’s ability to decrypt locally stored encrypted VMs. If VMs are encrypted using a key managed by a KMS server, they may remain accessible, but local storage encryption will be lost. Always backup your encryption keys before clearing the TPM.
How do I check if PowerCLI is installed correctly?
You can verify the installation by opening PowerShell and running Get-Module -ListAvailable VMware.PowerCLI. If the module is listed, it is installed. You should also run Update-Module VMware.PowerCLI to ensure you have the latest cmdlets and bug fixes.