What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
vSphere encryption is controlled by three separate pieces: a key provider that supplies cryptographic keys, a VM storage policy that requires encryption for selected storage, and vCenter permissions that allow an administrator to configure or use those controls. Configure them in that order, then verify the resulting key and policy state on the VM. A new vCenter is not configured with a key provider by default, even though Native Key Provider is available in vSphere 7.0 Update 2 and later.
The three controls behind vSphere VM encryption
It is easy to treat the Encrypt VM switch as a single feature. In practice, that switch depends on three independent controls:
- Key provider: Native Key Provider (NKP) or an external key-management server supplies, stores, or brokers the keys used by vSphere.
- Storage policy: A VM storage policy expresses whether a virtual disk or other VM storage must be encrypted. The policy is applied to VM home files, disks, or both, depending on its components.
- Access control: vCenter privileges determine who can configure the provider, create or assign the policy, encrypt or rekey a VM, and perform other cryptographic operations.
A provider without an encryption policy does not automatically encrypt every VM. Conversely, a policy that requires encryption cannot work until a usable provider is available and the user has permission to perform the task.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check versions, compatibility, and licensing first
Before changing a production VM, record the exact vCenter Server, ESXi, storage platform, and contract versions. UI labels and workflows vary by release. Broadcom documentation identifies Native Key Provider as a vSphere 7.0 Update 2 and later capability, but a freshly deployed vCenter still requires an administrator to configure it.
#1 Best Overall
- 【Quality materials and easy installation】TPM 2.0 Security Module is made of high quality material and is well made for long life.It is easy to install, lightweight and compact, and its easy integration makes it a breeze to install and operate quickly.
- 【Working environment】The TPM2.0 Security Module is compatible with GC-TPM2.0_S. Interface: LPC, TPM IC: SLB9665, Pin Connector: 12Pin.Please check compatibility before purchasing.
- 【Reliable Work】The TPM 2.0 Module is a highly reliable cryptographic processor that brings an extra layer of security to your Windows computer. With its advanced encryption technology, you can perform secure operations such as generating, storing, and restricting the use of cryptographic keys, ensuring that your system is protected from unauthorized access.
- 【High-quality replacement】high-quality professional use, the function is the same as the original model, stable performance, a good replacement of the original damaged old safety module.
- 【Model Support】Each security module is tested before it leaves the factory and is 100% perfectly works well.Therefore, Please confirm that your motherboard supports TPM2.0 technology.
- Confirm that every ESXi host which may run the encrypted VM supports the selected provider and encryption features. Mixed or incompatible host versions can make a policy appear noncompliant or prevent a power-on operation.
- Check whether your entitlement covers the operation you intend to perform. VMware states that all vSphere editions include Native Key Provider for vTPM use, while VM Encryption and vSAN encryption can require additional licensing. Treat those as separate feature checks and validate the current product terms for your edition and subscription.
- Identify the datastore or vSAN objects that the policy will govern and verify that they support the policy components you plan to use.
- Plan key backup, recovery access, and an outage procedure before encrypting the first VM. Losing the required key can prevent an encrypted VM from powering on.
Do not assume that a TPM module or a KMS appliance is a mandatory add-on for every deployment. NKP can provide the key service for supported use cases; an external KMS is a design choice driven by threat model, governance, and operations.
Choose a key provider
The provider supplies the key material or the service that vCenter and ESXi use to obtain it. The two common choices have different operational consequences.
| Decision factor | Native Key Provider | External KMS provider |
|---|---|---|
| Where key material is held | VMware stores the decryption keys locally on ESXi hosts under the NKP design. | A remote key-management service holds or brokers keys outside the ESXi host. |
| Physical-theft threat model | Convenient local operation, but a stolen host may still be able to unlock encrypted VMs or vSAN datastores if the relevant keys are available. | Can better separate keys from hosts, which may fit a stronger physical-security requirement. |
| Availability dependency | Depends on the vCenter/ESXi NKP configuration and protected recovery material. | Adds network reachability, KMS health, trust configuration, and KMS recovery dependencies. |
| Feature and host compatibility | Supports VM Encryption, vTPM, and vSAN encryption when the release and license permit them. | Support depends on the KMS integration, vSphere release, and compatible hosts. |
| Licensing | NKP for vTPM is included in all vSphere editions according to VMware; other encryption features may require additional entitlement. | Check vSphere feature licensing plus the separate KMS product and support terms. |
| Operational ownership | vSphere administrators own provider setup, backup, and recovery handling. | Infrastructure and security teams must operate the KMS, certificates, access controls, and disaster recovery. |
Neither option is universally safer. Select NKP when local key management and simpler architecture meet your threat model. Select an external KMS when policy requires keys to remain outside hosts or when centralized key governance is a requirement. In either case, document who can recover keys and how an outage is handled.
Rank #2
- 【Wide Compatibility – Gigabyte & ASUS】 Specifically designed for Gigabyte and ASUS desktop motherboards with a 20-1 pin (2x10 / GA 20-1) 2.54mm pitch LPC TPM header. Ideal for upgrading to TPM 2.0 on DDR4 systems. (Note: NOT compatible with 12-pin, 2x6, or 14-pin headers).
- 【Windows 11 Readiness】 An essential hardware upgrade to meet Windows 11 security requirements. Ensure your system stays secure and up-to-date with a dedicated hardware TPM 2.0 module without replacing your entire motherboard or CPU.
- 【Advanced Security & Encryption】 Powered by the standalone Infineon SLB9665 encryption processor. This module securely stores cryptographic keys for software like Windows BitLocker, providing a robust layer of hardware-based security for your data.
- 【Platform Limits – No Laptops】 Optimized for Desktop motherboards from the DDR4 era (X99 series and newer). Not compatible with laptops or legacy DDR3 systems. Please verify your motherboard's header layout (2x10 pins) before ordering.
- 【Easy Setup & BIOS Note】 Simple plug-and-play installation takes only minutes with no tools required. IMPORTANT: After installation, you MUST enable "Security Device Support" or "Intel PTT / AMD fTPM" in your BIOS settings for Windows to recognize the module.
Configure Native Key Provider
The exact navigation can change between vSphere releases, but the workflow follows the same sequence. Perform it in the vSphere Client with a role that includes Cryptographic operations > Manage key servers, the privilege identified by VMware for NKP configuration.
- Open the key-provider view. In the vSphere Client, open the vCenter Server object and the security or key-provider configuration area. In some releases this appears under Configure and Security; use the label supplied by your release.
- Add a Native Key Provider. Select the option to add or create an NKP, give it an unambiguous name, and complete the vCenter prompts.
- Associate the provider with the required hosts or cluster. Verify that every host expected to run encrypted workloads is included and compatible. A provider can be configured successfully while a particular host remains unable to use it.
- Back up the provider and recovery material. Store the backup in protected, access-controlled storage separate from the vCenter and ESXi hosts. Test that the people responsible for recovery can retrieve it without granting them routine administrative access.
- Verify status. Confirm that the provider reports a healthy or ready state, that hosts can communicate with it, and that no certificate, trust, or synchronization warning remains.
Do not skip the backup step. If the provider’s required key is unavailable, vSphere may refuse to power on an encrypted VM; consult the current Broadcom recovery documentation for the exact failure and recovery path for your release.
Connect an external KMS
An external KMS requires more than entering a hostname. Establish the security and availability relationship before assigning it to production workloads.
Rank #3
- TPM 2.0 module for Asus motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x7P, 14 pin security module
- LPC 14 Pin for AsusTPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASUS
- Obtain the KMS endpoint, supported protocol and version, certificate chain, and account or credentials required by the integration.
- In the vSphere Client’s key-provider configuration, add a standard or external provider and enter the KMS connection details.
- Exchange or approve certificates as required by both sides. Confirm hostname resolution, firewall rules, time synchronization, and network paths from the vCenter and ESXi hosts that will request keys.
- Complete the provider’s trust or registration workflow and verify that vSphere reports the provider as available.
- Document KMS clustering, backup, maintenance, and emergency access procedures. An external provider introduces an operational dependency: an unavailable KMS or broken trust relationship can block cryptographic operations.
Use the provider’s compatibility guidance for the exact vCenter and ESXi release. Do not infer support from the fact that a KMS speaks a generally familiar protocol.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCreate an encryption storage policy
The storage policy is the enforcement point for VM storage. It is separate from the key provider and should be designed before assigning it to a VM.
- Open Policies and Profiles and choose VM Storage Policies in the vSphere Client.
- Create a new policy, select the applicable vCenter, and give the policy a name that states its purpose, such as “Encrypted production VM storage.”
- Add the encryption requirement or encryption component available in your release. Configure whether it applies to the VM home namespace, virtual disks, or the storage objects supported by that policy.
- Add any placement, performance, availability, or tag rules needed for the target datastores. Encryption does not replace those requirements.
- Run the policy compatibility check against the intended datastore or cluster. Resolve any incompatible host, datastore, or capability result before assigning the policy.
- Save the policy and record its identifier and owner in your change documentation.
At the API level, key references include a key ID and a provider ID. Cluster cryptographic-mode policy is a different object: it can select a host key or a provider, and those values are mutually exclusive in that policy structure. Do not substitute cluster host-crypto mode for a VM storage policy; they control different layers.
Rank #4
- TPM 2.0 module for ASROCK motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x9P, 18 pin security module for ASROCK
- LPC 18 Pin for TPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASROCK
Apply the policy and encrypt a VM
After the provider is ready and the policy is compatible, assign the encryption policy to the VM or its disks using the storage-policy workflow in the vSphere Client. The available controls depend on the VM state, selected storage, provider, license, and your privileges.
- Open the VM, choose its storage-policy editing action, and select the encryption policy for the VM home and each disk that must be protected.
- Review the compliance and migration result. If files must move to satisfy the policy, schedule the relocation and confirm that the destination is supported.
- Use the VM’s security or cryptographic action to encrypt, rekey, or otherwise change encryption state when that action is exposed by your release.
- Power-cycle or reconfigure the VM only when the workflow requires it, and monitor recent tasks for key-provider or policy errors.
- Reopen the VM’s storage-policy and security views to verify that the intended disks are encrypted and that the policy reports compliance.
Release behavior is not uniform. A Broadcom support article describing a vCenter 8 workflow reports that adding a virtual Trusted Platform Module (vTPM) silently encrypts the VM. Older workflows and other releases may present an explicit encryption choice instead. Confirm the behavior for your exact vCenter and ESXi versions before using vTPM as an encryption trigger, and never assume that adding vTPM changed every disk’s policy unless the resulting state confirms it.
Grant only the permissions required for each task
Encryption controls are deliberately permission-sensitive. A user may be able to view a VM but still not see Encrypt VM, assign an encryption policy, or configure NKP.
Best Value
- Independent TPM Processor: The remote card encryption security module uses an independent TPM encryption processor, which is a daughter board connected to the main board.
- High Security: The TPM securely stores an encryption key that can be created using encryption software, without which the content on the user's PC remains encrypted and protected from unauthorized access.
- PC Architecture: TPM module system components adopts a standard PC architecture and reserves a certain amount of memory for the system, so the actual memory size will be smaller than the specified amount.
- Scope of Application: TPM modules are suitable for GIGABYTE for 11 motherboards. Some motherboards require a TPM module inserted or an update to the latest BIOS to enable the TPM option.
- Easy to Use: 12Pin remote card encryption security module is easy to use, no complicated procedures are required, and it can be used immediately after installation.
- Provider administration: NKP setup requires Cryptographic operations > Manage key servers according to the Native Key Provider setup guidance.
- VM cryptographic actions: Encrypting, decrypting, rekeying, or changing a VM’s cryptographic state can require separate cryptographic-operation privileges at the vCenter, cluster, host, or VM scope used by the task.
- Policy administration: Creating, editing, assigning, or checking a storage policy requires the relevant storage-policy privileges at the object scope involved.
- Object access: The role also needs inventory and datastore permissions for the VM, hosts, cluster, and destination storage.
Do not copy a broad administrator role merely to make a missing button appear. Identify the exact failed task and object scope, consult the privilege matrix for your vSphere release, and grant the smallest role that permits that task. The available excerpts do not define one universal least-privilege role for every encryption operation.
Troubleshoot a missing or disabled encryption control
| Symptom | Checks in the right order |
|---|---|
| Encrypt VM is absent | Confirm the user’s cryptographic-operation privileges, VM and datastore scope, a configured provider, compatible hosts, and an applicable encryption storage policy. A missing control is commonly an access or readiness problem rather than a VM corruption problem. |
| Encrypt VM is disabled | Check provider health, policy compatibility, VM power state and pending tasks, host membership, licensing, and whether the selected disks or datastore support the policy component. |
| Policy is incompatible | Inspect the compatibility report for the specific datastore, host, or capability. Verify that all candidate hosts support the provider and that the policy’s encryption component is valid for the storage type. |
| Provider shows unavailable | For NKP, check host association, provider status, certificates, and protected recovery configuration. For an external KMS, check DNS, firewall paths, time, certificates, credentials, KMS cluster health, and maintenance state. |
| Encrypted VM will not power on | Treat a missing or inaccessible key as a potential cause. Do not remove encryption or delete key objects while investigating. Preserve logs and follow the current Broadcom recovery procedure for the exact error and release. |
| vTPM changed encryption unexpectedly | Check the vCenter and ESXi versions and the VM’s resulting storage policy and cryptographic state. The vCenter 8 workflow described by Broadcom can silently encrypt when vTPM is added; other releases may behave differently. |
Capture the task name, timestamp, VM, host, provider status, policy name, and privilege scope when opening a support case. Those details distinguish an authorization failure from a key-service or compatibility failure.
Understand what VM encryption does not guarantee
VM encryption protects stored VM files and the cryptographic operations governed by vSphere. It is not a promise that a compromised running guest is harmless, nor does it defeat an administrator who legitimately controls the VM, hosts, vCenter, or the relevant keys. Use guest operating-system controls, network segmentation, identity protection, and privileged-access monitoring for those threats.
NKP’s local key storage also matters to physical security. VMware’s guidance warns that a stolen ESXi host may still be able to unlock encrypted VMs or vSAN datastores when the required keys remain available locally. If host theft or seizure is in your threat model, evaluate an external KMS and the procedures that keep its keys independent of the hosts.
Production-readiness checklist
- Document vCenter, ESXi, storage, and licensing versions.
- Choose NKP or an external KMS using a stated threat model and ownership plan.
- Configure the provider, protect its recovery material, and verify healthy status on every eligible host.
- Create and test an encryption storage policy against the intended datastores.
- Map each task to its required cryptographic, storage-policy, inventory, and datastore privileges.
- Encrypt a noncritical VM first and verify policy compliance, key references, power operations, backup behavior, and host mobility.
- Record how rekeying, KMS or vCenter outages, host replacement, and key recovery will be handled.
- Revalidate UI steps, licensing, and vTPM behavior after every vSphere upgrade.
When these checks pass, VM encryption becomes a controlled combination of key service, storage requirement, and authorization—not a hidden toggle whose availability depends on guesswork.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
