Hi,
I wrote that article about the experimental vTPM feature and also made the statement about "you can't move your VM to another host". While that is true for a VM using the experimental feature right now, this might change (and hopefully does change as it is a major showstopper from my point of view).
What I explicitly did not mention is how it works for full encrypted VM's as I don't normally use that feature myself.
So I just set out with a small VM (running Haiku OS) played a bit with that.. then cloned it and subsequently encrypted that Haiku VM.
Dragged it over to another host and tried to run it there.
I had no problem using that VM after supplying the password, it just worked.
This particular test shows that it is not the encryption itself that locks a VM to one physical host.
Note the following:
Haiku OS does not use a vTPM, so the VM had no TPM.
But Windows 11 really wants to have a vTPM, but as long as you have not used that vTPM to encrypt the data within your VM (like with bitlocker), you can remove the vTPM (and add one back later on)
As stated in the article Windows will complain a bit during login as Windows 11 will ask you to setup the login PIN again.
More testing will follow. Like with an actual Windows 11 VM 😂, but the initial test with a fully encrypted VM looks promising.
Hope this helps,
--
Wil
Hi,
@DVE2000 wrote:Fusion does say that removing it will destroy all encrypted data. From what you've said, this doesn't seem quite right.
So the steps would be remove the tpm2 module. Ignore any warnings of Death By Data Loss. Move the VM to another computer, add a new TPM2 module, and then everything should boot up just fine. I'll probably have to use my login password, and then setup a new PIN.
Hopefully, the TPM module could be removed on the second computer if not removed on the first. (Like in the case of the original Mac going belly up or whatever.)
I _think_ that you can ignore that, but to be sure I wouldn't remove the TPM on the first computer on my first try. In your case I would make a full backup of the VM before doing anything that might result in data loss, just to make certain to have something to fall back on.
Like you say, it would be safer to remove the TPM on the 2nd computer, but only if you have to do that.
--
Wil
That's really good to hear.
I have updated my article with your findings, thanks for reporting it back here.
--
Wil
@DVE2000 wrote:Cool. Glad to have been able to contribute something to add. I wasn't aware of vimalin, but now that I am, I'm definitely going to look into it. I've been doing the manual backup copy every few months with shutdown machines...
Sadly though making a backup of an encrypted VM that is running is not supported atm. That's on my list of things to look into once I have a bit more time.
--
Wil
