VM Fusion 12.2 - how to remove VTPM added using vmx option managedVM.autoAddVTPM="software"

[kapitainsky]

VTPM from latest VM 12.2 works perfectly with Windows 11 clinet but I wonder what is the process of removing /disabling it?

I have noticed than VMware adds multiple new entries in vmx file after starting with initial single line managedVM.autoAddVTPM="software".

Trying to remove these lines does not make any good. I can remove TPM device but then disk is still marked as encrypted - and I do not have password to remove "encryption".

[wila]

Hi,

I played with this a couple of days ago and beyond removing the extra lines that are generated and the autovtpm line it seems you also need to remove the .vmxf and .nvram file. (Maybe even just one of them, but it worked after I did that)

--
Wil

[kapitainsky]

I have tried and it does not work - unless I make some mistake. Either VM is still "encrypted" or it shows dictionary problem - probably some discrepancy in vmx file.

By any chance do you remember which lines you removed?

[wila]

Hi,

If you added the autovtpm line at the bottom, it would be the lines underneath.

eg. here's a screenshot from the VM I played with (the lines underneath are the new ones)

https://pbs.twimg.com/media/FBq9fNOXoAo8EVv?format=png&name=900x900

I did remove one more file... the .vmsd file (wasn't sure if it mattered, so didn't mention it)
But you should only do so if you have no snapshots open as the .vmsd file contains snapshot meta data.

edit: Also.. make sure to close Workstation while you are editing the .vmx file.

--
Wil

[kapitainsky]

Thank you, It worked now perfectly. What was missing was removing .vmsd file as well.

[kapitainsky]

I was too quick.... TPM is gone and disk is not "encrypted" anymore but when I try to start VM:

"The disk '/Users/kapitainsky/Temp/Windows 11/Windows 11 - 64-bit.vmwarevm/Virtual Disk.vmdk' is encrypted and a required key was not found."

[wila]

Hi,

I've been doing some more testing.

My apologies, it worked for me the other day, but that was with a squeeky clean VM. No guest OS installed.

I just redid the steps with a VM with a guest OS in there and as it turns out the vmdk descriptor files are fully encrypted as well.

Not seeing a difference in the actual data, but you will have to regenerate the actual vmdk descriptor files. Note that that is only easy if you do not use the "all in one file" vmdk file setup.

If you have an old copy of the descriptor file then you could put that back, if not then you can try and create a new VM with the exact same size disk and use the descriptor file from that.

Hope this helps,
--
Wil

[kapitainsky]

I have tried this path - does not really work. So good advice for anybody considering using this option - backup your VM first.

[wila]

Hi,

Yep.. agreed. Making a backup is pretty much mandatory before enabling this feature.

Btw, your experience (and of a few others at this forum and on twitter) made me dig a bit deeper and write the following article.
https://www.vimalin.com/blog/what-you-should-know-about-vmwares-experimental-vtpm/

Hopefully it helps to understand a bit better how this all fits together and what happened.

edit for completeness:
Btw, putting back a descriptor from a disk of same size should work.
However.. if you ever resized your virtual disk over time then you need to follow those same steps as the descriptor is a bit different from a resized disk versus a disk originally created at that size.
Also note that putting back a virtual descriptor file is pretty easy, but if you have a monolithic virtual disk (iow, it's only one file) then it is more difficult as you'd have to inject the descriptor metadata into that virtual disk file.

--
Wil