VM encrypted itself, don't know the password (part.2) (after 13.5 update)

[digifox55]

Hello, I read these topics: VM-encrypted-itself-don-t-know-the-password  and VM-asking-for-password but I still need help.

I updated Fusion 13 Pro from v. 13.0.2 to 13.5 a few days ago. I have a M2 MacBook with Sonoma, and run several vms of Win11 ARM.

After updating I noticed that I could only open my default vm file, all the other vms raised a popup saying "The virtual machine "Windows 11 64-bit arm" is encrypted. You must enter its password to continue.". I am sure I had never enabled encryption before. In fact I could close and reopen my default vm with no password prompt.

After noticing that my def-vm wasn't properly scaling the resolution anymore (no way to stretch it to fit it to the window), I decided to downgrade to 13.0.2. As soon as I went back to 13.0.2 not only my other-vms kept asking me the password, but also my def-vm has become encrypted with the same prompt. I went back to 13.5 again and def-vm is still encrypted.

Any ideas to recover my instances? Could a full macos time-machine backup lead me to a point where the vms aren't encrypted?

Thank you so much in advance!

[ColoradoMarmot]

You had to enter a password to create a Windows 11 ARM VM, and optionally saved it to the keychain.    You can check keychain access to see if you saved it there.

Time machine is unreliable to restore virtual machines, but there may be other workarounds if you can't find the password.

[bluesky2000]

I have the same problem...

[CATTS-IT]

I have the same issue, previoulsy used my VM prior to Somona and the VMFusion update OK, never set a password on VM creation way back when.  I have checked my Keychain and only have an entry for VMWare Fusion Encryption Key...

How can this be applied without some warning or prompt? And more importantly how do I get access to my VM back without having to spend hours re-creating it...  I have tried restoring a backup of my VM file, but it has the same problem when I try to access it.

I also tried the editing of the process suggested here - https://communities.vmware.com/t5/VMware-Fusion-Discussions/VM-encrypted-itself-don-t-know-the-passw... even though it dates back to 2021 and my issue started earlier this week.

[Technogeezer]

VMs do NOT encrypt themselves.  Encryption being enabled is either a choice that you made, or was made for you when you created a Windows 11 guest operating system with Fusion 13. In either case, you're prompted for a password (or offered to auto-generate one) and offered to save it in the Keychain.  You get a very stern warning if you do not offer to save the key in the keychain.

Take a look at that entry of "VMware Fusion Encryption Key" in the Keychain. You'll find that the "Where" field points to the .vmx configuration file of the VM, and if you double click  the item and click on the "show password" buttion, you'll see the password. 

The old full VM encryption feature also asked you for an encryption key when you turned on the encryption.

The only time that Fusion encrypted a VM "by itself" with a key that you didn't specify is if you made the unfortunate choice (or mistake) of enabling the experimental partial encryption feature of Fusion 12 or Workstation 16. Even then, it didn't do things by itself - you  had to go out of your way and manually edit the .vmx file in order to enable that feature. The feature wan't ready for prime time and was a one-way street to problems. 

Fusion 13.5 does not upgrade the encryption scheme to the new XTS encryption unless you tell it to. It will not apply that to an unencrypted VM. 

If you've partially encrypted the VM "Only encrypt the files necessary to support a TPM" - then the VMDK files of the VM are not encrypted. A new VM can be created and the virtual disks "transplanted" from the old VM into the new one. If you've fully encrypted the VM and forgot/don't have access to the password - you've hit a brick wall. 

[CATTS-IT]

Thanks, however I did not make a choice nor was there an issue with the VM prior to this week following the update.

The VM was originally created in 2021 (in whatever version was available for MAC at that point) and I have been using it since then with no issue, there was no stern warning about a password when it was originally created.  It was only since the update to VMware Fusion Pro 13.5.0 that I have been prompted by this mesage to enter a password that I did not set.  

The keychain info looks like this, see attached screenshots

  - no password ...

[Technogeezer]

That's indeed very strange.

You wouldn't happen to have a copy of that VM and its .vmx file available from before the 13.5 update, would you? Just would like to take a look at it.

[CATTS-IT]

Hers the VMX file, its from my last backup from 27 September which was before the latest VMware update (which I installed yesterday). 

[Technogeezer]

Well I understand what's going on now...

The VM was encrypted with the experimental vTPM implementation of Fusion 12.2. That's evident by the presence of the following line in the .vmx file

managedVM.autoAddVTPM = "software"

The system did auto-generated the encryption key for you without your input. It didn't automatically encrypt the VM though. The vmx file had to be hand edited in order for the encryption to be enabled. The experimental vTPM did not have a GUI setting to enable it. 

That vTPM should never have seen the light of day nor should anyone have used it. As I said, it's a one-way street. One of the huge failures of that implementation was that it autogenerated the encryption key and didn't give you any way to know what it is. The second big failure of the implementation was that the auto-generated encryption key is tied to the system somehow - meaning you can't easily move the VM to another machine.

Those defects were fixed in Fusion 13 and Workstation 17. Since those releases didn't change anything, all worked fine. But it looks like if you try to upgrade to Fusion 13.5 and then try to upgrade the encryption algorithm of a VM using that broken feature, that's where the problems occur. 

Did you notice if Fusion 13.5 asked you to upgrade the encryption the first time you powered on the VM after upgrading the Fusion release?

I'd recommend any user that had the experimental vTPM enabled to back up all the files within the VM before upgrade. Then rebuild the VM under Fusion 13.5 using the partial encryption option. 

You may wish to view a blog post by Wil van Antwerpen https://www.vimalin.com/blog/what-you-should-know-about-vmwares-experimental-vtpm/ abut the subject and you'll get an idea of just how broken that feature is. He also has some discussion about how to recover from that mess but there is "some assembly required".

[CATTS-IT]

Hmmm, I wonder if I edit the vmx file and removed those lines before placing it into the Vmware folder and then trying to open it?  Will give that a go and let you know.  I did have a look at the article you mentioned prior to finding this forum.  I tried some of that but it didnt work as the VM file was already in the folder.

Thanks for your insight.

[CATTS-IT]

Nope, that didnt work.  I have now created a new VM and will try moving the disk files from the original into that one.

[CATTS-IT]

So that didnt work either, still got the password message and couldnt open the VM.

I have created a fresh VM and put everything back.  Very dissapointed that this has been forced on people without warning.