Dazzathedrummer
Contributor
Contributor

Can't get back into encrypted VM

Hi,

I've been running VM Fusion with W11 Arm for a couple of weeks and all seemed ok but with a few niggles (can't activate windows). I tried downloading the Tech Preview and it seemed to run a bit smoother but I had some problems with black screens when switching programs and highlighting ranges in Excel.

I was in the middle of sitting a mock exam (Financial Modelling so Excel PC works better than Excel Mac). I thought I'd switch from the Tech Preview back to the regular Fusion but when I tried to open the VM I got a message saying that the VM is encrypted and I need to enter a password - I've tried all the likely passwords but nothing is working.

Is there any way to get in without the password or do I need to create a new VM?

I'm glad it didn't happen in the real exam - I did have to finish the mock exam in Excel Mac though!

 

Reply
0 Kudos
Technogeezer
Immortal
Immortal

The tech preview uses a different encryption algorithm than Fusion 13 and earlier - this is spelled out in the Tech Preview Testing Guide and in KB article https://kb.vmware.com/s/article/93071. You can’t simply provide the password to move that VM back to Fusion 13 because it can’t decrypt it  

Try the following to move that VM back to Fusion 13.

Start with the Tech Preview

In the VM’s settings, remove the TPM device, decrypt the VM using the password, then set the VM’s compatibility back to hardware version 20.

Now remove the Tech Preview and install Fusion 13.

Start Fusion 13.

In the VM’s settings, encrypt the VM (only the files needed to support a TPM). Hint: remember the password even if Fusion stores it in the Keychain). Then add a TPM device to the VM.

You can now re-start the VM under Fusion 13. 

- Paul (Technogeezer)
Editor of the Unofficial Fusion Companion Guides
Reply
0 Kudos
Dazzathedrummer
Contributor
Contributor

Thanks. 

I think I need to start again as I’ve no idea what the password is - I’ve tried all my regular ones but it’s not having it.

its not too much of a big deal as I keep all my files in OneDrive. 

Reply
0 Kudos
Technogeezer
Immortal
Immortal

As a matter of practice when creating an encrypted virtual machine, either

  • Encrypt the VM with a password of your choosing, then remember it, or
  • Auto-generate the password, display it in the dialog before hitting "return", then remember it.
  • Optionally enable the password to be remembered in the Keychain.

The key thing here is "remember the password". Do not rely on the system to remember it for you, because there are situations where you will need to know the password. Having the password remembered in the Keychain is a convenience that does not eliminate the need for you to remember the password.

I get a feeling that too many people just "click through" the encryption dialog, letting the system auto-generate a password and remember it. It's a really, really bad idea not to know what the password is. 

For example, should you want to move the VM to another system, you will need to know the password to open it (the password doesn't come along with the system). Also if something goes wrong with the user and their keychain, without the password the VM may be toast.

There is an alternate way of getting that VM back if it's been encrypted with the "only the files needed to support a TPM" option. It's not for someone that's afraid of getting their hands dirty. The VMDK files of an encrypted VM using this method are not encrypted. You would create an empty VM, copy the vmdk files from the old VM's bundle folder to the new one, then make edits to the .vmx file to make sure the virtual disk is pointing to the copy of the old disk. 

- Paul (Technogeezer)
Editor of the Unofficial Fusion Companion Guides
Reply
0 Kudos
Jer0en
Contributor
Contributor

Had the same problem when changing employer.

Got in contact to use my old laptop to decrypt the password using the following utility, worked great.

You don't need to re-encrypt a new password. After decrypting you can simply change the password in de vm settings via GUI.

https://www.syvik.com/multidesk/howto.win11.vmware16.en.html

Reply
0 Kudos
Technogeezer
Immortal
Immortal

That utility may fix things in the short run, but in the long run it may be better to stop using that broken partial encryption and convert it to one of the supported mechanisms. That’s going to be painful, but it’s better than having to deal with the possibility that VMware suddenly removes “support” for an unsupported feature in a future Fusion release. 

- Paul (Technogeezer)
Editor of the Unofficial Fusion Companion Guides
Reply
0 Kudos