topic Re: Get ESXI host Encryption Mode status in powercli in VMware PowerCLI Discussions

Get ESXI host Encryption Mode status in powercli

h0d1p4p4 — Mon, 06 Nov 2023 11:02:35 GMT

Is there a way to only get the Host Encryption Mode status of an esxi via powercli? All our esxi have host encryption status disabled, but I didn't managed to find a way to get this info with powercli. Thanks!

Re: Get ESXI host Encryption Mode status in powercli

LucD — Mon, 06 Nov 2023 13:07:38 GMT

Try like this

Get-VMHost | Select Name, @{N='CryptoState';E={$_.ExtensionData.Runtime.CryptoState}}

Re: Get ESXI host Encryption Mode status in powercli

h0d1p4p4 — Mon, 06 Nov 2023 13:34:45 GMT

Works great, thanks! I was struggling with extensiondata.config.tpmattestationenabled and cryptomanager, but seems it was a dead end. The result of this command is "incapable" which could mean "disabled" I guess? The host encryption mode is indeed disabled.

Re: Get ESXI host Encryption Mode status in powercli

LucD — Mon, 06 Nov 2023 13:52:46 GMT

I think 'incapable' means that this ESXi node doesn't have the required HW to use encryption.
The possible values are in the enum CryptoState
I'm not sure if that property will actually say 'enabled', I suspect if it doesn't say 'safe' it means it is not enabled.

That also seems to be the logic used in the VMware.VMEncryption module