In this post, we are going to see how to encrypt a Virtual Machines using Bitlocker (OS level Encryption).
In High level this consists of 3 steps.
- Add KeyProviders in Vcenter
- Add vTPM module in VM
- Install Bitlocker and encrypt the drives.
Configuring KeyProviders:
Starting from vSphere 7.0U2 we have Native Key Provider. The below article explains pre-requisites and steps to configure Native key provider in vCenter.
Configuring vTPM:
Once Keyprovider is added successfully, go to VM edit settings and add a TPM Module. Below document explains the Pre-requisites and steps to add TPM.
Once these are Configured, OS team should be able to encrypt VMs using Bitlocker.
By Default, Virtual machine disks are detected as Removable drives in OS. Due to this reason, you will not find an option to Auto Unlock drive while enabling Bitlocker. To detect this as Fixed Data drives, please add devices.hotplug = FALSE entry to vmx configuration file. Below KB article explains the same.