VMware Workstation

 View Only
Expand all | Collapse all

Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

  • 1.  Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 28 days ago
    Edited by Technogeezer 17 days ago

    Note: This message has been updated and corrected to reflect the actual technical root cause after further investigation.
    New title: [UPDATED/CORRECTED] Critical: Windows Credential Manager entry deleted after migrating from 25H2 to 26H1 (Snapshots intact)

    Environment:

    • Host OS: Windows 11

    • Upgrade: VMware Workstation Pro 25H2 > 26H1 (Native 64-bit)

    • Guest VM: Windows 11 64-bit (vTPM & Partial Encryption enabled)

    Description of the issue:

    Following the 26H1 upgrade, one of my encrypted VMs became locked, prompting for a password.

    Technical observations & Corrections:

    • Snapshots: (Correction: The snapshots were never lost or broken). They remained perfectly intact. The empty Snapshot Manager was just a symptom of the UI while the VM was locked.

    • The Bug: Prior to the upgrade, both of my Windows VMs had a valid, unique, and different encryptedVM.guid in their .vmx files. The 26H1 upgrade directly caused the deletion of the entry for one of these VMs inside the Windows Credential Manager. Post-upgrade, only one GUID entry remained visible.

    • Resolution: I manually re-entered the encryption password in Workstation 26H1, which unlocked the VM and recreated the missing entry in the Windows Credential Manager.

    Question:

    The migration worked for one VM but deleted the credential entry for the other. Do you know what could have caused the installer or the migration routine to wipe out this specific GUID entry?



  • 2.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 28 days ago

    Again, Workstation does not encrypt VMs on its own. You had to select some kind of encryption for it.

    Can you elaborate on "Windows 11 64-bit with vTPM enabled "? Was the VM created with Workstation 17 or later and encrypted through the GUI with partial encryption? Or did you use the experimental vTPM (which involved manually editing the .vmx file) that was introduced in Workstation 16.2? 



    ------------------------------
    Paul Rockwell (technogeezer)
    vExpert 2026 (3x)
    ------------------------------



  • 3.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 28 days ago
    Edited by Technogeezer 17 days ago
    Sorry, I've corrected my first message since then.

    The VMs were created in Workstation Pro 25H2 and migrated to the 26H1 build (26.0.0, Build 25388281).
     
    Setup for both Windows 11 VMs (running on Windows 11 Host):
     
    Partial Encryption enabled via GUI.
     
    vTPM enabled with 'Remember password in Credential Manager' checked.
     
    The issue:
    After migrating to 26H1, one VM worked perfectly without a prompt, while the other was locked and required a manual password.
     
    I have since recovered the password and regained access, but the inconsistent behavior remains unexplained. Both VMs had identical configurations; it seems the link between the .vmx GUID and the Windows Vault was preserved for one but broken for the other during the upgrade. Is this a known issue with how the Credential Manager handles multiple VMs during a host version transition?

    -------------------------------------------



  • 4.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 26 days ago

    Similar issue here... after migrating to 26H1, one VM worked perfectly without a prompt, while the other was locked and required a manual password.

    How did you recover the password?

    -------------------------------------------



  • 5.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 25 days ago
    Edited by Technogeezer 17 days ago

    I managed to recover the password. This was the only solution because my Windows Credential Manager entry for that VM had been deleted, and a standard system restore point would not resolve this issue.




  • 6.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 25 days ago

    "Is this a known issue with how the Credential Manager handles multiple VMs during a host version transition?"

    I don't know about no encrypting&passwords, but ...

    Did you have multiple different VMs OR just the same VM twice? I mean, did you copy the VM and say "I moved it", instead of "I copied it". This might - I say might - make a difference for seemingly odd behavior.




  • 7.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 25 days ago

    No the VMs were working fine before the upgrade, they were not moved or copied, and the identification manager shows 1 entry for each VM

    -------------------------------------------



  • 8.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Broadcom Employee
    Posted 18 days ago
    Edited by Technogeezer 17 days ago

    Snapshots Disappeared: While the Snapshot Manager in the UI is empty, the physical files (.vmsn and -00000X.vmdk) are still present in the VM directory (e.g., Windows_Sandbox_-Snapshot38.vmsn). The encryption seems to have broken the link to the .vmsd file.

    This does not make any sense.  If the VM was locked because you didn't have the encryption password, you can't open the VM and can't access the Snapshot Manager.  How were you observing that "snapshots disappeared"?

    If you are observing that encrypted VMs (whether partially or fully encrypted) that had their encryption passwords remembered in the Windows Credential Manager do not get unlocked automatically after upgrading to VMware Workstation 26H1, then you probably can recover the encryption password from the Windows Credential Manager.  Unfortunately, Windows does not provide a built-in way to view passwords in the Credential Manager (although there are third-party tools that can do so).  Also, unfortunately previous versions of VMware Workstation made it extremely unclear which credentials corresponded to which VM (those credentials are shown with just a GUID, e.g. {A94D7E4F-28CC-4CC9-B434-C2C08FA2AEB0}; this corresponds to encryptedVM.guid value in the encrypted VM's .vmx file).  That's what we finally fixed in Workstation 26H1, and that's why the management of encrypted VM passwords was changed.  Those passwords are supposed to be migrated to the new format automatically.  I am not sure why that did not happen in your case; a UI log from opening the VM might have more details.  At any rate, if Workstation 26H1 failed to migrate a saved password for an encrypted VM, the old entry should still be there in Credential Manager.

    -------------------------------------------



  • 9.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Broadcom Employee
    Posted 18 days ago

    Also, to anyone else encountering a problem where an encrypted VM is not automatically unlocked in VMware Workstation 26H1 but was automatically unlocked in Workstation 25H2 or earlier, I would be curious to know the following:

    1. Examine the encrypted VM's .vmx file and note the value of encryptedVM.guid
    2. Open the Windows Credential Manager, and click "Windows Credentials".   In the "Generic Credentials" section, does an entry exist for the GUID observed in step 1?
    -------------------------------------------



  • 10.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 11 days ago
    Edited by State2816 11 days ago

    Same issue, and i think it's related to cloned VMs.

    Started with Win11-base image (using Workstation 17). Has TPM and showing partially encrypted. Cloned the base image, for a number of VMs. All using older versions of workstation.  Never prompted  for password. 

    Updated to 26H1, Win11-base image opened fine. All other VMs that are cloned prompted for a password.

    There's one relevant entry in credential manager, for base image only:

    Target: LegacyGeneric:target=VMware Encrypted VM: C:\Users\xxxxx\OneDrive\Documents\Virtual Machines\Win11-Base\Win11-Base.vmx
        Type: Generic
        Local machine persistence

    All the previously cloned VMs did not have an entry in credential manager.

    Decrypting that entry using ps module

    $creds = Get-StoredCredential -Target "VMware Encrypted VM: C:\Users\xxxxx\OneDrive\Documents\Virtual Machines\Win11-Base\Win11-Base.vmx" -AsCredentialObject 

    and converting it to readable format

    $passwordBytes = [System.Text.Encoding]::Unicode.GetBytes($creds.Password)
    $asciiString = [System.Text.Encoding]::ASCII.GetString($passwordBytes)
    Write-Host "Password: $asciiString"

    yields a password, which can be used to unlock the VMs, and there's a box to save the password in credential manager (that is barely visible with dark theme). This then saves the credentials for each VM into creds manager, and does not require an unlock password on stopping and re-starting VMware workstation. Not checking box does not save the password (as expected). 

    When password is saved for these VMs, it is exactly as in the format above, pointing to the .vmx file. 

    Cloning my Win11-base image into a new VM in 26H1, closing and re-opening VMware workstation ALSO prompts for password, which is the same as in what was pulled via powershell, so a cloned VM does not generate an entry automatically in 26H1 and still expects a password. 


    There definitely seems to be some kind of an issue - i imagine that cloned VMs should reference the same password as base-VM in cred manager (as the password is the same), but that does not happen in 26h1.  

    -------------------------------------------



  • 11.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Broadcom Employee
    Posted 11 days ago

    Ah, that's a good point.  Passwords will not be migrated for all clones of encrypted VMs.

    Clones (especially full clones, and we allow only full clones for encrypted VMs) are treated as completely independent VMs.  They get a new UUID and new MAC address.  The encryption password for a clone is independent of the original VM.  You can change the password of one (or even decrypt one) without affecting the other.  In Workstation 26H1, encrypted clones get separate entries in the Credential Manager.

    Unfortunately, the old Credential Manager usage that Workstation 25H2 and earlier had a number of design issues (which again is why it needed to be overhauled).  Among them was that all clones of an encrypted VM shared the same credential in Credential Manager, so changing or removing the encryption password to one would break the rest.  Another issue is that it's not possible to automatically add saved encryption passwords for all clones because we don't necessarily know what clones have been created.  Furthermore, although users opted-in to saving the encryption password to the original VM, they never opted-in to saving encryption passwords for the clones.

    -------------------------------------------



  • 12.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 11 days ago
    Edited by State2816 11 days ago

    duplicate



  • 13.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 18 days ago

    Hi James,

    Thank you for the insights into the 26H1 credential management changes.

    To clarify and correct the previous assumptions: the snapshots were never lost or broken. They remained perfectly intact and accessible. The issue was strictly limited to the deletion of an entry in the Windows Credential Manager during the upgrade process.

    Here is exactly what occurred based on the diagnostic steps you mentioned:

    • Prior to the upgrade: Both Windows VMs were working normally, each possessing a valid, unique, and different encryptedVM.guid in their respective .vmx files.

    • The Bug: This major upgrade directly caused the deletion of the entry for one of the VMs inside the Windows Credential Manager. Post-upgrade, only one of the two distinct GUID entries remained visible in the "Generic Credentials" section.

    • Resolution: Because the entry was wiped out by the upgrade process, I had to manually input the encryption password within Workstation 26H1. Doing so successfully unlocked the VM and recreated the missing entry in the Windows Credential Manager.

    The 26H1 migration worked, but one of the entries in the Windows Credential Manager was deleted.

    This still does not explain why this deletion happened in the first place. Do you know what could have caused the installer or the migration routine to wipe out this specific entry?

    -------------------------------------------



  • 14.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Broadcom Employee
    Posted 16 days ago

    Post-upgrade, only one of the two distinct GUID entries remained visible in the "Generic Credentials" section.

    So one of the two GUID-based entries was removed from the Credential Manager, and no corresponding "VMware Encrypted VM: ..." entry was created?

    Do you know what could have caused the installer or the migration routine to wipe out this specific entry?

    The credential migration is not done by the installer but is done by the VMware Workstation UI the first time you attempt to open an encrypted VM with its password saved in the old format.

    It should not be possible for the old entry to be removed without first creating a new entry.  The code to do the migration is intentionally written to delete the old entry only after the new entry is successfully created.

    -------------------------------------------



  • 15.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 16 days ago

    Hi James,

    Yes, your understanding is exactly correct.

    I even attempted to downgrade back to the previous version, but the issue persisted as the entry was already gone. I ultimately had to track down and manually re-enter my original password to recover the VM.

    Since you mention the UI routine is coded to delete the legacy entry only after a successful new creation, this sequence clearly failed. The deletion step occurred, but the creation step was silently skipped or aborted without any error message, leaving the VM locked and the credential store wiped.

    -------------------------------------------



  • 16.  RE: Critical: Automatic VM encryption and lost snapshot chain after migrating from 25H2 to 26H1

    Posted 15 days ago
    Edited by Technogeezer 10 days ago
    Thank you for your replies.
     
    Even though the version upgrade is significant, an informational message and a prompt before performing the upgrade would be helpful, as the VMs were behaving normally. This could disrupt usability, and especially the application's functionality, if the user no longer has access to their password, as it's a destructive process.