ESXi Host encryption Key

[iDIGIT]

Looking for PowerCLI script to list encryption key (the same output by "esxcli system settings encryption recovery list") for all ESXi hosts in a vCenter. 

Thanks,

[LucD]

You can run all esxcli commands via the Get-EsxCli cmdlet.

------------------------------

Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

------------------------------

[iDIGIT]

Great as always. 

[TX_Tundra]

Is it the TPM Encryption keys?  Try this.  I use the Start-Transcript/Stop-Transcript to output to a text file:

Start-Transcript -Path "C:\temp\tpmkeys.txt"

$VMHosts = get-vmhost | Where { $_.PowerState -eq "PoweredOn" -and $_.ConnectionState -eq "Connected" } | Sort Name

foreach ($VMHost in $VMHosts) {
    $esxcli = Get-EsxCli -VMHost $VMHost
    try {
        $key = $esxcli.system.settings.encryption.recovery.list()
        Write-Host "$VMHost;$($key.RecoveryID);$($key.Key)"
    }

    catch {
        
    }
} 

Stop-Transcript

[iDIGIT]

@TX_Tundra, 

Thanks. I was able to get desired results with: 

function Get-EncryptionRecoveryKeys {

    $esxiHosts = get-vmhost | Where { $_.PowerState -eq "PoweredOn" -and $_.ConnectionState -eq "Connected" } | Sort Name

    $encryptionKeys = @()

 

    foreach ($esxiHost in $esxiHosts) {

        $esxCli = Get-EsxCli -VMHost $esxiHost -V2

        try {

            $recoveryKeyList = $esxCli.system.settings.encryption.recovery.list.Invoke()

            foreach ($key in $recoveryKeyList) {

                $encryptionKeys += [PSCustomObject]@{

                    HostName = $esxiHost.Name

                    RecoveryKey = $key.Key

                    #Description = $key.Description

                    #CreatedTime = $key.Created

                    RecoveryID = $key.RecoveryID

                }

            }

        } catch {

            Write-Error "Failed to retrieve encryption keys for host $($esxiHost.Name)"

        }

    }

 

    return $encryptionKeys

}