$reportFile = Join-Path $BackupPath "backup_report.txt" $report | Out-File -FilePath $reportFile
$report = @() $report += "# TPM Recovery Key Backup Report - $(Get-Date)" $report += "# vCenter: $vCenterServer" $report += " n## Encrypted VMs:" $encryptedVMs | ForEach-Object $report += "- $($_.name)" $report += " n## Hosts with TPM:" $hosts | Where-Object $ .TpmPresent -eq $true | ForEach-Object $report += "- $($ .name)"
$hosts = Get-VMHost foreach ($esxiHost in $hosts) try Out-File -FilePath $keyFile Write-Host "Backed up host: $($esxiHost.name)" -ForegroundColor Green
# Add to crontab (weekly backup) 0 2 * * 1 /opt/scripts/tpm-backup.sh | Key Type | Rotation Frequency | Retention | |----------|-------------------|-----------| | VM encryption keys | Never (unless compromised) | Permanent | | Host TPM keys | Each host maintenance | 3 generations | | Recovery passwords | Every 90 days | 5 years | Part 7: Compliance Considerations Documentation Requirements Create a key inventory document (stored separately from keys):
catch Write-Host "No TPM or key retrieval failed for: $($esxiHost.name)" -ForegroundColor Yellow
$reportFile = Join-Path $BackupPath "backup_report.txt" $report | Out-File -FilePath $reportFile
$report = @() $report += "# TPM Recovery Key Backup Report - $(Get-Date)" $report += "# vCenter: $vCenterServer" $report += " n## Encrypted VMs:" $encryptedVMs | ForEach-Object $report += "- $($_.name)" $report += " n## Hosts with TPM:" $hosts | Where-Object $ .TpmPresent -eq $true | ForEach-Object $report += "- $($ .name)"
$hosts = Get-VMHost foreach ($esxiHost in $hosts) try Out-File -FilePath $keyFile Write-Host "Backed up host: $($esxiHost.name)" -ForegroundColor Green
# Add to crontab (weekly backup) 0 2 * * 1 /opt/scripts/tpm-backup.sh | Key Type | Rotation Frequency | Retention | |----------|-------------------|-----------| | VM encryption keys | Never (unless compromised) | Permanent | | Host TPM keys | Each host maintenance | 3 generations | | Recovery passwords | Every 90 days | 5 years | Part 7: Compliance Considerations Documentation Requirements Create a key inventory document (stored separately from keys):
catch Write-Host "No TPM or key retrieval failed for: $($esxiHost.name)" -ForegroundColor Yellow
