Updates

vSphere Tools/GetKeys.ps1

@@ -0,0 +1,150 @@
+param (
+	[string]$vCenter = "",
+	[switch]$SaveCred = $false,
+	[switch]$Help = $false
+)
+
+# Variables
+$fileVersion = "1.1.0"
+$fileDate = "2025-04-02"
+
+# Display Script Banner
+Write-Host "--------------------------------------------------" -ForegroundColor White
+Write-Host "vSphere TPM Key Inventory" -ForegroundColor Green
+Write-Host "Version $($FileVersion) ($($FileDate))" -ForegroundColor Green
+Write-Host "Written by Charlie Silverman" -ForegroundColor Green
+Write-Host "--------------------------------------------------" -ForegroundColor White
+
+if ($Help) {
+	Write-Host 
+	Write-Host "Purpose:  Collect TPM encryption keys for all ESXi hosts."
+	Write-Host "Command Syntax:"
+	Write-Host "   GetKeys.ps1 (-vcenter [vcenter host name]) (-savecred) (-help)"
+	Write-Host "Command Line Options:"
+	Write-Host 
+	Write-Host -NoNewLine "    -vCenter    " -foregroundcolor Green
+	Write-Host "- The FQDN or IP address of a vCenter server."
+	Write-Host -NoNewLine "    -savecred   " -foregroundcolor Green
+	Write-Host "- Configure and store vCenter server credentials.  This will only store the credentials under"
+	Write-Host "                  the current logged in user."
+	Write-Host -NoNewLine "    -help       " -foregroundcolor Green
+	Write-Host "- Display command help."
+	Write-Host
+	Write-Host "If no any of the information is not provided, you will be prompted.  If a credential has been previously stored, it will be used again unless the -savecred option is specified."
+	Write-Host
+	exit
+}
+
+if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI*)) {
+	Write-Host "ERROR: VMware PowerCLI is not installed!" -foregroundcolor yellow
+	exit
+}
+
+$hideresult = Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
+
+if ($vCenter -eq "") {
+	$vCenter = Read-Host "Enter name of vCenter Server"
+}
+
+if ($savecred) {
+	$credential = Get-Credential -Message "Enter credentials for vCenter server $vcenter" 
+	$credential | Export-Clixml -path $env:USERPROFILE\kis-getkeys-$vcenter.cred
+	Write-Host "Saving credentials."
+}
+
+if (Test-Path -path $env:USERPROFILE\kis-getkeys-$vcenter.cred -PathType Leaf) {
+	$credentials = Import-Clixml -path $env:USERPROFILE\kis-getkeys-$vcenter.cred
+	Write-Host "Using stored credentials"
+} else {
+	$credentials = Get-Credential -Message "Enter credentials for vCenter server $vcenter"
+	if (!$credentials) {
+		Write-Host "ERROR: No credentials were entered" -foregroundcolor yellow
+	}
+}
+
+try {
+	Write-Host -NoNewLine "Connecting to vCenter $vcenter..."
+	$vcconn = Connect-VIServer $vcenter -Credential $credentials -ErrorAction SilentlyContinue
+	Write-Host " Success" -ForegroundColor green
+} catch {
+	Write-Host " Failure" -ForegroundColor Yellow -BackgroundColor Red
+	exit
+}
+
+$now = (Get-Date).ToString("yyyyMMdd_hhmm")
+$exportfile = "TPMKeys-$vCenter-$now.csv"
+
+$VMHosts = Get-VMHost | Sort-Object
+$VMHostKeys = @()
+foreach ($VMHost in $VMHosts) {
+    $esxcli = Get-EsxCli -VMHost $VMHost -V2
+    try {
+        $encryption = $esxcli.system.settings.encryption.get.Invoke()
+        if ($encryption.Mode -eq "TPM")
+        {
+            $key = $esxcli.system.settings.encryption.recovery.list.Invoke()
+            $hostKey = [pscustomobject]@{
+                Host = $VMHost.Name
+                EncryptionMode = $encryption.Mode
+                RequireExecutablesOnlyFromInstalledVIBs = $encryption.RequireExecutablesOnlyFromInstalledVIBs
+                RequireSecureBoot = $encryption.RequireSecureBoot
+                RecoveryID = $key.RecoveryID
+                RecoveryKey = $key.Key
+            }
+            $VMHostKeys += $hostKey
+        }
+        else
+        {
+            $hostKey = [pscustomobject]@{
+                Host = $VMHost.Name
+                EncryptionMode = $encryption.Mode
+                RequireExecutablesOnlyFromInstalledVIBs = $encryption.RequireExecutablesOnlyFromInstalledVIBs
+                RequireSecureBoot = $encryption.RequireSecureBoot
+                RecoveryID = $null
+                RecoveryKey = $null
+            }
+            $VMHostKeys += $hostKey
+        }
+    }
+    catch {
+        $VMHost.Name + $_
+    }
+}
+Write-Host "Exporting TPM keys for all hosts in $vcenter`n   to $exportfile..." -NoNewLine
+try {
+	$VMHostKeys | Export-Csv $exportfile
+	Write-Host " Complete" -ForegroundColor Green
+} catch {
+	Write-Host " Failed" -ForegroundColor Red
+	exit
+}
+
+Write-Host "Attempting to reset all TPM Encryption Recovery Key Backup Alarms..."
+# Locate TPM Encrytpion Recovery Key Backup Alarm ID
+$alarm = Get-AlarmDefinition "TPM Encryption Recovery Key Backup Alarm"
+$alarmID = $alarm.Id -split '-', 2 | select-object -last 1
+$alarmMgr = Get-View AlarmManager
+
+foreach ($VMHost in $VMHosts) {
+	try {
+		$decalarm = $VMHost.ExtensionData.TriggeredAlarmState | where-object {$_.Alarm.Value -eq $alarmID} | Select-Object -first 1
+		if ([string]::IsNullorEmpty($decalarm)) {
+			continue
+		}
+	} catch {
+		Write-Host "Error retrieving alarms for host $VMHost"
+		continue
+	}
+}	
+
+Write-Host "Clearing all yellow alarms from ESXi hosts..."
+try {
+	$filter = New-Object VMware.Vim.AlarmFilterSpec
+	$filter.Status += [VMware.Vim.ManagedEntityStatus]::yellow
+	$filter.TypeEntity = [VMware.Vim.AlarmFilterSpecAlarmTypeByEntity]::entityTypeHost
+	$filter.TypeTrigger = [vmware.vim.AlarmFilterSpecAlarmTypeByTrigger]::triggerTypeAll
+	$alarmMgr.ClearTriggeredAlarms($filter)
+	Write-Host " Success" -ForegroundColor Green
+} catch {
+	Write-Host " Failed" -ForegroundColor Red
+}