PowerProtect Data Manager 19.11 Virtual Machine User Guide

Support for backup and restore of encrypted virtual machines

Backup and restore of encrypted virtual machines is supported in PowerProtect Data Manager, with the following limitations:

Restoring encrypted virtual machines to a different vCenter server is not supported. You must perform the restore to the original virtual machine or a new virtual machine on the same vCenter server.
Restoring an encrypted virtual machine backup to a new virtual machine on the original vCenter server will restore the virtual machine disks (VMDKs) in clear text if the VMDKs are not encrypted. The article "Virtual Machine Encryption" at https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html provides more information about manually changing the virtual machine policy to enable encryption of VMDKs.
In order to use Hot Add transport mode, all VM proxies with access to the encrypted virtual machines datastore must be encrypted as well. For example, if encrypted virtual machines reside in an ESXi cluster, all VM proxies deployed on the cluster must also be encrypted.
In order to backup and restore encrypted virtualization-based security (VBS) and virtual Trusted Platform Module 2.0 (vTPM) virtual machines, vCenter 7.0 U1 or later is required.