Encrypt and Restrict a Virtual Machine

You can encrypt a virtual machine to secure it from unauthorized use. You can also enable restrictions to prevent users from changing configuration settings.

Depending on the size of the virtual machine, the encryption process can take several minutes or several hours.

Prerequisites

• Power off the virtual machine.
• Familiarize yourself with the encryption feature limitations. See Virtual Machine Encryption Limitations.
• Familiarize yourself with restricted virtual machine expiration behavior. See Restricted Virtual Machine Expiration.

Procedure

1. Select the virtual machine and select VM > Settings.
2. On the Options tab, select Access Control.
3. Click Encrypt.
4. Click Encrypt, type an encryption password, and click Encrypt.

   The encryption password is required to gain access to the virtual machine. It does not prevent the user from changing the virtual machine configuration. Turn on restrictions and enter a password to prevent the user from changing the virtual machine configuration.

   Important: Record the encryption password you use. If you forget the password, Workstation Pro does not provide a way to retrieve it.
   Workstation Pro begins encrypting the virtual machine. After the encryption process is complete, you can optionally set a restrictions password.
5. (Optional) To enable restrictions, select the Enable restrictions check box and configure restrictions options.

   Option	Action
   Restrictions password	Set the restrictions password. The restrictions password prevents users of the virtual machine from changing the virtual machine configuration. Important: Record the restrictions password you use. If you forget the password, Workstation Pro does not provide a way to retrieve it.
   Require the user to change the encryption password when this virtual machine is moved or copied	(Optional) Select this check box to require the user to change the encryption password for the virtual machine if the virtual machine is moved or copied.
   Allow USB devices to be connected to this virtual machine	(Optional) Select this check box to allow USB device connections in the virtual machine.
   Expire the virtual machine after	(Optional) Set a date and time for the virtual machine to expire. Click the down arrow to select an expiration date. Click in the time field and enter the expiration time. You can provide an alert message and configure a time server by performing the appropriate steps that follow: Click Advanced. Enter text to be displayed when the virtual machine expires. (Optional) Select the check box to show a message when the virtual machine is about to expire and enter message text. (Optional) Set the number of days before expiration that the message is displayed. (Optional) To provide the URL of a custom time server, enter the URL of the time server in the Time server text box. (Optional) To verify the time server URL, click Check Server. (Optional) To manage the certificates of the time server, click Manage certificates, click Add, navigate to each certificate file and add the file. When you add certificates to the virtual machine, Workstation Pro uses the certificates in the virtual machine, not on the host. (Optional) To change how often the encrypted virtual machine syncs with the time server, set the number and time measurement of the Server contact frequency option. (Optional) To change the Maximum time the VM can be used without sever contact setting, set the number of days. Click OK.

6. Click OK in the Virtual Machine Settings dialog box.

What to do next

For more information about the expiration of a restricted virtual machine, see Restricted Virtual Machine Expiration.