Quick Tip – Enable vTPM on Hyper-V VMs

Here is a quick PowerShell script to enable vTPM on one or more VMs in Hyper-V.

# Get a few VMs using a Name with a wildcard
$VMNamePrefix = "DA-Intune-0*" 
$VMs = Get-VM -Name $VMNamePrefix | Sort-Object Name
foreach ($VM in $VMs) {

    $VMName = $VM.Name

    # Check current TPM status
    If ((Get-VMSecurity -VMName $VMName).TPMEnabled -eq $true){
        Write-Host "$VMName has TPM enabled"
        Write-Host ""
    }
    Else {
        Write-Host "$VMName has Not TPM enabled, enabling it now..."
        Write-Host ""

        # Enable TPM
        $owner = Get-HgsGuardian UntrustedGuardian -ErrorAction SilentlyContinue
        If ($owner){
            # All good
        }
        Else {
            # Create new UntrustedGuardian HgsGuardian
            $owner = New-HgsGuardian -Name "UntrustedGuardian" -GenerateCertificates
        }
        $kp = New-HgsKeyProtector -Owner $owner -AllowUntrustedRoot
        Set-VMKeyProtector -VMName $VMName -KeyProtector $kp.RawData
        Enable-VMTPM -VMName $VMName
    }
}