Quick Tip – Migrate Windows 11 VMs with TPM Enabled to New Hyper-V Host

If you ever need to migrate a few Windows 11 VMs, with TPM (vTPM) activated, from one Hyper-V host to another, this is how.

Export Certificates and VMs on the Old Hyper-V Host

In addition to exporting the VMs, you also need to export the two certificates that are created when enabling vTPM on a VM. Here is a PowerShell script to do that.

# Export a few VMs using a Name with a wildcard
$VMName = "DA-Intune-01*" 
$ExportPath = "E:\Export"
$VMs = Get-VM -Name $VMName
foreach ($VM in $Vms) {
    Export-VM -VM $VM -Path $ExportPath
}

# Export Hyper-V Host Certificates as PFX with a password
$Password = ConvertTo-SecureString "YourSecurePassword" -AsPlainText -Force
$Certs = Get-ChildItem "Cert:\LocalMachine\Shielded VM Local Certificates"
foreach ($Cert in $Certs) {
    $SafeName = ($Cert.Subject -replace '[\\/:*?"<>|=,]', '_')
    $PfxPath = Join-Path $ExportPath "$SafeName-$($Cert.Thumbprint).pfx"
    Export-PfxCertificate -Cert $Cert -FilePath $PfxPath -Password $Password
}

Import Certificates and VMs on the Old Hyper-V Host

After copying the exported VMs and certificates, you can import them using this PowerShell script:

# Import previously exported Hyper-V Host Certificates
$Password = ConvertTo-SecureString "YourSecurePassword" -AsPlainText -Force
$ExportedCerts = Get-ChildItem "D:\Export" -Filter "*.pfx"
$CertStore = "Cert:\LocalMachine\Shielded VM Local Certificates"
foreach ($Cert in $ExportedCerts) {
    Import-PfxCertificate -FilePath $Cert.FullName -CertStoreLocation $CertStore -Password $Password
}

# Import previously exported VMs (copied to the D:\VMs folder)
$ImportPath = "D:\VMs"
$VMs = Get-ChildItem $ImportPath -Recurse -Filter *.vmcx 
foreach ($VM in $VMs) {
    Import-VM -Path $VM.FullName
}