Before pulling the key, confirm that TPM encryption is active. Connect to your ESXi host via . Run the following command: esxcli system settings encryption get Use code with caution.