#Verify that the ESXi host is in TPM mode
esxcli system settings encryption get
#If the Mode appears as NONE, you must enable the TPM in the firmware of the host, and set the mode
esxcli system settings encryption set --mode=TPM
#Enable secure boot in the firmware of the host then run this command
esxcli system settings encryption set --require-secure-boot=T
#To enable key persistence (if reboot esxi host and kms is not available)
esxcli system security keypersistence enable
#To save the setting
/sbin/auto-backup.sh
#Secure ESXi Configuration Recovery Key
esxcli system settings encryption recovery list
#To disable persistence
esxcli system security keypersistence disable --remove-all-stored-keys
