Question 103894 in Azure Question posted in
The official documentation to get you started can be found here.

Azure Disk Encrption – Key vault secret wrap with key encryption key failed

When I try to enabled Azure Disk Encryption on an Azure Windows Server 2022 VM I get the following error:
*Failed to enable Azure Disk Encryption on the VM with the following exception details:Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerFailedToSendEncryptionSettingsException: The fault reason was: ‘ 0xc142506f RUNTIME_E_KEYVAULT_SECRET_WRAP_WITH_KEK_FAILED Key vault secret wrap with key encryption key failed.at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.WireProtocol.WireProtocolMessage.SendEncryptionSettingsToHost()
*
I have enabled Access Policies on the KeyVault. I’m following the instructions here:
https://www.starwindsoftware.com/blog/encrypt-your-azure-vm-with-azure-disk-encryption

The KeyVault is in the same tenant as the VM.
I have JIT enabled on the VM. Not sure if that’s an issue.

Any ideas?

Tags:

2

Answers


  1. 0

    I tried to reproduce the same in my environment I got the same error like below:

    Failed to enable Azure Disk Encryption on the VM with the followingexceptiondetails:Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerFailedToSendEncryptionSettingsException:> The fault reason was: ‘ 0xc142506f RUNTIME_E_KEYVAULT_SECRET_WRAP_WITH_KEK_FAILED Key vault secret wrap with key encryption key failed.at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.WireProtocol.WireProtocolMessage.SendEncryptionSettingsToHost()

    enter image description here

    Note : Windows Server 2022 and Windows 11 do not support an RSA 2048 bit key Check this.

    When I created Azure Windows Server 2019 VM Azure Disk Encryption is deployed successfully like below:

    enter image description here

    When I try to check in server BitLocker drive encryption Bitlocker is enabled in the Azure VM and the disk is encrypting successfully like below:

    enter image description here

    Login or Signup to reply.
  2. 0

    This is a kind of emerging issue as KEK encryption is not currently supported on Windows Server 2022.

    Please try the possible 2 workarounds:

    1. Use BEK for the encryption

    2. Change the length of the RSA key from 2048 to the higher values

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search