Hyper-V saved-state VM migration fails due to missing encryption keys- how to export and import VM state encryption keys?

Hello Harry Taylor,

The failure you are seeing when moving saved‑state VMs is expected behavior because Hyper‑V encrypts the saved state files with host‑specific keys. A destination host cannot decrypt them unless you explicitly export and import the VM state encryption keys. The supported method is to use the Protect-VM and Unprotect-VM cmdlets in PowerShell, which manage the Key Protector objects tied to each VM. On the source host, you run Export-VMKeyProtector -VMName <VMName> -Path <file> to generate the key package. Then copy that package securely to the target host and run Import-VMKeyProtector -VMName <VMName> -Path <file> before attempting to start or restore the VM. This ensures the destination host has the same cryptographic material needed to unlock the saved state.

It is critical that the Certificate and Key Storage provider on the target host is healthy and that the VM configuration files are consistent with the imported protector. Never attempt to manually copy or edit the encrypted state files, as that will corrupt the VM. After importing, validate with Get-VMKeyProtector that the protector is present, and then retry the move operation. This is the Microsoft‑supported way to transfer VM state encryption keys safely between Hyper‑V hosts and restore normal operations.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

HL.