See below for registering the Policy Agent from the Windows command line

Required information

Before registering the Policy Agent from the Windows command line, make sure you know:

• The VM Encryption vault details. This is the vault you configured during the initial setup. 

• The IP addresses of the Cryptographic Security Platform Vault for VM Encryption node with which you want to register the Policy Agent.

• The login credentials for a Cryptographic Security Platform Vault for VM Encryption account with Cloud Admin privileges.
• The name of the Cryptographic Security Platform Vault for VM Encryption Cloud VM Set with which you want to associate the VM. You cannot encrypt the drive until it has been associated with a Cloud VM Set in Cryptographic Security Platform Vault for VM Encryption. For details, see the Administration Guide.

Creating the cloud VM set of certificates

When you register the VM, you can either specify the Cloud VM Set you want to use interactively during registration, or create a certificate for that Cloud VM Set in the Cryptographic Security Platform Vault for VM Encryption web GUI and use that certificate during registration.

To create the cloud VM set of certificates

1. Log in to the Cryptographic Security Platform Vault for VM Encryption using an account with Cloud Admin privileges.
2. In the top menu bar, click Workloads.
3. On the VM Sets tab, select the Cloud VM Set with which you want to associate the VM.
4. Click Actions > Create New Certificate.
5. If desired, enter a passphrase for the certificate. If you enter a passphrase here, you will need to enter that passphrase when you use the certificate on the VM.
6. Enter a date on which this certificate should expire.

7. Click Create. The Cryptographic Security Platform Vault for VM Encryption downloads a .cert file to the default download location.  

   Do not rename the downloaded certificate. The certificate name includes additional information, and a renamed certificate will fail.

8. If necessary, copy the .cert file to the Windows VM.

Running the registration command

Log into the VM using an account with administrator privileges, open a Windows command prompt run the following command.

Where:

• -a — Indicates that you want to authenticate the VM through the command line or the script instead of through a certificate file. Use this option if you are using Simplified or Automated Authentication. If you created a certificate in Cryptographic Security Platform Vault, omit this option and specify the certificate name in cert-file.cert.
• -h—The name of the VM that will be displayed in the Cryptographic Security Platform Vault for VM Encryption (Default: hostname).
• -d—A description of the VM that will be displayed in the Cryptographic Security Platform Vault for VM Encryption.
• -p—The passphrase assigned to the certificate when it was created. If you do not specify this parameter and the certificate has an associated passphrase, the registration process prompts you for the passphrase. Applies to Standard Authentication only.

• -v (optional)—The Vault ID of the Vault that will be displayed in Vault Management. If you do not specify vault_id, you will be asked whether you want to enter vault_id.

• -o—The one-time passphrase that will be used to encrypt the initial communication between this VM and the existing Cryptographic Security Platform Vault for VM Encryption cluster. If you do not specify this parameter, the registration process prompts you for the one-time passphrase. Applies to Standard Authentication only. 

  The passphrase is valid for 15 minutes from the time it is created. Make sure you authenticate the VM in Cryptographic Security Platform Vault during this time. Authentication will fail after the passphrase has expired.

• -z—The name of the Cloud VM Set defined in the Cryptographic Security Platform Vault for the VM Encryption cluster to which you want to assign this VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).
• -n — The name of the Cluster Node Mapping that you want to associate with this VM. If you do not specify this option and one or more Cluster Node Mappings have been configured, the Policy Agent prompts you to select a Node Mapping from the list. If you do not want to use a Node Mapping, you must manually respond to this prompt. This option is mutually exclusive with the -N option, described below, and it requires that the -a option must be specified on the hcl register command.
• -N—Tells the Policy Agent that you do not want to use a Cluster Node Mapping, even if one is available. If you specify both -N and -n, the Policy Agent ignores the -n option and does not assign a Node Mapping to the VM. Applies to Simplified or Automated Authentication only (the -a option must be specified on the hcl register command).

• kc-hostname[:port],kc-hostname2[:port],... (required)—The list of IP addresses or hostnames for the Cryptographic Security Platform Vault nodes with which you want to register the VM. You must specify at least one Cryptographic Security Platform Vault node in this list. You must also specify a port if the Cryptographic Security Platform Vault nodes use anything other than the default port (443). 

  If you are using the -n option to specify a Cluster Node Mapping, this IP address will be the Cryptographic Security Platform Vault for VM Encryption node that the VM contacts to retrieve the Node Mapping information. After the Node Mapping has been retrieved, the Policy Agent ignores any other IP addresses in this list and only registers the VM with the Cryptographic Security Platform Vault for VM Encryption nodes contained in the Node Mapping.

• cert-file.cert—The name of the certificate file you copied to the target system if you are using Standard Authentication. If you are running the hcl register command from a directory other than the one where the .cert file resides, specify the full path to the .cert file as part of this option. If you did not create a certificate file in Cryptographic Security Platform Vault for VM Encryption, omit this option and use the -a option instead.

The following command registers a VM with the "hq-vm-3" and the "HQ Windows 2022 Server" description, using standard authentication and a node at 10.238.32.74.

The following command line registers the VM without prompting the user.

The following command registers a VM named "hq-vm-3" with the "HQ Windows 2022 Server" description and prompts the user for the account information, the cloud VM set, and the cluster node mapping.