At the end of the VDI life cycle, the clone VM is deleted from the hypervisor. This can happen as a result of administrator action through the vSphere Client or the Horizon GUI.

Before a clone VM is deleted, you need to unregister it from Cryptographic Security Platform Vault. This removes the address of the clone from Cryptographic Security Platform Vault so that the same address can be used again later. Otherwise, you will have "orphan" names in Cryptographic Security Platform Vault which will prevent you from reusing those addresses.

Important: Removing a clone from Cryptographic Security Platform Vault without decrypting the data first means that the data on all encrypted disks will be lost. If you want to decrypt the data first, see Decrypting a Disk Using the CLI.

1. For Linux, log into the VM as root. For Windows, log in as a System Administrator and open a Command Prompt or start Windows PowerShell.

2. Remove the VM using the CLI or the Entrust Python-based REST API. After the clone VM has been removed, none of its encrypted drives can be accessed. If the clone boot partition was encrypted, the clone is powered off after it is removed from Cryptographic Security Platform Vault.

   • If you want to use the CLI, enter the command hcl unregister [-a] [-u username [-p password]] [-y], where:

     • -a tells hcl that the VM is registered with Cryptographic Security Platform Vault but it is currently unauthenticated. This option requires Cryptographic Security Platform Vault Cloud Admin user account credentials. Omit this option if the VM is currently registered and authenticated with Cryptographic Security Platform Vault.
     • -u is a Cryptographic Security Platform Vault user account with Cloud Admin privileges. If you do not specify the account name, hcl prompts you for the information.
     • -p is the password for the Cryptographic Security Platform Vault account. If you do not specify this password you will be prompted for the information.
     • -y tells the command to run non-interactively.

   • If you want to use the API:

     1. Make sure Python is available on the VM.
     2. If needed, install the Entrust APIs on the machine from which you want to do the clean up. You can download the API package from the Cryptographic Security Platform Vault webGUI by clicking Cloud in the top menu bar, selecting Actions > Download Policy Agent, then downloading the file called hcs-api-RelaseNumber-BuildNumber.tgz. For example, hcs-api-10.4.6-12346M.tgz.
     3. Copy the hcs-api-RelaseNumber-BuildNumber.tgz file to the VM and unpack the archive so that you have an hcs-api directory with 5 python files and one executable called hicli.

     4. Create a Python script with the following lines:

        keycontrol=$1
        cvmset=$2
        clonevm=$3
        username=$4
        password=$5
        hicli kc select $keycontrol
        hicli user login $username --password=$password
        hicli cvmset select $cvmset
        yes | hicli cvm rm $clonevm

        Where $username is a Cryptographic Security Platform Vault user account with Cloud Admin privileges and $password is the password for that Cryptographic Security Platform Vault account.