diff --git a/Modules/VMware.VMEncryption/README.md b/Modules/VMware.VMEncryption/README.md
new file mode 100644
index 0000000..9e38900
--- /dev/null
+++ b/Modules/VMware.VMEncryption/README.md
@@ -0,0 +1,7 @@
+Prerequisites/Steps to use this module:
+
+1. This module only works for vSphere products that support VM Encryption. E.g. vSphere 6.5 and later.
+2. All the functions in this module only work for KMIP Servers.
+3. Install the latest version of Powershell and PowerCLI(6.5).
+4. Import this module by running: Import-Module -Name "location of this module"
+5. Get-Command -Module "This module Name" to list all available functions.
\ No newline at end of file
diff --git a/Modules/VMware.VMEncryption/VMware.VMEncryption.psd1 b/Modules/VMware.VMEncryption/VMware.VMEncryption.psd1
new file mode 100644
index 0000000..d310632
Binary files /dev/null and b/Modules/VMware.VMEncryption/VMware.VMEncryption.psd1 differ
diff --git a/Modules/VMware.VMEncryption/VMware.VMEncryption.psm1 b/Modules/VMware.VMEncryption/VMware.VMEncryption.psm1
new file mode 100644
index 0000000..149fd49
--- /dev/null
+++ b/Modules/VMware.VMEncryption/VMware.VMEncryption.psm1
@@ -0,0 +1,2045 @@
+# Script Module : VMware.VMEncryption
+# Version       : 1.0
+
+# Copyright © 2016 VMware, Inc. All Rights Reserved.
+
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+
+New-VIProperty -Name AESNIStatus -ObjectType VMHost -Value {
+    Param ($VMHost)
+    $FeatureCap = $VMHost.ExtensionData.Config.FeatureCapability
+    foreach ($Feature in $FeatureCap) {
+       if ($Feature.FeatureName -eq "cpuid.AES") {
+          ($Feature.Value -eq "1")
+       }
+    }
+} -BasedOnExtensionProperty 'Config.FeatureCapability' -Force | Out-Null
+
+New-VIProperty -Name CryptoSafeSupported -ObjectType VMHost -Value {
+    Param ($VMHost)
+       $VMHost.ExtensionData.Runtime.CryptoState -ne $null
+} -BasedOnExtensionProperty 'Runtime.CryptoState' -Force
+
+New-VIProperty -Name CryptoSafe -ObjectType VMHost -Value {
+    Param ($VMHost)
+        $VMHost.ExtensionData.Runtime.CryptoState -eq "safe"
+} -BasedOnExtensionProperty 'Runtime.CryptoState' -Force
+
+New-VIProperty -Name Encrypted -ObjectType VirtualMachine -Value {
+    Param ($VM)
+       $VM.ExtensionData.Config.KeyId -ne $null
+} -BasedOnExtensionProperty 'Config.KeyId' -Force | Out-Null
+
+New-VIProperty -Name EncryptionKeyId -ObjectType VirtualMachine -Value {
+    Param ($VM)
+    if ($VM.Encrypted) {
+      $VM.ExtensionData.Config.KeyId
+    }
+} -BasedOnExtensionProperty 'Config.KeyId' -Force | Out-Null
+
+New-VIProperty -Name Locked -ObjectType VirtualMachine -Value  {
+    Param ($VM)
+    ($vm.extensiondata.Runtime.ConnectionState -eq "invalid") -and ($vm.extensiondata.Config.KeyId)
+} -BasedOnExtensionProperty 'Runtime.ConnectionState','Config.KeyId' -Force | Out-Null
+
+New-VIProperty -Name Encrypted -ObjectType HardDisk -Value {
+ Param ($hardDisk)
+     $hardDisk.ExtensionData.Backing.KeyId -ne $null
+} -BasedOnExtensionProperty 'Backing.KeyId' -Force | Out-Null
+
+New-VIProperty -Name EncryptionKeyId -ObjectType HardDisk -Value {
+    Param ($Disk)
+    if ($Disk.Encrypted) {
+      $Disk.ExtensionData.Backing.KeyId
+    }
+} -BasedOnExtensionProperty 'Backing.KeyId' -Force | Out-Null
+
+Function Enable-VMHostCryptoSafe {
+    <#
+    .SYNOPSIS
+       This cmdlet enables the VMHost's CryptoSate to safe.
+
+    .DESCRIPTION
+       This cmdlet enables the VMHost's CryptoSate to safe.
+
+    .PARAMETER VMHost
+       Specifies the VMHost you want to enable.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID which you want to use to generate the encrytion key.
+
+    .EXAMPLE
+       C:\PS>$VMHost = Get-VMHost -name $VMHostName
+       C:\PS>Enable-VMHostCryptoSafe -VMHost $VMHost
+
+       Enables the specified VMHost's CryptoSate to safe.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VMHost] $VMHost,
+
+        [Parameter(Mandatory=$False)]
+        [String] $KMSClusterId
+    )
+
+    Process {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       if (!$VMHost.CryptoSafeSupported) {
+          Write-Error "The VMHost: $VMHost does not support CryptoSafe!`n"
+          return
+       }
+
+       if ($VMHost.CryptoSafe) {
+          Write-Error "The VMHost: $VMHost CryptoSafe already enabled!`n"
+          return
+       }
+
+       # Generate key from the specified KMS cluster
+       try {
+          $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+       } catch {
+          Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+       }
+
+       $VMHostView = Get-View $VMHost
+       $VMHostView.ConfigureCryptoKey($KeyResult.KeyId)
+    }
+}
+
+Function Set-VMHostCryptoKey {
+    <#
+    .SYNOPSIS
+       This cmdlet changes the VMHost CryptoKey.
+
+    .DESCRIPTION
+       This cmdlet changes the VMHost CryptoKey if VMHost is already in Crypto safe state.
+
+    .PARAMETER VMHost
+       Specifies the VMHost whose CryptoKey you want to update.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID which you want to use to generate the encryption key.
+
+    .EXAMPLE
+       C:\PS>$VMHost = Get-VMHost -Name $VMHostName
+       C:\PS>Set-VMHostCryptoKey -VMHost $VMHost
+
+       Changes the VMHost CryptoKey to a new CryptoKey.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VMHost] $VMHost,
+
+        [Parameter(Mandatory=$False)]
+        [String] $KMSClusterId
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+       if (!$VMHost.CryptoSafeSupported) {
+          Write-Error "The VMHost: $VMHost does not support CryptoSafe!`n"
+          return
+       }
+
+       if (!$VMHost.CryptoSafe) {
+          Write-Error "The VMHost: $VMHost has not enabled the CrytoSate to safe!"
+          return
+       }
+
+       $VMHostView = Get-View $VMHost
+       $OldKey = $VMHostView.Runtime.CryptoKeyId
+
+       # Generate key from the specified KMSCluster
+       try {
+          $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+       } catch {
+          Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+       }
+
+       try {
+          $VMHostView.ConfigureCryptoKey($KeyResult.KeyId)
+          Write-Verbose "Change Crypto Key on VMHost: $VMHost succeeded!`n"
+       } catch {
+          Write-Error "Change Crypto Key on VMHost: $VMHost failed.$_!`n"
+          return
+       }
+
+       # Remove the old host key
+       Write-Verbose "Removing the old hostKey: $($OldKey.KeyId) on $VMHost...`n"
+       $VMHostCM = Get-View $VMHostView.ConfigManager.CryptoManager
+       $VMHostCM.RemoveKeys($OldKey, $true)
+    }
+}
+
+Function Enable-VMEncryption {
+    <#
+    .SYNOPSIS
+       This cmdlet encrypts the specified VM.
+
+    .DESCRIPTION
+       This cmdlet encrypts the specified VM.
+
+    .PARAMETER SkipHardDisks
+       If specified, skips the encryption of the hard disks of the specified VM.
+
+    .PARAMETER VM
+       Specifies the VM you want to encrypt.
+
+    .PARAMETER Policy
+       Specifies the encryption policy you want to use.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS clusterId you want to use to generate new key for encryption.
+
+    .EXAMPLE
+       C:\PS>Get-VM -Name win2012|Enable-VMEncryption
+
+       Encrypts the whole VM with default encryption policy.
+
+    .EXAMPLE
+       C:\PS>$SP = Get-SpbmStoragePolicy -name "EncryptionPol"
+       C:\PS>Get-VM -Name win2012 |Enable-VMEncryption -Policy $SP -SkipHardDisks
+
+       Encrypts the VM Home with the encryption policy 'EncryptionPol' and skips hard disks encryption.
+
+    .NOTES
+       This cmdlet assumes there already is KMS defined in vCenter Server.
+       If VM Home is already encrypted, the cmdlet quits.
+       If VM Home is not encrypted, encrypt VM Home if SkipHardDisks specified. Otherwise encrypt the VM Home and VM-attached disks.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$False,ValueFromPipeline=$False,ValueFromPipelinebyPropertyName=$False)]
+        [VMware.VimAutomation.Storage.Types.V1.Spbm.SpbmStoragePolicy] $Policy,
+
+        [Parameter(Mandatory=$False,ValueFromPipeline=$False,ValueFromPipelinebyPropertyName=$False)]
+        [String] $KMSClusterId,
+
+        [Parameter(Mandatory=$False)]
+        [switch]$SkipHardDisks=$False
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+        # VM Home is already encrypted
+        if ($VM.Encrypted) {
+           $ErrMsg = "VM $VM is already encrypted, please use: "+
+                     "Enable-VMDiskEncryption if you want to "+
+                     "encrypt disks which not encrypted yet!`n"
+           Write-Error $ErrMsg
+           return
+        }
+
+        Write-Verbose "Checking if the VMHost supports CryptoSafe...`n"
+        $VMhost = $VM|Get-VMHost
+        if (!$VMHost.CryptoSafeSupported) {
+           Write-Error "The VMHost: $VMHost does not support CryptoSafe.`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM has no snapshots...`n"
+        if ($VM|Get-Snapshot) {
+           Write-Error "$VM has snapshots, please remove all snapshots and try again!`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM powered off...`n"
+        if ($VM.PowerState -ne "PoweredOff") {
+           $ErrMsg = "The VM can only be encrypted when powered off, "+
+                     "but the current power state of $VM is $($VM.PowerState)!`n"
+           Write-Error $ErrMsg
+           return
+        }
+
+        $PolicyToBeUsed = $null
+        $BuiltInEncPolicy = Get-SpbmStoragePolicy -Name "VM Encryption Policy"
+
+        if ($Policy) {
+           # Known issue: If the provided policy is created/cloned from
+           # the default "VM Encryption Policy",
+           # Or When creating the policy you didn't select 'Custom',
+           # there will be null-valued Exception.
+           Write-Verbose "Checking if the provided policy: $Policy is an encryption policy`n"
+           if (($Policy.Name -ne "VM Encryption Policy") -and !$Policy.CommonRule.Capability.Category.Contains("ENCRYPTION")) {
+              Write-Error "The policy $Policy is not an encryption policy, exit!"
+              return
+           }
+           $PolicyToBeUsed = $Policy
+        } else {
+           Write-Verbose "No storage policy specified, try to use the built-in policy.`n"
+           if ($BuiltInEncPolicy) {
+              $PolicyToBeUsed = $BuiltInEncPolicy
+           } else {
+              Throw "The built-in policy does not exist, please use: New-SpbmStoragePolicy to create one first!`n"
+           }
+        }
+
+        # Encrypt the VM disks if SkipHardDisk not specified
+        if (!$SkipHardDisks) {
+           $Disks = $VM|Get-HardDisk
+        }
+
+        $VMView = Get-View $VM
+        $ProfileSpec = New-Object VMware.Vim.VirtualMachineDefinedProfileSpec
+        $ProfileSpec.ProfileId = $PolicyToBeUsed.Id
+        $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+        $VMCfgSpec.VmProfile = $ProfileSpec
+
+        if ($KMSClusterId) {
+           # Generate a new key from KMS
+           try {
+              $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+           } catch {
+              Throw "Key generation failed, make sure the specified KMS Cluster exists!`n"
+           }
+
+           $CryptoKeyId = $KeyResult.KeyId
+           $CryptoSpec = New-Object VMware.Vim.CryptoSpecEncrypt
+           $CryptoSpec.CryptoKeyId = $CryptoKeyId
+           $VMCfgSpec.Crypto = $CryptoSpec
+        }
+
+        $DeviceChanges = @()
+        foreach ($Disk in $Disks) {
+           Write-Verbose "Attaching policy: $PolicyToBeUsed to $Disk`n"
+           $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+           $BackingSpec = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+           $DeviceChange.operation = "edit"
+           $DeviceChange.device = $Disk.extensiondata
+           $DeviceChange.Profile = $ProfileSpec
+           $BackingSpec.Crypto = $CryptoSpec
+           $DeviceChange.Backing = $BackingSpec
+           $DeviceChanges += $deviceChange
+        }
+
+        if ($Devicechanges) {
+           $VMCfgSpec.deviceChange = $Devicechanges
+        }
+
+        return $VMView.ReconfigVM_Task($VMCfgSpec)
+     }
+}
+
+Function Enable-VMDiskEncryption {
+    <#
+    .SYNOPSIS
+       This cmdlet encrypts the specified hard disks.
+
+    .DESCRIPTION
+       This cmdlet encrypts the specified hard disks.
+
+    .PARAMETER VM
+       Specifies the VM whose hard disks you want to encrypt.
+
+    .PARAMETER Policy
+       Specifies the encryption policy you want to use.
+
+    .PARAMETER HardDisk
+       Specifies the hard disks you want to encrypt.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS clusterId you want to use to generate new key for encryption.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$VMDisks= $VM|Get-Harddisk|Select -last 2
+       C:\PS>Enable-VMDiskEncryption -VM $VM -$HardDisk $VMDisks
+
+       Encrypts the VM disks with the default encryption policy and use the VM encryption key.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.VirtualDevice.HardDisk[]] $HardDisk,
+
+        [Parameter(Mandatory=$False)]
+        [VMware.VimAutomation.Storage.Types.V1.Spbm.SpbmStoragePolicy] $Policy,
+
+        [Parameter(Mandatory=$False)]
+        [String] $KMSClusterId
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+       Write-Verbose "Checking if $VM is encrypted..."
+       if (!$VM.Encrypted) {
+          Write-Error "$VM is not encrypted, please use:Enable-VMEncryption to encrypt the VM.`n"
+          return
+       }
+
+       # Validate the hard disks
+       Write-Verbose "Checking the hard disks...`n"
+       ConfirmHardDiskIsValid -VM $VM -HardDisk $HardDisk
+
+       Write-Verbose "Checking if $VM has no snapshots..."
+       if ($VM|Get-Snapshot) {
+          Write-Error "$VM has snapshots, please remove all snapshots!`n"
+          return
+       }
+
+       Write-Verbose "Checking if $VM is powered off..."
+       if ($VM.powerstate -ne "PoweredOff") {
+          $ErrMsg = "The VM can only be ecrypted when powered off, "+
+                    "but the current power state of $VM is $($VM.PowerState)!`n"
+          Write-Error $ErrMsg
+          return
+       }
+
+       $PolicyToBeUsed = $null
+
+       if ($Policy) {
+          # Known issue: If the provided policy is created/cloned from
+          # the default "VM Encryption Policy",
+          # Or When creating the policy you didn't select 'Custom',
+          # there will be null-valued Exception.
+          Write-Verbose "Checking if the provided policy: $Policy is an encryption policy`n"
+          if (($Policy.Name -ne "VM Encryption Policy") -and !$Policy.CommonRule.Capability.Category.Contains("ENCRYPTION")) {
+             Throw "The policy $Policy is not an encryption policy, exit!"
+          }
+          $PolicyToBeUsed = $Policy
+       } else {
+          Write-Verbose "No storage policy specified, try to use the VM Home policy.`n"
+          $PolicyToBeUsed = (Get-SpbmEntityConfiguration -VM $VM).StoragePolicy
+          if (!$PolicyToBeUsed) {
+             Write-Warning "The VM Home policy is not available, try to use the built-in policy.`n"
+             $BuiltInEncPolicy = Get-SpbmStoragePolicy -Name "VM Encryption Policy"
+             if ($BuiltInEncPolicy) {
+                $PolicyToBeUsed = $BuiltInEncPolicy
+             } else {
+                Throw "The built-in policy does not exist, please use: New-SpbmStoragePolicy to create one first!`n"
+             }
+          }
+       }
+
+       # Specify the key used to encrypt disk
+       if ($KMSClusterId) {
+          # Generate a new key from KMS
+          try {
+             $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+          } catch {
+             Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+          }
+
+          $CryptoKeyId = $KeyResult.KeyId
+          $CryptoSpec = New-Object VMware.Vim.CryptoSpecEncrypt
+          $CryptoSpec.CryptoKeyId = $CryptoKeyId
+       }
+
+       Write-Verbose "Encrypting the hard disks: $HardDisk...`n"
+
+       $VMView = Get-View $VM
+       $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+       $ProfileSpec = New-Object VMware.Vim.VirtualMachineDefinedProfileSpec
+       $ProfileSpec.ProfileId = $PolicyToBeUsed.Id
+
+       $DeviceChanges = @()
+
+       foreach ($Disk in $HardDisk) {
+          Write-Verbose "Attaching policy: $PolicyToBeUsed to $Disk`n"
+          $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+          $BackingSpec = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+          $DeviceChange.operation = "edit"
+          $DeviceChange.device = $Disk.extensiondata
+          $DeviceChange.Profile = $ProfileSpec
+          $BackingSpec.Crypto = $CryptoSpec
+          $DeviceChange.Backing = $BackingSpec
+          $DeviceChanges += $DeviceChange
+       }
+
+       if ($DeviceChanges) {
+          $VMCfgSpec.deviceChange = $DeviceChanges
+       }
+
+       return $VMView.ReconfigVM_Task($VMCfgSpec)
+    }
+}
+
+Function Disable-VMEncryption {
+    <#
+    .SYNOPSIS
+       This cmdlet decrypts the specified VM.
+
+    .DESCRIPTION
+       This cmdlet decrypts the specified VM.
+
+    .PARAMETER VM
+       Specifies the VM you want to decrypt.
+
+    .EXAMPLE
+       C:\PS>Get-VM -Name win2012 | Disable-VMEncryption
+
+       Decrypts the VM Home and all encrypted disks.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>Disable-VMEncryption -VM $VM
+
+       Decrypts the whole VM, including the encrypted disks.
+
+    .NOTES
+       If the VM is not encrypted, the cmdlet quits.
+
+    .NOTES
+       Author                                    : Carrie Yang.
+       Author email                              : yangm@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+        Write-Verbose "Checking if $VM is encrypted..."
+        if (!$VM.Encrypted) {
+           Write-Error "$VM is not encrypted.`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM has no snapshots..."
+        if ($VM|Get-Snapshot) {
+           Write-Error "$VM has snapshots, it can not be decrypted!`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM is powered off..."
+        if ($VM.powerstate -ne "PoweredOff") {
+           $ErrMsg = "The VM can only be decrypted when powered off, "+
+                     "but the current power state of $VM is $($VM.PowerState)!`n"
+           Write-Error $ErrMsg
+           return
+        }
+
+        $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+        $Profile = New-Object VMware.Vim.VirtualMachineEmptyProfileSpec
+        $DecryptCrypto = New-Object VMware.Vim.CryptoSpecDecrypt
+        $DisksToDecrypt = $VM|Get-HardDisk|Where {$_.Encrypted}
+
+        $VMCfgSpec.VmProfile = $Profile
+        $VMCfgSpec.Crypto = $DecryptCrypto
+
+        $DeviceChanges = @()
+        foreach ($Disk in $DisksToDecrypt) {
+           $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+           $DeviceChange.operation = "edit"
+           $DeviceChange.device = $Disk.extensiondata
+           $DeviceChange.Profile = $Profile
+           $DeviceChange.Backing = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+           $DeviceChange.Backing.Crypto = $DecryptCrypto
+           $DeviceChanges += $DeviceChange
+        }
+
+        if ($Devicechanges) {
+           $VMCfgSpec.deviceChange = $Devicechanges
+        }
+
+        return (Get-View $VM).ReconfigVM_Task($VMCfgSpec)
+    }
+}
+
+Function Disable-VMDiskEncryption {
+    <#
+    .SYNOPSIS
+       This cmdlet decrypts the specified hard disks in a given VM.
+
+    .DESCRIPTION
+       This cmdlet decrypts the specified hard disks in a given VM.
+
+    .PARAMETER VM
+       Specifies the VM which the hard disks belong to.
+
+    .PARAMETER HardDisk
+       Specifies the hard disks you want to decrypt.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$HardDisk = $VM|Get-HardDisk|select -last 1
+       C:\PS>Disable-VMDiskEncryption -VM $VM -HardDisk $HardDisk
+
+       Decrypts the last hard disk in the VM.
+
+    .NOTES
+       If the VM is not encrypted, the cmdlet quits.
+
+    .NOTES
+       Author                                    : Carrie Yang.
+       Author email                              : yangm@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.VirtualDevice.HardDisk[]] $HardDisk
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+        Write-Verbose "Checking if $VM is encrypted..."
+        if (!$VM.Encrypted) {
+           Write-Error "$VM is not encrypted.`n"
+           return
+        }
+
+        # Validate the hard disks
+        Write-Verbose "Checking the hard disks...`n"
+        ConfirmHardDiskIsValid -VM $VM -HardDisk $HardDisk
+
+        $DisksToDecrypt = $HardDisk |Where {$_.Encrypted}
+
+        if ($DisksToDecrypt.Length -eq 0) {
+           Write-Error "The provided disks are not encrypted.`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM has no snapshots..."
+        if ($VM|Get-Snapshot) {
+           Write-Error "$VM has snapshots, it can not be decrypted!`n"
+           return
+        }
+
+        Write-Verbose "Checking if $VM is powered off..."
+        if ($VM.powerstate -ne "PoweredOff") {
+           $ErrMsg = "The VM can only be decrypted when powered off, "+
+                     "but the current power state of $VM is $($VM.PowerState)!`n"
+           Write-Error $ErrMsg
+           return
+        }
+
+        $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+        $Profile = New-Object VMware.Vim.VirtualMachineEmptyProfileSpec
+        $DecryptCrypto = New-Object VMware.Vim.CryptoSpecDecrypt
+
+
+        $DeviceChanges = @()
+        foreach ($Disk in $DisksToDecrypt) {
+           $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+           $DeviceChange.operation = "edit"
+           $DeviceChange.device = $Disk.extensiondata
+           $DeviceChange.Profile = $Profile
+           $DeviceChange.Backing = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+           $DeviceChange.Backing.Crypto = $DecryptCrypto
+           $DeviceChanges += $DeviceChange
+        }
+
+        $VMCfgSpec.deviceChange = $DeviceChanges
+
+        return (Get-View $VM).ReconfigVM_Task($VMCfgSpec)
+    }
+}
+
+Function Set-VMEncryptionKey {
+    <#
+    .SYNOPSIS
+       This cmdlet sets the encryption key of VM or hard disks.
+
+    .DESCRIPTION
+       This cmdlet sets the encryption key of VM or hard disks.
+
+    .PARAMETER VM
+       Specifies the VM you want to rekey.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS clusterId you want to use for getting a new key for rekey operation.
+
+    .PARAMETER Deep
+       When it's specified, both the key encryption key (KEK) and
+       the internal data encryption key (DEK) will be updated.
+       This is implemented through a full copy; It's a slow operation that
+       must be performed while the virtual machine is powered off.
+       A shallow key change will only update the KEK and the operation can be performed
+       while the virtual machine is running.
+
+    .PARAMETER SkipHardDisks
+       Skip updating the hard disk keys.
+
+    .EXAMPLE
+       C:\PS>Get-VM -Name win2012 | Set-VMEncryptionKey
+
+       Rekeys the VM win2012 VM Home and all its disks.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$VM|Set-VMEncryptionKey -SkipHardDisks
+
+       Rekeys the VM Home only.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$VM|Set-VMEncryptionKey -Deep
+
+       Rekeys the VM Home and all its disks with Deep option.
+
+    .EXAMPLE
+       C:\PS>$KMSCluster = Get-KMSCluster | select -last 1
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$VM|Set-VMEncryptionKey -KMSClusterId $KMSCluster.Id -Deep
+
+       Deep rekeys the VM Home and all its disks using a new key.
+       The key is generted from the KMS whose clusterId is $KMSCluster.Id.
+
+    .NOTES
+       This cmdlet assumes there is already a KMS in vCenter Server. If VM is not encrypted, the cmdlet quits.
+       You should use Enable-VMEncryption cmdlet to encrypt the VM first.
+
+    .NOTES
+       Author                                    : Carrie Yang.
+       Author email                              : yangm@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$False)]
+        [String] $KMSClusterId,
+
+        [Parameter(Mandatory=$False)]
+        [switch]$Deep = $FALSE,
+
+        [Parameter(Mandatory=$False)]
+        [switch]$SkipHardDisks = $False
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+        Write-Verbose "Checking if $VM is encrypted...`n"
+        if (!$VM.Encrypted) {
+           Write-Error "$VM is not encrypted."
+           return
+        }
+
+        Write-Verbose "Checking if $VM has no snapshots...`n"
+        if ($VM|Get-Snapshot) {
+           Write-Error "$VM has snapshot, please remove all snapshots and try again!`n"
+           return
+        }
+
+        if ($Deep) {
+           Write-Verbose "Checking if $VM powered off...`n"
+           if ($VM.powerstate -ne "PoweredOff") {
+              $ErrMsg = "The VM can only be recrypted when powered off, "+
+                        "but the current power state of $VM is $($VM.PowerState)!`n"
+              Write-Error $ErrMsg
+              return
+           }
+        }
+
+        $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+        $ProfileSpec = New-Object VMware.Vim.VirtualMachineDefinedProfileSpec
+        $CryptoSpec = New-Object VMware.Vim.CryptoSpecShallowRecrypt
+
+        if ($Deep) {
+           $CryptoSpec = New-Object VMware.Vim.CryptoSpecDeepRecrypt
+           $VMPolicy = (Get-SpbmEntityConfiguration -VM $VM).StoragePolicy
+           $ProfileSpec.ProfileId = $VMPolicy.Id
+           $VMCfgSpec.VmProfile = $ProfileSpec
+        }
+
+        # Generate a key from KMS
+        try {
+           $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+        } catch {
+           Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+        }
+        $CryptoSpec.NewKeyId = $KeyResult.KeyId
+        $VMCfgSpec.Crypto = $CryptoSpec
+
+        if (!$SkipHardDisks) {
+           $DisksToRecrypt = $VM|Get-HardDisk|Where {$_.Encrypted}
+
+           $DeviceChanges = @()
+           foreach ($disk in $DisksToRecrypt) {
+              $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+              $DeviceChange.operation = "edit"
+              $DeviceChange.device = $Disk.extensiondata
+              if ($Deep) {
+                 $DiskProfileSpec = New-Object VMware.Vim.VirtualMachineDefinedProfileSpec
+                 $DiskProfileSpec.ProfileId = ($Disk|Get-SpbmEntityConfiguration).StoragePolicy.Id
+                 $DeviceChange.Profile = $DiskProfileSpec
+              }
+              $DeviceChange.Backing = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+              $DeviceChange.Backing.Crypto = $CryptoSpec
+              $DeviceChanges += $DeviceChange
+           }
+
+           if ($DeviceChanges.Length -gt 0) {
+              $VMCfgSpec.deviceChange = $DeviceChanges
+           }
+        }
+
+        return (Get-View $VM).ReconfigVM_Task($VMCfgSpec)
+    }
+}
+
+Function Set-VMDiskEncryptionKey {
+    <#
+    .SYNOPSIS
+       This cmdlet sets the encryption key of the hard disks in the VM.
+
+    .DESCRIPTION
+       This cmdlet sets the encryption key of the hard disks in the VM.
+
+    .PARAMETER VM
+       Specifies the VM from which you want to rekey its disks.
+
+    .PARAMETER HardDisk
+       Specifies the hard disks you want to rekey.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS clusterId you want to use for getting a new key for rekey operation.
+
+    .PARAMETER Deep
+       When it's specified, both the key encryption key (KEK) and
+       the internal data encryption key (DEK) will be updated.
+       This is implemented through a full copy; It's a slow operation that
+       must be performed while the virtual machine is powered off.
+       A shallow key change will only update the KEK and the operation can be performed
+       while the virtual machine is running.
+
+    .EXAMPLE
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$HardDisk = $VM|Get-HardDisk|select -last 2
+       C:\PS>Set-VMDiskEncryptionKey -VM $VM -HardDisk $HardDisk
+
+       Rekeys the last 2 hard disks in the VM.
+
+    .EXAMPLE
+       C:\PS>$VM=Get-VM -Name win2012
+       C:\PS>$HardDisk = get-vm $vm|Get-HardDisk|Select -last 2
+       C:\PS>Set-VMDiskEncryptionKey -VM $VM -HardDisk $HardDisk -Deep
+
+       Deep rekeys the last 2 hard disks in the VM.
+
+    .EXAMPLE
+       C:\PS>$KMSCluster = Get-KMSCluster | select -last 1
+       C:\PS>$VM = Get-VM -Name win2012
+       C:\PS>$HardDisk = get-vm $vm|Get-HardDisk
+       C:\PS>$HardDisk|$Set-VMEncryptionKey -VM $VM -KMSClusterId $KMSCluster.Id -Deep
+
+       Deep rekeys all the disks of the $VM  using a new key.
+       The key is generted from the KMS whose clusterId is $KMSCluster.Id.
+
+    .NOTES
+       This cmdlet assumes there is already a KMS in vCenter Server.
+       If VM is not encrypted, the cmdlet quits.
+       You should use Enable-VMEncryption cmdlet to encrypt the VM first.
+
+    .NOTES
+       Author                                    : Carrie Yang.
+       Author email                              : yangm@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.VirtualDevice.HardDisk[]] $HardDisk,
+
+        [Parameter(Mandatory=$False)]
+        [String] $KMSClusterId,
+
+        [Parameter(Mandatory=$False)]
+        [switch]$Deep = $FALSE
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+    }
+
+    Process {
+        Write-Verbose "Checking if $VM is encrypted...`n"
+        if (!$VM.Encrypted) {
+           Write-Error "$VM is not encrypted."
+           return
+        }
+
+        # Valid the hard disks
+        Write-Verbose "Checking the hard disks...`n"
+        ConfirmHardDiskIsValid -VM $VM -HardDisk $HardDisk
+
+        Write-Verbose "Checking if $VM has no snapshots...`n"
+        if ($VM|Get-Snapshot) {
+           Write-Error "$VM has snapshot, please remove all snapshots and try again!`n"
+           return
+        }
+
+        if ($Deep) {
+           Write-Verbose "Checking if $VM powered off...`n"
+           if ($VM.powerstate -ne "PoweredOff") {
+              $ErrMsg = "Deep rekey could be done only when VM powered off,"+
+                        "but current VM power state is: $($VM.powerstate)!`n"
+              Write-Error $ErrMsg
+              return
+           }
+        }
+
+        $VMCfgSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
+        $CryptoSpec = New-Object VMware.Vim.CryptoSpecShallowRecrypt
+        if ($Deep) {
+           $CryptoSpec = New-Object VMware.Vim.CryptoSpecDeepRecrypt
+        }
+
+        # Generate a key from KMS
+        try {
+           $KeyResult = NewEncryptionKey -KMSClusterId $KMSClusterId
+        } catch {
+           Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+        }
+        $CryptoSpec.NewKeyId = $KeyResult.KeyId
+
+        $DeviceChanges = @()
+        foreach ($disk in $HardDisk) {
+           $DeviceChange = New-Object VMware.Vim.VirtualDeviceConfigSpec
+           $DeviceChange.operation = "edit"
+           $DeviceChange.device = $Disk.extensiondata
+           if ($Deep) {
+              $ProfileSpec = New-Object VMware.Vim.VirtualMachineDefinedProfileSpec
+              $ProfileSpec.ProfileId = ($Disk|Get-SpbmEntityConfiguration).StoragePolicy.Id
+              $DeviceChange.Profile = $ProfileSpec
+           }
+           $DeviceChange.Backing = New-Object VMware.Vim.VirtualDeviceConfigSpecBackingSpec
+           $DeviceChange.Backing.Crypto = $CryptoSpec
+           $DeviceChanges += $DeviceChange
+        }
+
+        $VMCfgSpec.deviceChange = $DeviceChanges
+
+        return (Get-View $VM).ReconfigVM_Task($VMCfgSpec)
+    }
+}
+
+Function Get-VMEncryptionInfo {
+    <#
+    .SYNOPSIS
+       This cmdlet gets the encryption information of VM and its disks.
+
+    .DESCRIPTION
+       This cmdlet gets the encryption information of VM and its disks.
+
+    .PARAMETER VM
+       Specifies the VM for which you want to retrieve the encryption information.
+
+    .PARAMETER HardDisk
+       Specifies the hard disks for which you want to retrieve the encryption information.
+
+    .EXAMPLE
+       C:\PS>Get-VM|Get-VMEncryptionInfo
+
+       Retrieves all VM's encryption information.
+
+    .EXAMPLE
+       C:\PS>Get-VMEncryptionInfo -VM $vm -HardDisk $HardDisks
+
+       Retrieves only disks' encryption information.
+
+    .NOTES
+       If $HardDisk is specified, then only the encryption information of the disks specified in $HardDisk is obtained.
+       Otherwise, all disks' encryption information of the specified VM is returned.
+    
+    .NOTES
+       Author                                    : Carrie Yang.
+       Author email                              : yangm@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$False,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.VirtualDevice.HardDisk[]] $HardDisk
+    )
+
+    Process {
+       $DisksInfo = @()
+
+       if ($HardDisk) {
+          # Validate the hard disks
+          Write-Verbose "Checking the hard disks...`n"
+          ConfirmHardDiskIsValid -VM $VM -HardDisk $HardDisk
+       }
+
+       foreach ($DK in $HardDisk) {
+          $DKInfo = @{}
+          $DKInfo.index = $DK.ExtensionData.Key
+          $DKInfo.label = $DK.ExtensionData.DeviceInfo.Label
+          $diskSize = $DK.ExtensionData.CapacityInKB
+          $formattedSize = "{0:N0}" -f $diskSize
+          $DKInfo.summary = "$formattedSize KB"
+          $DKInfo.profile = ($DK|Get-SpbmEntityConfiguration).StoragePolicy
+          $DKInfo.fileName = $DK.Filename
+          $DKInfo.uuid = $DK.ExtensionData.Backing.Uuid
+          $DKInfo.keyId = $DK.ExtensionData.Backing.KeyId
+          $DKInfo.iofilter = $DK.ExtensionData.Iofilter
+          $DisksInfo += $DKInfo
+       }
+
+       $VMInfo = @{}
+       $VMInfo.name = $VM.Name
+       $VMInfo.connectState = $VM.ExtensionData.Runtime.ConnectionState
+       $VMInfo.profile = ($VM | Get-SpbmEntityConfiguration).StoragePolicy
+       $VMInfo.keyId = $VM.ExtensionData.Config.KeyId
+       $VMInfo.disks = $DisksInfo
+
+       return $VMInfo
+    }
+}
+
+Function Get-EntityByCryptoKey {
+    <#
+    .SYNOPSIS
+       This cmdlet gets all the related objects in which it has the key associated.
+
+    .DESCRIPTION
+       This cmdlet gets all the related objects in which it has the key associated.
+
+    .PARAMETER KeyId
+       Specifies the KeyId string.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMSClusterId string.
+
+    .PARAMETER SearchVMHosts
+       Specifies whether to search the VMHosts.
+
+    .PARAMETER SearchVMs
+       Specifies whether to search the VMs.
+
+    .PARAMETER SearchDisks
+       Specifies whether to search the HardDisks.
+
+    .EXAMPLE
+       C:\PS>Get-EntityByCryptoKeyId -SearchVMHosts -KeyId 'keyId'
+
+       Gets the VMHosts whose CryptoKeyId's KeyId matches exactly the 'keyId'.
+
+    .EXAMPLE
+       C:\PS>Get-EntityByCryptoKeyId -SearchVMs -KMSClusterId 'clusterId'
+
+       Gets the VMs whose CryptoKeyId's ProfileId.Id matches exactly the 'clusterId'.
+
+    .EXAMPLE
+       C:\PS>Get-EntityByCryptoKey -SearchVMHosts -SearchVMs -KMSClusterId 'clusterId'
+
+       Gets VMHosts and VMs whose CryptoKeyId's ProviderId.Id matches the 'clusterId'.
+
+    .NOTES
+       At least one of the KeyId and KMSClusterId parameters is required.
+       If the SearchVMHosts, SearchVMs and SearchDisks all not specified, the cmdlet return $null.
+    
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$false,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [String] $keyId,
+
+        [Parameter(Mandatory=$false,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [String] $KMSClusterId,
+
+        [Parameter(Mandatory=$False)]
+        [switch] $SearchVMHosts,
+
+        [Parameter(Mandatory=$False)]
+        [switch] $SearchVMs,
+
+        [Parameter(Mandatory=$False)]
+        [switch] $SearchDisks
+    )
+
+    if (!$KeyId -and !$KMSClusterId) {
+       Throw "One of the keyId or KMSClusterId must be specified!`n"
+    }
+
+    # The returned Items
+    $Entities = @{}
+
+    # Find VMHosts
+    $CryptoSafeVMHosts = Get-VMHost|Where {$_.CryptoSafe}
+
+    # Quit if no VMHosts found.
+    if (!$CryptoSafeVMHosts) {
+       Throw "No VMHosts enabled the CrytoState to Safe!`n"
+    }
+
+    if ($SearchVMHosts) {
+       Write-Verbose "Starting to search VMHosts...`n"
+       $VMHostList = $CryptoSafeVMHosts| Where {$_.ExtensionData.Runtime.CryptoKeyId|MatchKeys -KeyId $KeyId -KMSClusterId $KMSClusterId}
+       $Entities.VMHostList = $VMHostList
+    }
+
+    # Find the VMs which encrypted: Look for both VMHome and Disks
+    $VMs = Get-VM|Where {$_.Encrypted}
+    if ($SearchVMs) {
+       Write-Verbose "Starting to search VMs...`n"
+       $VMList = @()
+       $Disks = $VMs|Get-HardDisk|Where {$_.Encrypted}
+       $VMDiskList = $Disks|Where {$_.EncryptionKeyId|MatchKeys -KeyId $keyId -KMSClusterId $KMSClusterId}
+
+       $VMList += $VMs|Where {$_.EncryptionKeyId|MatchKeys -KeyId $keyId -KMSClusterId $KMSClusterId}
+       $VMList += $VMDiskList.Parent
+       $VMList = $VMList|sort|Get-Unique
+       $Entities.VMList = $VMList
+    }
+
+    # Find the Disks
+    if ($SearchDisks) {
+       Write-Verbose "Starting to search Disks...`n"
+       if ($SearchVMs) {
+          $DiskList = $VMDiskList
+       } else {
+          $Disks = $VMs|Get-HardDisk|Where {$_.Encrypted}
+          $DiskList = $Disks|Where {$_.EncryptionKeyId|MatchKeys -KeyId $keyId -KMSClusterId $KMSClusterId}
+       }
+
+       $Entities.DiskList = $DiskList
+    }
+
+    return $Entities
+}
+
+Function New-KMServer {
+    <#
+    .SYNOPSIS
+       This cmdlet adds a Key Management Server.
+
+    .DESCRIPTION
+       This cmdlet adds a Key Management Server to vCenter Server and verifies it.
+
+    .PARAMETER KMServer
+       Specifies the Key Management Server IP address or FQDN.
+
+    .PARAMETER KMSClusterId
+       Specifies the ID of the KMS cluster. KMSs with the same cluster ID are in one cluster and provide the same keys for redundancy.
+
+    .PARAMETER UserName
+       Specifies user name to authenticate to the KMS.
+
+    .PARAMETER Password
+       Specifies password to authenticate to the KMS.
+
+    .PARAMETER Name
+       Specifies the name of the KMS.
+
+    .PARAMETER Port
+       Specifies the port of the KMS.
+
+    .PARAMETER ProxyServer
+       Specifies the address of the proxy server.
+
+    .PARAMETER ProxyPort
+       Specifies the port of the proxy server.
+
+    .PARAMETER Protocol
+       Specifies the KMS library protocol handler, for example KMS1.
+
+    .EXAMPLE
+       C:\PS>New-KMServer -KMServer 1.1.1.1 -KMSClusterId clsName  -UserName "YourKMSUserName" -Password '***' -Name "KMS1"
+
+       Adds the Key Management Server 1.1.1.1 into vCenter with the cluster name 'clsname' and KMS name 'KMS1'.
+
+    .NOTES
+       This cmdlet only supports PyKMIP Server. For other KMS vendors, modify the script accordingly.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True)]
+        [String]$KMServer,
+
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True)]
+        [String]$KMSClusterId,
+
+        [Parameter(Mandatory=$False)]
+        [String] $UserName,
+
+        [Parameter(Mandatory=$True,ValueFromPipeline=$True)]
+        [String] $Name,
+
+        [Parameter(Mandatory=$False)]
+        [String] $Password,
+
+        [Parameter(Mandatory=$False)]
+        [Int] $Port=5696,
+
+        [Parameter(Mandatory=$False)]
+        [String] $ProxyServer,
+
+        [Parameter(Mandatory=$False)]
+        [Int] $ProxyPort,
+
+        [Parameter(Mandatory=$False)]
+        [String] $Protocol
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       # Get the cryptoManager of vCenter Server
+       $CM = GetCryptoManager
+    }
+
+    Process {
+       if ([string]::IsNullOrWhiteSpace($KMSClusterId)) {
+          Write-Error "The KMSClusterId parameter is mandatory, please specify a valid value!`n"
+          return
+       }
+
+       if ([string]::IsNullOrWhiteSpace($KMServer)) {
+          Write-Error "The KMServer parameter is mandatory, please specify a valid value!`n"
+          return
+       }
+
+       if ([string]::IsNullOrWhiteSpace($Name)) {
+          Write-Error "The KMSName parameter is mandatory. Please specify a valid value!`n"
+          return
+       }
+
+       Write-Verbose "Starting to add Key Management Server: $KMServer......`n"
+       # Construct KMServerInfo and Spec
+       $KMServerInfo = New-Object VMware.Vim.KmipServerInfo
+       $KMServerSpec = New-Object VMware.Vim.KmipServerSpec
+       $KMServerInfo.Address = $KMServer
+       $KMServerInfo.Name = $Name
+
+       if ($UserName) {
+          $KMServerInfo.UserName = $UserName
+       }
+
+       if ($KMSPassword) {
+          $KMServerSpec.Password = $Password
+       }
+
+       if ($Port) {
+          $KMServerInfo.Port = $Port
+       }
+
+       if ($ProxyServer) {
+          $KMServerInfo.ProxyAddress = $ProxyServer
+       }
+
+       if ($ProxyPort) {
+          $KMServerInfo.ProxyPort = $ProxyPort
+       }
+
+       if ($Protocol) {
+          $KMServerInfo.Protocol = $Protocol
+       }
+
+       $ProviderID = New-Object VMware.Vim.KeyProviderId
+       $ProviderID.Id = $KMSClusterId
+       $KMServerSpec.ClusterId = $ProviderID
+       $KMServerSpec.Info = $KMServerInfo
+
+       Write-Verbose "Registering $KMServer to vCenter Server....`n"
+
+       try {
+          $CM.RegisterKmipServer($KMServerSpec)
+       } catch {
+          Write-Error "Exception:  $_ !"
+          return
+       }
+
+       Write-Verbose "Establishing trust between vCenter Server and the Key Management Server: $KMServer`n"
+       try {
+          $KMServerCert = $CM.RetrieveKmipServerCert($providerID,$KMServerInfo)
+          $CM.UploadKmipServerCert($providerID,$KMServerCert.Certificate)
+       } catch {
+          Write-Error "Error occurred while retrieveing and uploading certification!`n"
+          return
+       }
+
+       $CM.updateviewdata()
+       if (!(Get-DefaultKMSCluster) -and
+            ($CM.KmipServers|foreach {$_.servers}|foreach {$_.Address}) -contains $KMServer) {
+          Write-Verbose "No default Key Management Server yet. Marking $KMServer as default!`n"
+          Set-DefaultKMSCluster -KMSClusterId $ProviderID.Id
+       }
+
+       Write-Verbose "Verifying KMS registration.....`n"
+       $CM.updateviewdata()
+       $KMServers = $CM.Kmipservers|where {($_.servers|foreach {$_.Address}) -contains $KMServer}
+       if ($KMServers) {
+          Write-Verbose "Key Management Server registered successfully!`n"
+          $KMServers
+       } else {
+          Write-Error "Key Management Server registration failed!`n"
+       }
+    }
+}
+
+Function Remove-KMServer {
+    <#
+    .SYNOPSIS
+       This cmdlet removes a Key Management Server.
+
+    .DESCRIPTION
+       This cmdlet removes a Key Management Server from vCenter Server.
+
+    .PARAMETER Name
+       Specifies the name or alias of the Key Management Server.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID string to be used as Key Management Server cluster.
+
+    .EXAMPLE
+       C:\PS>Remove-KMServer -KMSClusterId "ClusterIdString" -KMSName "KMServerName"
+
+       Removes the KMS from vCenter Server which has the KMS name and KMS cluster ID.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True)]
+        [String]$KMSClusterId,
+
+        [Parameter(Mandatory=$True)]
+        [String]$Name
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       # Get the cryptoManager of vCenter Server
+       $CM = GetCryptoManager
+    }
+
+    Process {
+       if ([string]::IsNullOrWhiteSpace($Name) -Or
+           [string]::IsNullOrWhiteSpace($KMSClusterId)) {
+          $ErrMsg = "The KMSName and KMSClusterId parameters are mandatory "+
+                    "and should not be null or empty!`n"
+          Write-Error $ErrMsg
+          return
+       }
+
+       $KMServers = $CM.KmipServers
+       if (!$KMServers) {
+          Write-Error "There are no Key Managerment Servers in vCenter Server!`n"
+          return
+       }
+
+       if ($KMServers|Where { ($_.ClusterId.Id -eq $KMSClusterId) -and ($_.Servers|Where {$_.Name -eq $Name})}) {
+          #Start to remove the specified Km Server
+          try {
+             $ProviderID = New-Object VMware.Vim.KeyProviderId
+             $ProviderID.Id = $KMSClusterId
+             $CM.RemoveKmipServer($providerID, $Name)
+          } catch {
+             Write-Error "Exception: $_!`n"
+             return
+          }
+       } else {
+          $KMSNotFounErrMsg = "Cannot find the KMS with Name:$Name and KMS ClusterId:$KMSClusterId,"+
+                              "please make sure you specified correct parameters!`n"
+          Write-Error $KMSNotFounErrMsg
+          return
+       }
+    }
+}
+
+Function Get-KMSCluster {
+    <#
+    .SYNOPSIS
+       This cmdlet retrieves all KMS clusters.
+
+    .DESCRIPTION
+       This cmdlet retrieves all KMS clusters.
+
+    .EXAMPLE
+       C:\PS>Get-KMSCluster
+
+       Retrieves all KMS clusters.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    # Confirm the connected VIServer is vCenter Server
+    ConfirmIsVCenter
+
+    # Get the cryptoManager of vCenter Server
+    $CM = GetCryptoManager
+
+    # Get all KMS Clusters
+    return $CM.KmipServers.ClusterId
+}
+
+Function Get-KMSClusterInfo {
+    <#
+    .SYNOPSIS
+       This cmdlet retrieves the KMS cluster information.
+
+    .DESCRIPTION
+       This cmdlet retrieves the KMS cluster Information by providing the KMS cluster ID string.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID.
+
+    .EXAMPLE
+       C:\PS>Get-KMSClusterInfo
+
+       Retrieves all KMS cluster information.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$False,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [String] $KMSClusterId
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       # Get the cryptoManager of vCenter Server
+       $CM = GetCryptoManager
+    }
+
+    Process {
+       # Get all Km Clusters if no KMSClusterId specified
+       if (!$KMSClusterId) {
+          return $CM.KmipServers
+       }
+       return $CM.KmipServers|where {$_.ClusterId.Id -eq $KMSClusterId}
+    }
+}
+
+Function Get-KMServerInfo {
+    <#
+    .SYNOPSIS
+       This cmdlet retireves the Key Management Servers' information.
+
+    .DESCRIPTION
+       This cmdlet retireves the Key Management Servers' information by providing the KMS cluster ID string.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID.
+
+    .EXAMPLE
+       C:\PS>Get-KMServerInfo
+
+       Retrieves information about all Key Management Servers.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$False,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [String] $KMSClusterId
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       # Get the cryptoManager of vCenter Server
+       $CM = GetCryptoManager
+    }
+
+    Process {
+       # Get all KMS Info if no clusterId specified
+       if ($KMSClusterId) {
+          $FindCluster = (Get-KMSCluster).Contains($KMSClusterId)
+          if (!$FindCluster) {
+             Write-Error "Cannot find the specified KMS ClusterId in vCenter Server!"
+             return
+          }
+
+          $ClsInfo = Get-KMSClusterInfo -KMSClusterId $KMSClusterId
+
+          return $ClsInfo.Servers
+       }
+
+       return $CM.KmipServers.Servers
+    }
+}
+
+Function Get-KMServerStatus {
+    <#
+    .SYNOPSIS
+       This cmdlet retrieves the KMS status.
+
+    .DESCRIPTION
+       This cmdlet retrieves the KMS status by providing the KMS cluster ID String
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster ID from which to retrieve the servers' status.
+
+    .EXAMPLE
+       C:\PS>Get-KMServerStatus -KMSClusterId 'ClusterIdString'
+
+       Retrieves the specified KMS cluster 'ClusterIdString' server status.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$False,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)]
+        [String] $KMSClusterId
+    )
+
+    Begin {
+       # Confirm the connected VIServer is vCenter Server
+       ConfirmIsVCenter
+
+       # Get the cryptoManager of vCenter Server
+       $CM = GetCryptoManager
+    }
+
+    Process {
+       $ClusterInfo = @()
+       if ($KMSClusterId) {
+          # Quit if the ClusterID cannot be found
+          $FindCluster = (Get-KMSCluster).Contains($KMSClusterId)
+          if (!$FindCluster) {
+             Write-Error "Cannot find the specified KMS ClusterId in vCenter Server!"
+             return
+          }
+
+          $ClsInfo = New-Object VMware.Vim.KmipClusterInfo
+          $ProviderId = New-Object VMware.Vim.KeyProviderId
+          $ProviderId.Id = $KMSClusterId
+          $ClsInfo.ClusterId = $providerId
+          $ClsInfo.Servers = (Get-KMSClusterInfo -KMSClusterId $KMSClusterId).Servers
+          $ClusterInfo += $ClsInfo
+          $KMSClsStatus = $CM.RetrieveKmipServersStatus($ClusterInfo)
+       } else {
+          $ClusterInfo = Get-KMSClusterInfo
+          $KMSClsStatus = $CM.RetrieveKmipServersStatus($ClusterInfo)
+       }
+
+       if ($KMSClsStatus) {
+          return $KMSClsStatus
+       } else {
+          Write-Error "Failed to get the KMS status`n"
+          return $null
+       }
+    }
+}
+
+Function Get-DefaultKMSCluster {
+    <#
+    .SYNOPSIS
+       This cmdlet retrieves the default KMS cluster.
+
+    .DESCRIPTION
+       This cmdlet retrieves the default KMS cluster.
+
+    .EXAMPLE
+       C:\PS>Get-DefaultKMSCluster
+
+       Retrieves the default KMS cluster.
+
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+    # Confirm the connected VIServer is vCenter Server
+    ConfirmIsVCenter
+
+    # Get the cryptoManager of vCenter Server
+    $CM = GetCryptoManager
+
+    return ($CM.KmipServers|where {$_.UseAsDefault}).ClusterId.Id
+}
+
+Function Set-DefaultKMSCluster {
+    <#
+    .SYNOPSIS
+       This cmdlet sets the provided KMS cluster as the default KMS cluster.
+
+    .DESCRIPTION
+       This cmdlet sets the provided KMS cluster as the default KMS cluster.
+
+    .PARAMETER KMSClusterId
+       Specifies KMS cluster ID which will be used to mark as default KMS cluster.
+
+    .EXAMPLE
+       C:\PS>Set-DefaultKMSCluster -KMSClusterId 'ClusterIdString'
+
+       Sets the KMS cluster whose cluster ID is 'ClusterIdString' as the default KMS cluster.
+    
+    .NOTES
+       Author                                    : Baoyin Qiao.
+       Author email                              : bqiao@vmware.com
+       Version                                   : 1.0
+
+       ==========Tested Against Environment==========
+       VMware vSphere Hypervisor(ESXi) Version   : 6.5
+       VMware vCenter Server Version             : 6.5
+       PowerCLI Version                          : PowerCLI 6.5
+       PowerShell Version                        : 3.0
+
+    #>
+
+   [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True)]
+        [String] $KMSClusterId
+    )
+
+    # Confirm the connected VIServer is vCenter Server
+    ConfirmIsVCenter
+
+    # Get the cryptoManager of vCenter Server
+    $CM = GetCryptoManager
+    $ProviderId = New-Object VMware.Vim.KeyProviderId
+    $ProviderId.Id = $KMSClusterId
+
+    $CM.MarkDefault($ProviderId)
+}
+
+Function ConfirmIsVCenter{
+    <#
+    .SYNOPSIS
+       This function confirms the connected VI server is vCenter Server.
+
+    .DESCRIPTION
+       This function confirms the connected VI server is vCenter Server.
+
+    .EXAMPLE
+       C:\PS>ConfirmIsVCenter
+
+       Throws exception if the connected VIServer is not vCenter Server.
+    #>
+
+    $SI = Get-View Serviceinstance
+    $VIType = $SI.Content.About.ApiType
+
+    if ($VIType -ne "VirtualCenter") {
+       Throw "Operation requires vCenter Server!"
+    }
+}
+
+Function ConfirmHardDiskIsValid {
+    <#
+    .SYNOPSIS
+       This function confirms the hard disks is valid.
+
+    .DESCRIPTION
+       This function confirms the hard disks is valid.
+
+    .PARAMETER VM
+       Specifies the VM which you want to used to validate against.
+
+    .PARAMETER HardDisk
+       Specifies the hard disks which you want to use to validate.
+
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+        [Parameter(Mandatory=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.Inventory.VirtualMachine] $VM,
+
+        [Parameter(Mandatory=$True)]
+        [VMware.VimAutomation.ViCore.Types.V1.VirtualDevice.HardDisk[]] $HardDisk
+    )
+
+    $NonVMHardDisks = $HardDisk|Where {$_.Parent -ne $VM}
+
+    if ($NonVMHardDisks.Length -ge 1) {
+       Throw "Some of the provided hard disks: $($NonVMHardDisks.FileName) do not belong to VM: $VM`n"
+    }
+}
+
+Function MatchKeys {
+   <#
+    .SYNOPSIS
+       This function checks whether the given keys matched or not.
+
+    .DESCRIPTION
+       This function checks whether the given keys matched or not with the provided KeyId or KMSClusterId.
+
+    .PARAMETER KeyToMatch
+       Specifies the CryptoKey to match for.
+
+    .PARAMETER KeyId
+       Specifies the keyId should be matched.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMSClusterId should be matched.
+
+    .NOTES
+       Returns the true/false depends on the match result.
+       One of keyId or KMSClusterId parameter must be specified.
+    #>
+
+    [CmdLetBinding()]
+
+    Param (
+       [Parameter(Mandatory=$True,ValueFromPipeline=$True)]
+       [VMware.Vim.CryptoKeyId] $KeyToMatch,
+
+       [Parameter(Mandatory=$false)]
+       [String] $KeyId,
+
+       [Parameter(Mandatory=$false)]
+       [String] $KMSClusterId
+    )
+
+    Process {
+       if (!$KeyId -and !$KMSClusterId) {
+          Throw "One of the keyId or KMSClusterId must be specified!`n"
+       }
+
+       $Match = $True
+       if ($KeyId -and ($KeyId -ne $KeyToMatch.KeyId)) {
+           $Match = $false
+       }
+
+       if ($KMSClusterId) {
+          if (!$KeyToMatch.ProviderId) {
+              $Match = $false
+          }
+
+          if ($KMSClusterId -ne $KeyToMatch.ProviderId.Id) {
+              $Match = $false
+          }
+       }
+       return $Match
+    }
+}
+
+Function NewEncryptionKey {
+    <#
+    .SYNOPSIS
+       This function generates new encryption key from KMS.
+
+    .DESCRIPTION
+       This function generates new encryption from KMS, if no KMSClusterId specified the default KMS will be used.
+
+    .PARAMETER KMSClusterId
+       Specifies the KMS cluster id.
+
+    .EXAMPLE
+       C:\PS>NewEncryptionKey -KMSClusterId 'ClusterIdString'
+
+       Generates a new encryption key from the specified KMS which cluster id is 'ClusterIdString'.
+    #>
+
+    Param (
+        [Parameter(Mandatory=$False)]
+        [String]$KMSClusterId
+    )
+
+    # Confirm the connected VIServer is vCenter
+    ConfirmIsVCenter
+
+    # Get the cryptoManager of vCenter Server
+    $CM = GetCryptoManager
+    $ProviderId = New-Object VMware.Vim.KeyProviderId
+
+    Write-Verbose "Generate a CryptoKey.`n"
+    if ($KMSClusterId) {
+       $ProviderId.Id = $KMSClusterId
+    } else {
+       $ProviderId = $null
+    }
+
+    $KeyResult = $CM.GenerateKey($ProviderId)
+    if (!$keyResult.Success) {
+       Throw "Key generation failed, make sure the KMS Cluster exists!`n"
+    }
+    return $KeyResult
+}
+
+Function GetCryptoManager {
+    <#
+    .SYNOPSIS
+       This function retrieves the cryptoManager according to the given type.
+
+    .DESCRIPTION
+       This function retrieves the cryptoManager according to the given type.
+
+    .PARAMETER Type
+       Specifies the type of CryptoManager instance to get, the default value is KMS.
+
+    .EXAMPLE
+       C:\PS>GetCryptoManager -Type "CryptoManagerKmip"
+
+       Retrieves the 'CryptoManagerKmip' type CryptoManager.
+    #>
+
+    Param (
+        [Parameter(Mandatory=$false)]
+        [String] $Type
+    )
+
+    Process {
+       $SI = Get-View Serviceinstance
+       $CM = Get-View $SI.Content.CryptoManager
+       $cryptoMgrType = $CM.GetType().Name
+
+       if (!$Type) {
+          # As the type is not cared, so return the CM directly
+          return $CM
+       }
+       if ($cryptoMgrType -eq $Type) {
+          return $CM
+       }
+
+       Throw "Failed to get CryptoManager instance of the required type {$Type}!"
+    }
+}
+
+Export-ModuleMember *-*