diff --git a/inventory/group_vars/all b/inventory/group_vars/all
index c7948b3d4f..e95f432dda 100644
--- a/inventory/group_vars/all
+++ b/inventory/group_vars/all
@@ -302,3 +302,8 @@ notes: |
   Unspecified.
     * What hosts/services does this rely on?
     * What hosts/services rely on this?
+
+# network block device encryption default to false,
+# only set on hardware hosts that are encrypted installs where
+# there is a local tang server or tpm
+nbde: false
diff --git a/playbooks/groups/virthost.yml b/playbooks/groups/virthost.yml
index c6573be937..143a68f070 100644
--- a/playbooks/groups/virthost.yml
+++ b/playbooks/groups/virthost.yml
@@ -48,7 +48,7 @@
   - role: collectd/base
   - sudo
   - virthost
-  - {role: linux-system-roles.nbde_client, tags: ['nbde_client'], when: (datacenter == 'rdu3' and nbde|bool) or ( datacenter == 'rdu3' and nbde|bool) }
+  - {role: linux-system-roles.nbde_client, tags: ['nbde_client'], when: (nbde|bool) }
   - {role: serial-console, when: datacenter == 'rdu3' and ansible_architecture != 's390x'}
   - {role: iscsi_client, when: datacenter == 'rdu3' and inventory_hostname.startswith('bvmhost-p10-01') }