Windows Integrated authentication issue with vCSA 6.5 and Powercli 6.5.4

[AllBlack]

Hi there

I haven't done much with powercli over last few years so please excuse ignorance.

I have vCSA 6.5 and installed the latest powercli from the gallery.

I have been given some scripts to modify which are supposed to run weekly via scheduled task.

They are currently not working and it seems it is due to credentials not being passed through.

I have verified that when I connect manually from the cli the integration is not working and I get prompted for the credentials.

Any idea as why this could be? My SSO has the domain we use set WIA and it is set to default.

It seems this can be worked around with import-clixml but if there is an out of the box solution I'd like to hear

Cheers

[LucD]

Not sure exactly what you are asking.

Did you specify credentials for the scheduled task? And you want to do a Connect-VIServer in the scheduled scripts without passing credentials?

[AllBlack]

Hi Luc

In the vSphere 5.5 environment everything works as expected. This is using an older version of powercli (the one that came with installer, not the new module based one)

The task is set to run with a specific account (whether user is logged on or not).

The script is called as follows

Program/script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Argument: -PSConsoleFile "C:\\vCenter_scripts\RemoveVMwithOldSnaps.ps1"

And this is pretty much what the script does in terms of connecting

### USER DEFINED VARIABLES

$vcenterserver = "xxx" #Enter the FQDN or IP of your vCenter server

$fromAddr = "xxx" # Enter the FROM address for the e-mail alert

$toAddr = "xxx" # Enter the TO address for the e-mail alert

$smtpsrv = "xxx" # Enter the FQDN or IP of a SMTP relay

$messageSubject = "Snapshots removed"

### END USER DEFINED VARS

#Write-Host "Connecting to vCenter" -foregroundcolor "magenta"

Connect-VIServer -Server $vcenterserver

I get the following error

Task Scheduler failed to launch action "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" in instance "{ad5242f2-3cd5-4c44-8904-de299682b7cd}" of task "\vCenter - Remove Old Snapshots". Additional Data: Error Value: 2147942667.

Basically why I was using about the authentication was because my colleague said he had to use the import-clixml command in one of our scripts to make it work since we moved to vsphere 6.5

Also, running connect-viserver from the cli prompts me for credentials too. I do not get prompted for them when I connect to the 5.5 environment, just works.

Hope this makes sense

[LucD]

I see.

When I schedule a PS task I always add the -NonInteractive parameter.

On the difference in behaviour between 5.5 and 6.54, could it be that you have CredentialStoreItem in 5.5 for that user, and not in 6.5.4?

Can you check by dong a Get-VICredentialStoreItem when connected with that user in both environments?

[AllBlack]

Checked both environments but neither returns a Get-VICredentialStoreItem value

Trying with the -Noninteractive parameter does not seem to make a difference either

I created this batch script to execute ps and do some logging.

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c Start-Transcript c:\site\logs\OldSnapshotsavc1.log;Import-Module VMware.PowerCLI;.\RemoveVMwithOldSnaps_avc1.ps1

The credentials box popped up but just clicked cancel.

**********************

Windows PowerShell transcript start

Start time: 20171215084929

Username: site\myaccount

RunAs User: site\myaccount

Machine: TUR-ACCTMGMT1 (Microsoft Windows NT 6.1.7601 Service Pack 1)

Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c Start-Transcript c:\site\logs\OldSnapshotsavc1.log;Import-Module VMware.PowerCLI;.\RemoveVMwithOldSnaps_avc1.ps1

Process ID: 19724

PSVersion: 5.1.14409.1012

PSEdition: Desktop

PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14409.1012

BuildVersion: 10.0.14409.1012

CLRVersion: 4.0.30319.36415

WSManStackVersion: 3.0

PSRemotingProtocolVersion: 2.3

SerializationVersion: 1.1.0.1

**********************

Transcript started, output file is c:\site\logs\OldSnapshotsavc1.log

WARNING: Please consider joining the VMware Customer Experience Improvement Program, so you can help us make PowerCLI a better product. You can join using the following command:

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $true

VMware's Customer Experience Improvement Program ("CEIP") provides VMware with information that enables VMware to improve its products and services, to fix problems, and to advise you on how best to deploy and use our products.  As part of the CEIP, VMware collects technical information about your organization’s use of VMware products and services on a regular basis in association with your organization’s VMware license key(s).  This information does not personally identify any individual.

For more details: type "help about_ceip" to see the related help article.

To disable this warning and set your preference use the following command and restart PowerShell:

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $true or $false.

          Welcome to VMware PowerCLI!

Log in to a vCenter Server or ESX host:

Connect-VIServer

To find out what commands are available, type:

Get-VICommand

To show searchable help for all PowerCLI commands:

Get-PowerCLIHelp

Once you've connected, display all virtual machines:

Get-VM

If you need more help, visit the PowerCLI community:

Get-PowerCLICommunity

       Copyright (C) VMware, Inc. All rights reserved.

WARNING: There were one or more problems with the server certificate for the server vcenter.domain.local:443:

* The X509 chain could not be built up to the root certificate.

Certificate: [Subject]

  C=US, CN=vcenter.domain.local

[Issuer]

  OU=VMware Engineering, O=site-psc1.domain.local, S=California, C=US, DC=local, DC=vsphere, CN=CA

[Serial Number]

  00F2E1C032545644D5

[Not Before]

  8/08/2017 1:40:54 p.m.

[Not After]

  3/08/2027 11:59:50 a.m.

[Thumbprint]

  87C094B8515CFEA6F52E68CA55386801139B2607

The server certificate is not valid.

WARNING: THE DEFAULT BEHAVIOR UPON INVALID SERVER CERTIFICATE WILL CHANGE IN A FUTURE RELEASE. To ensure scripts are not affected by the change, use Set-PowerCLIConfiguration to set a value for the InvalidCertificateAction option.

Connect-VIServer : 15/12/2017 8:49:56 a.m. Connect-VIServer Could not determine user name and/or password for server

vcenter.domain.local

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:10 char:1

+ Connect-VIServer -Server $vcenterserver

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [Connect-VIServer], ViServerConnectionException

    + FullyQualifiedErrorId :

ViCore_Login_CredentialNotFound,VMware.VimAutomation.ViCore.Cmdlets.Commands.ConnectVIServer

Connect-VIServer : 15/12/2017 8:49:56 a.m. Connect-VIServer Could not

determine user name and/or password for server vcenter.domain.local

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:10 char:1

+ Connect-VIServer -Server $vcenterserver

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [Connect-VIServer], ViServerCo

   nnectionException

    + FullyQualifiedErrorId : ViCore_Login_CredentialNotFound,VMware.VimAutoma

   tion.ViCore.Cmdlets.Commands.ConnectVIServer

PS>TerminatingError(Get-VM): "15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a Connect cmdlet. "

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a

Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:104 char:18

+ $VMsWithSnapsDel=Get-vm | get-snapshot | Where {$_.Created -lt ((Get- ...

+                  ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConnectionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAutomation.ViCore.Cmdlets.Commands.GetVM

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to

any servers. Please connect first using a Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:104 char:18

+ $VMsWithSnapsDel=Get-vm | get-snapshot | Where {$_.Created -lt ((Get- ...

+                  ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConne

   ctionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAuto

   mation.ViCore.Cmdlets.Commands.GetVM

>> TerminatingError(Get-VM): "15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a Connect cmdlet. "

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a

Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:108 char:1

+ Get-vm | get-snapshot | Where {$_.Created -lt ((Get-Date).AddDays(-5) ...

+ ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConnectionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAutomation.ViCore.Cmdlets.Commands.GetVM

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to

any servers. Please connect first using a Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:108 char:1

+ Get-vm | get-snapshot | Where {$_.Created -lt ((Get-Date).AddDays(-5) ...

+ ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConne

   ctionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAuto

   mation.ViCore.Cmdlets.Commands.GetVM

>> TerminatingError(Get-VM): "15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a Connect cmdlet. "

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to any servers. Please connect first using a

Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:112 char:19

+ $VMsWithSnapsKeep=Get-vm | get-snapshot | Where {$_.Created -lt ((Get ...

+                   ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConnectionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAutomation.ViCore.Cmdlets.Commands.GetVM

Get-vm : 15/12/2017 8:49:56 a.m. Get-VM You are not currently connected to

any servers. Please connect first using a Connect cmdlet.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:112 char:19

+ $VMsWithSnapsKeep=Get-vm | get-snapshot | Where {$_.Created -lt ((Get ...

+                   ~~~~~~

    + CategoryInfo          : ResourceUnavailable: (:) [Get-VM], ViServerConne

   ctionException

    + FullyQualifiedErrorId : Core_BaseCmdlet_NotConnectedError,VMware.VimAuto

   mation.ViCore.Cmdlets.Commands.GetVM

Disconnect-VIServer : 15/12/2017 8:49:56 a.m. Disconnect-VIServer Could not find VIServer with name

'vcenter.domain.local'.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:122 char:1

+ Disconnect-VIServer -Server $vcenterserver -Confirm:$false

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (vcenter.domain.local:String) [Disconnect-VIServer], VimException

    + FullyQualifiedErrorId :

Core_ObnSelector_SelectObjectByNameCore_ObjectNotFound,VMware.VimAutomation.ViCore.Cmdlets.Commands.DisconnectVIServer

Disconnect-VIServer : 15/12/2017 8:49:56 a.m. Disconnect-VIServer Could not

find VIServer with name 'vcenter.domain.local'.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:122 char:1

+ Disconnect-VIServer -Server $vcenterserver -Confirm:$false

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (vcenter.domain.local:String) [D

   isconnect-VIServer], VimException

    + FullyQualifiedErrorId : Core_ObnSelector_SelectObjectByNameCore_ObjectNo

   tFound,VMware.VimAutomation.ViCore.Cmdlets.Commands.DisconnectVIServer

>> TerminatingError(Disconnect-VIServer): "15/12/2017 8:49:57 a.m. Disconnect-VIServer Could not find any of the servers specified by name. "

Disconnect-VIServer : 15/12/2017 8:49:57 a.m. Disconnect-VIServer Could not find any of the servers specified by name.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:122 char:1

+ Disconnect-VIServer -Server $vcenterserver -Confirm:$false

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (VMware.VimAutom...Server[] Server:RuntimePropertyInfo)

[Disconnect-VIServer], ServerObnFailureException

    + FullyQualifiedErrorId : Core_ObnSelector_SetNewParameterValue_ServerSpecifiedButNotFound,VMware.VimAutomation.ViCo

re.Cmdlets.Commands.DisconnectVIServer

Disconnect-VIServer : 15/12/2017 8:49:57 a.m. Disconnect-VIServer Could not

find any of the servers specified by name.

At C:\site\vCenter_scripts\RemoveVMwithOldSnaps_avc1.ps1:122 char:1

+ Disconnect-VIServer -Server $vcenterserver -Confirm:$false

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (VMware.VimAutom...Server[] Serv

   er:RuntimePropertyInfo) [Disconnect-VIServer], ServerObnFailureException

    + FullyQualifiedErrorId : Core_ObnSelector_SetNewParameterValue_ServerSpec

   ifiedButNotFound,VMware.VimAutomation.ViCore.Cmdlets.Commands.DisconnectVI

  Server

PS>$global:?

True

**********************

Windows PowerShell transcript end

End time: 20171215084957

**********************

[LucD]

That seems to say that there is an invalid certificate.

Did you set the InvalidCertificateAction to Ignore with Set-PowerCLIConfiguration?
You can do that before the Connect-VIServer in your script

[AllBlack]

Yes, makes sense as I use the default certificate.

I did set to ignore the InvalidCertificateAction but it still prompts for credentials

[LucD]

That it prompts for credentials is normal, but it shouldn't stop the connection when the certificate is invalid.

You should also use the Scope, preferably the AllUsers setting.

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope AllUsers

You can check with Get-PowerCLIConfiguration

[FuzzyBunnyofDoo]

Hey AllBlack
​
Something LucD said before, I beleive ​I've been having the same issue as you
After installing a new environment all my scripts run fine as scheduled Windows tasks for my old 5.5 & 6.0 environments, but not 6.5 vCSA
I have stumbled onto my solution that I hope helps you
The bases is that you need to have the credentials saved as a VICredentialStoreItem

Log in to your windows server as your service account/user you want to run your scheduled task as & launch Powercli 
Run the New-VICredentialStoreItem command (below) to add the service account to the credential store.
Exmple. C:\>New-VICredentialStoreItem -Host 'vCenterServer' -User 'admin' -Password 'password'

​When your script runs under the scheduled task, the credentials provided here will be used to connect to the vCenter server.