VMware Cloud Community
LMarshall
Contributor
Contributor

Enabling AD Authenication

I am trying to enable AD authentication via powershell. I have enabled the firewall ports but I am attempting to find a way to execute the following command via powershell.

esxcfg-auth --enablead --addomain=my.company.com --addc=mydc.company.com

I have not seen anything in the community on this. Can someone help.

Thanks,

Larry

0 Kudos
2 Replies
LucD
Leadership
Leadership

There are no VITK cmdlets nor any SDK methods that will allow you to do the same thing as the esxcfg-auth command does.

The only solution, afaik, is run the esxcfg-auth command from within a PS script.

To be able to do that there are some prerequisites:

1) you need to install putty on the machine from which you want to run the PS script.

The script use the plink.exe program.

2) you need to configure an account, with the required privileges, in the COS of the ESX server

2a) since we don't allow SSH with the root account we use a dedicated account for this

2b) add this account to the required groups in the COS (we use the same groups that the root account has)

2c) add an entry in the /etc/sudoers file to avoid password prompts for this account

...
<accountname> ALL=(ALL) NOPASSWD: ALL
...

If all the prerequisites are met you can use a script like this to execute the esxcfg-auth command.

$User = <accountname>
$Pswd = <password>
$ESX = <ESX-server>
$plink = <path-to>\plink.exe"
$plinkoptions = " -v -batch -pw $Pswd"
$cmd = 'sudo -u root /usr/sbin/esxcfg-auth --enablead --addomain=my.company.com --addc=mydc.company.com'

$remoteCommand = '"' + $cmd + '"'
$command = $plink + " " + $plinkoptions + " " + $User + "@" + $ESX + " " + $remoteCommand

Invoke-Expression -command $command 

Note that this way of working is not very secure.

You do have a clear-text password in the script !


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
RobMokkink
Expert
Expert

Lmarshall,

It's better to use:

esxcfg-auth --enablead --addomain=my.company.com --addc=my.company.com

The --addc = also the fqdn of the domain. This way every dc can be used for authentication. Make sure you have your sites setup properly, if you have multiple sites offcourse.

If you are looking for a script to update users on the esx hosts, have a look at the following document:

http://communities.vmware.com/docs/DOC-7090

Also make sure you have setup sudo correctly, als Lucd pointed out.

0 Kudos