I am working on a Permission audit and am struggling to get the output I need. In Vcenter, under Administration, and Users and Groups, neither Users or Groups has an export option. So I have dug around and referenced:
https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Fetching-User-Group-Role-details-using-Powercli/td-p/1823101
and
https://communities.vmware.com/t5/VMware-PowerCLI-Discussions/Script-to-display-members-of-groups/td-p/933560
And using those I have come up with this block that runs, and the Permissions, and Roles tabs are great. But I am not getting any output on the members column of the groups sheet.
Now in my environment my vSphere groups can have multiple AD users and AD Security groups from multiple domains as members. And a couple groups have a mix of AD and vsphere.local members. ( I know that is part of why I am trying to run an audit to clean it up)
What I need help with is the groups lookup. Ideally I would get a sheet called groups and it lists the Group Name "Principal", Members of the vSphere Group, Members of the AD group if listed in the vSphere group, Where all that Group has permissions "VIObject", and what level of permissions that group has in that location "Role".
And from the below block I can get most of that but I haven't figured out how to list the group members and then pass that into the AD lookup. I am getting familar with PowerCLI cmdlets, but cant seem to find the the properties I need to pull this together.
Any Help would be appreciated.
And I am using PowerCLI 12.2.0 with vSphere 6.7.
$d=get-date -Format yyyyMMdd
$reportName = "C:\VCenter_Permission_Audit-$d.xlsx"
$reporttime = [System.Diagnostics.Stopwatch]::StartNew()
Get-VIPermission | Select Principal,Role,@{n='Entity';E={$_.Entity.Name}},@{N='Entity Type';E={$_.EntityId.Split('-')[0]}},@{N='vCenter';E={$_.Uid.Split('@:')[1]}}`
| Export-Excel -Path $reportName -WorksheetName Permissions
Get-VIRole | Select Name,@{N='PrivilegeList';E={[string]::Join([char]10,$_.PrivilegeList)}} `
| Export-Excel -Path $reportName -WorksheetName Roles
Get-VIPermission | Select @{N="VIObject";E={$_.Entity.Name}},Role,Principal,
@{N="Members";E={ if($_.IsGroup){
$group = Get-ADGroup $_.Principal.Split('\')[1] -Properties Members
$names = $group.Members | %{Get-ADObject $_ | Select -ExpandProperty Name} string]::Join(',',$names)}}}`
| Export-Excel -Path $reportName -WorksheetName Groups
$reporttime.Stop()
Write-Host "This report took "$reporttime.Elapsed.Minutes"Minutes and "$reporttime.Elapsed.Seconds"Seconds to run"