PowerCLI script for Desktop Support to reboot VM's

[BKleiman72]

I have a need to have or Desktop Support team occasionally reboot VM's when they become unstable. They don't have access to vCenter and are not allowed access to vCenter, so I would like to create a script that would prompt them for the name of the server that needs to be rebooted and then use the credentials from a service account that needs to be encrypted to reboot the server.

Thanks

[LucD]

That sounds more like a standard PowerShell script, no PowerCLI involved.

Something like this

$target = Read-Host -Prompt "Name of machine to reboot"

$confirm = Read-Host -Prompt "Are you sure you want to reboot $target (y/n)"

if($confirm -eq 'y'){

    Restart-Computer -ComputerName $target -Confirm:$false

}

[BKleiman72]

The VM's are in a domain that the Help Desk staff don't have access to, this why I was hoping to do this through vCenter using a service account that has restart permissions.

[sjesse]

Are you using Horizon for the desktops?

[BKleiman72]

No these are Citrix XenApp servers that are using a legacy app that occasionally have hung user sessions and need to be restarted.

[LucD]

I thought you said the Helpdesk doesn't have access to vCenter?
With a PowerCLI based solution, they will at least have to make a connection to the vCenter, albeit with an account with restricted privileges.

[sjesse]

You can take LucD​ script and convert is like this

$target = Read-Host -Prompt "Name of machine to reboot"

$confirm = Read-Host -Prompt "Are you sure you want to reboot $target (y/n)"

if($confirm -eq 'y'){

     Connect-VIServer vcenter-name

    Get-VM -Name $target | Restart-VMGuest -Confirm:$false

}

This will ask for a user name and password for vcenter where you can enter a service account. This still requires access to vcenter though, I'm not aware of a way to allow powercli but not access to the client.

[BKleiman72]

I have a service account that can be used for this. I just didn't want to give the Help Desk staff the credentials, I wanted to put the credentials in the script in an encrypted state.

[LucD]

Which encryption do you envisage?

If these are workstations and you don't have a Security DB or App, you will be limited to using DPAPI on Windows.
That is

1. Not really secure (easily broken)
2. Is restricted in that the encryption key is stored locally and is bound to the user (meaning that you would need to create the encrypted string with the account that will use it) and station (meaning the encryption will have to be done on each station)