VMware Cloud Community
emcclure
Enthusiast
Enthusiast

Script to remove users from folder is trying to remove more than one account

Hello,

I have this script that can remove a user from a folder I specify on multiple vCenters.  It works, but when I went to remove the permission of a test account it also wanted to remove my domain account (which I used to login to the vCenters and which is an admin in the vCenters).

param(

[array]$viservers = ("vcenter.domain", "vcenter2.domain")

)

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false

$creds = Get-Credential -Message "Enter your vCenter credentials" -UserName "$($env:USERDNSDOMAIN)\$($env:USERNAME)"

$vSphereConns+= Connect-VIServer -Server $viservers -Credential $creds

while($true){
    $endAnswer = '1'
    while($endAnswer -ne 'Q'){
        if($endAnswer -eq '1'){
            $podnumber = Read-Host = "Enter the pod number"
            if($podnumber.count -eq 1){
                $folder = Get-Folder -Name myfolder-$podnumber
            }
            $endAnswer = '2'
        }
        if($endAnswer -eq '2'){
            $usertoremove = Read-Host = "Enter the username in domain\user format to remove from the folder"
           
           
        }
  
  Get-VIPermission -Entity $folder -Principal $usertoremove | Remove-VIPermission
   
        write-host "Please select an option"
        Write-Host "1 - Go back to the pod number selection"
  Write-Host "2 - Go back to the user selection"
        Write-Host "Q - Exit the script"
        $endAnswer = ''
        while('1','2','Q' -notcontains $endAnswer){
            $endAnswer = (Read-Host -Prompt 'Your answer').ToUpper()
        }
    }
    Disconnect-VIServer -Server $viserver -Confirm:$false
Write-Host "Disconnecting from vCenter and exiting script"
Write-Host "Insert catchy quote here."
    break
}

20 Replies
LucD
Leadership
Leadership

Shouldn't that line be

$usertoremove = Read-Host -Prompt "Enter the username in domain\user format to remove from the folder"


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Good catch.  I fixed it, but it still doesn't solve my problem unfortunately.

0 Kudos
LucD
Leadership
Leadership

Can you try with this adapted version of your script.

Note that I added a WhatIf switch on the Remove-VIPermission cmdlet, so you can check what would happen (without actually removing a permission).

Do you see 2 removals?

param(

   [array]$viservers = ("vcenter.domain", "vcenter2.domain")

)


Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false

$creds = Get-Credential -Message "Enter your vCenter credentials" -UserName "$($env:USERDNSDOMAIN)\$($env:USERNAME)"

$vSphereConns += Connect-VIServer -Server $viservers -Credential $creds

$answer = '1'

while ($answer -ne 'Q')

{

   if ($answer -eq 1)

   {

   $podnumber = Read-Host = "Enter the pod number"

   $answer = 2

   }

   if ($answer -eq 2)

   {

   $folder = Get-Folder -Name myfolder-$podnumber

   }

   $usertoremove = Read-Host -Prompt "Enter the username in domain\user format to remove from the folder"


   Get-VIPermission -Entity $folder -Principal $usertoremove | Remove-VIPermission -WhatIf


   write-host "Please select an option"

   Write-Host "1 - Go back to the pod number selection"

   Write-Host "2 - Go back to the user selection"

   Write-Host "Q - Exit the script"

   $answer = (Read-Host -Prompt 'Your answer').ToUpper()

}

Disconnect-VIServer -Server $viserver -Confirm:$false

Write-Host "Disconnecting from vCenter and exiting script"

Write-Host "Insert catchy quote here."


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

Yes I do see two removals with the -WhatIf Smiley Sad

0 Kudos
LucD
Leadership
Leadership

Can you share the text the WhatIf produced?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

Here it is:

What if: Removing permission on entity 'Folder-group-v343992' for principal 'mydomain\useriwant' and role 'VirtualMachineUser'.

What if: Removing permission on entity 'Folder-group-d1' for principal 'mydomain\useridontwant' and role 'Admin'.

0 Kudos
LucD
Leadership
Leadership

Very strange.

Can you just try the following, and see if it also returns 2 users.

Get-VIPermission -Entity (Get-Folder -Name MyFolder) -Principal 'domain\user'


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

Yes if I specify the user in that section it still wants to remove the other user.

I'm basically specifying a user I have in another domain that I want to remove that I'm logged onto the machine I'm running the script from.

I'm also logged into the vCenter with a different domain account that has admin rights on that vCenter.

When I run the script it wants to remove both accounts, which is odd, yes the username is the same, but they're different domains, neither is a child domain of each other, different spellings, etc.

0 Kudos
LucD
Leadership
Leadership

Do you specify the domain, when providing the username?

Is one of these domains your primary authentication resource?

Is the VCSA registered in one of those domains?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

Yes I do specify the domain when providing the username.

So in our vCenter we have this:

vsphere.local

Domain1

Domain2

Domain3

Domain1 is the domain that the vCenter is on (and registered) and the login that I use when connecting to the vCenter in the script as that account has admin rights to the whole vCenter.

Domain2 is the domain that the current machine I'm working on is joined to and is also the domain I use when adding a user to test the script.

Domain3 is just another corporate domain that's not relevant to this.

All domains are separate.  None are a child domain of each other.

When I run my join script which is almost the same as this script it just adds the user I specify to the folder I want which is great.  I never see anything for the user account I'm logged in as to be added to whatever folder I'm assigning someone to.

Hope this helps clear up any confusion.

0 Kudos
LucD
Leadership
Leadership

I don't have a solution for what you are seeing, and neither can I replicate that.

But I did notice in the output from the WhatIf, that the 2nd removal is on the root folder (also known as Datacenters), not on the folder you specified.

But I have no idea why that would be triggered by the Remove-VIPermission cmdlet you are using.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

Ok well thanks for the help.  I'm not sure why this is happening either.  I've rebooted my machine and that didn't help.  Also tried running it on another machine that's in the same domain as the vCenter and the login I use to the vCenter and still no difference.  I guess I'll keep playing around and maybe get lucky.

0 Kudos
emcclure
Enthusiast
Enthusiast

Hi LucD​,

So I just found something out.  When I run the script and try to remove any account that's tied to me (since they all have the same username, but are in different domains) the script tries to remove all of them.  However if I try to just remove a different user altogether then it behaves properly in only trying to remove them and not me.  That doesn't make a whole lot of sense to me.

I tried removing this section from the beginning of the script: -UserName "$($env:USERDNSDOMAIN)\$($env:USERNAME)" thinking that maybe it was gathering my login info somehow in my different domains, but it made no difference unfortunately.

0 Kudos
LucD
Leadership
Leadership

This sounds more and more like a bug to me.

When you did the Get-VIPermission, with an account tied to you, did you get multiple entries back?
Each with a different principal or not?


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Yes when I did the Get-VIPermission with an account tied to me I got back multiple accounts of mine with different principals.  One for the folder I assigned one of my accounts to, the other to my main account that's at the top level of the vCenter.

0 Kudos
LucD
Leadership
Leadership

That looks like a bug to me.
I would suggest you open an SR for that issue.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

Will do.  Will update this thread with the results.

0 Kudos
LucD
Leadership
Leadership

Thanks.
It looks more and more as if the Get-VIPermission only uses the USER part, and drops the DOMAIN part.


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference

0 Kudos
emcclure
Enthusiast
Enthusiast

I believe I finally figured it out.  Unfortunately I got nowhere with VMware support.

I changed this line:

Get-VIPermission -Entity $folder -Principal $usertoremove | Remove-VIPermission

to this:

Get-VIPermission -Entity $folder | where {$_.principal -eq "$usertoremove"} | Remove-VIPermission

and it seems to be working.  I had noticed that if there was even another user with multiple accounts on the vCenter that it would try to remove all of theirs as well, so it wasn't just for my account running it, but for anybody who had multiple accounts in the vCenter.  Scary stuff.