Update ESXi Password Policy in each host in Cluster.

[zatara]

Hi,

Can someone help me finish this code? I would really appreciate it.

This is a script that sets the Password Policy on every ESXi host in a cluster by vCenter FQDN. I want it to sort of do the following:

1. Connect to vCenter: $variable for vCenter.

     2. Show an error message if vCenter connection fails.

3. Update the policy by the cluster name: $variable for the cluster name.

     4. Loop through every host in the cluster and update the password policy.

     5. Show an error message if connection to cluster fails.

     6. Show a message per ESXi host as "Successful" if the policy applied correctly

7. Disconnect from vCenter.

I found this code below on the web, but I want to modify it to behave just like I have in the description above. We have sort of a strange environment, so it's important that I update where cluster name = $clustername. I don't know if the code below will help, but it's something that worked for someone, I just want to modify it a bit. Thanks! We are running vCenter 6.7 & I use PowerShell with all the VMware Modules loaded in it.

# Set the ESXi Password Policy by using PowerCLI for every ESXi host

# Last updated by: Ivo Beerens October 4, 2015

$PasswordPolicy = "retry=3 min=disabled, disabled , disabled, disabled, 8"

$VMHosts = Get-VMHost | Where { $_.ConnectionState -eq "Connected" }

foreach ($VMHost in $VMHosts)

{

$VMHosts | Get-AdvancedSetting -Name “Security.PasswordQualityControl" | Set-AdvancedSetting -Value $PasswordPolicy -Confirm:$false

}

[LucD]

Try something like this

$vcName = 'vcsa.domain'

$clusterName = 'cluster'

$pswdPolicy = 'retry=3 min=disabled, disabled , disabled, disabled, 8'

try{

    Connect-VIServer -Server $vcName -ErrorAction Stop

}

catch{

    throw "Connection to $vcName failed"

}

try{

    $cluster = Get-Cluster -Name $clusterName -ErrorAction Stop

}

catch{

    throw "Could not find cluster $clusterName"

}

# Set the ESXi Password Policy by using PowerCLI for every ESXi host

# Last updated by: Ivo Beerens October 4, 2015

Get-VMHost -Location $cluster -PipelineVariable esx |

ForEach-Object -Process {

    if($esx.ConnectionState -eq 'Connected'){

        Get-AdvancedSetting -Entity $esx -Name 'Security.PasswordQualityControl' |

        where{$_.Value -ne $pswdPolicy} |

        Set-AdvancedSetting -Value $pswdPolicy -Confirm:$false

    }

    else{

        Write-Error "Node $($esx.Name) is not connected"

    }

}

[zatara]

Wow LucD, you're really amazing at replying to PowerShell questions, it's greatly appreciated! You almost reply to all my questions I post.

On the script you proposed, I'm looking forward to trying it, but I don't think it has a line to disconnect from the vCenter at the end of the script. What would be the best way to add that in? Thank You Sir!

[LucD]

Thanks.

You can just add the following line at the end of the script.

Disconnect-VIServer -Server $vcName -Confirm:$false

[zatara]

Awesome, thank you so much! I appreciate that. Can't wait to try it out. Trying to get a lab built to try it out. There was a VMware HOL where I could test running some scripts but it isn't accessible anymore. I'm trying to get my company to purchase VMware Learning Zone Enterprise, but I'm having a very difficult time getting them to do so, so I can use LabConnect. Sure wish I had access to LabConnect.

I do have Workstation Pro 15.5.5, so I'm working on building a nested lab. I should have it done this weekend so I can test the script, because I have to have this policy changed on hundreds of hosts ASAP next week due to an audit. Our root password already meets the policy requirements, but they still are making us go into each host and modify the policy. Tried to see if it could be accomplished with Host Profiles, but it's just too slow trying to get it done that way - at least in our environment with hundreds of ESXi hosts.

I have a three physical server bare metal lab also, but right now it's kind of in shambles because I tried upgrading it to vSphere 7. Unfortunately one of my hosts didn't meet the requirements. My other two systems had slightly new Xeon CPUs so I was able to get by installing vSphere 7. In doing so, my physical lab is all messed up right now, and I need to do a lot of work on it. Probably use that vSAN Witness Appliance and figure out how to make it work possibly - don't know if that will work with two hosts being @ 7 and another being at 6.7. But we'll see. Thanks again. I sure wish  I could script like you! Maybe someday. My workload is tremendous and stressful and I don't have a lot of down time for learning.

[LucD]

HostProfiles are fine when combined with AutoDeploy.
But for single changes like this, I agree that a HostProfile is too 'heavy' as a solution.

Having a test environment (lab) should be something everyone has in their environment.
Your mgmt wouldn't want you to test scripts in production I hope :smileygrin:

[LucD]

You might want to have a look at William Lam's collection of Homelab scripts.
William has done all the hard work for you (and me)

[zatara]

It's funny you mention that, because I'm actually using Lam's 6.7 OVA's for my nested labs

They won't let use have a test environment at work because they say it isn't properly maintained and it's a waste of money when that money can go to buying extra gear for our regular workload. Of course I don't agree, but I really have no say. Low man on the totem poll. I have suggested and even volunteered to ensure it's taken care of properly and maintained, and even suggest a very low cost solution, but no go. I don't need 50k to 100k servers for a lab environment.

Thank you for your positive reinforcement about the Host Profiles. I'm glad to see I was being sane in that decision. I worked with one of my team members this week trying to get it working via host profiles, but I think it would take till Christmas to finally get it done that way. heh. Also for some reason the Host Profiles wasn't exactly working as expected in the HTML 5 client, and we were having to use the older Flash Client to get it working as expected. I definitely see a lot of bugs in the HTML 5 client also. I used to have the Dark Theme enabled because I liked how it looked more, and I found that it actually hides some things. I was going crazy trying to re-order NICs on a dVS to standyby and unused, and the dark theme actually made the arrows hidden. It's clear that the HTML 5 client still needs some work. Some people in my group say they feel it was rushed. We have a TAM, so I always let him know about the bugs I find and ensure there is a PR opened for the bug.

Thank you again. Your dedication and help to this community is amazing.

[zatara]

LucD:

So I finally got an environment I'm testing this in. Either I'm doing something wrong, or something is wrong in the code.

I couldn't copy & paste, because it was in an isolated lab I couldn't past the code out of, however, I took a screenshot of how I put the code, and then another screenshot of the error message from Powershell.

Just FYI: I'm doing this via the Powershell ISE, with the PSVersion at 5.1.14490.1018

I have the separate Powershell 7 I installed, but I guess there is no ISE with that. However I saw a blog on how to make the ISE work with version 7 so I'm going to try to figure that out, but for now, I'm stuck with the 5.1 version. That's what I'll be stuck with at work as well.

I'm supposed to start getting these done next week. Any chance you can figure out why it's not working? Thank you very much, I appreciate it.

*note - I added the script picture twice, because I couldn't get the first one to open for some odd reason, So i made the script-copy version. Thanks

[LucD · Accepted solution]

It looks as if you have cluster instead of $cluster on the Location parameter.

[zatara]

I'll try it with $cluster and see if it works here in a few minutes. Thanks!

[zatara]

Yep, that was the issue. I'm going to mark you're response to add the $cluster msg as the correct answer since the original response was missing that $. Thank you so much for your help, I really appreciate. I'm relieved I'll have this ready for Monday now. Thank you again, your help means a lot to me! You're awesome!

[LucD]

Oops, sorry about that.

For future viewers of this thread, I corrected the code above as well.

[zatara]

No problem at all. Thank you again.