Workarounds for VMSA-2020-0026.1 - Multiple removing USB controllers from VM's

[Joggid_1981]

Hello,

could you help me with script for removing all types "USB" Controllers from VMs? I found a lot of VMs in our environments and we want to remove it from all VMs.The reason is vulnerability VMSA-2020-0026.1.

David

[Joggid_1981]

Hello,

could you help me with script for removing all types "USB" Controllers from VMs? I found a lot of VMs in our environments and we want to remove it from all VMs.The reason is vulnerability VMSA-2020-0026.1.

David

[LucD]

This security post only mentions the XHCI USB controllers
So you do not need to remove all USB controllers.

You can do something like this

Get-View -ViewType VirtualMachine -Property Name,'Config.Hardware.Device' -PipelineVariable vm | 
ForEach-Object -Process {
    $spec = New-Object -TypeName VMware.Vim.VirtualMachineConfigSpec

    $vm.Config.Hardware.Device.Where({$_ -is [VMware.Vim.VirtualUSBXHCIController]}) |
    ForEach-Object -Process {
        $devSpec = New-Object -TypeName VMware.Vim.VirtualDeviceConfigSpec
        $devSpec.Device = $_
        $devSpec.Operation = [VMware.Vim.VirtualDeviceConfigSpecOperation]::remove
        $spec.DeviceChange += $devSpec
    }
    if($spec.DeviceChange -ne $null){
        $vm.ReconfigVM($spec)
    }
}

[Joggid_1981]

Excellent!!! Many thanks for this in very short time. 🙂

David

[sandy8]

thanks for the script. how to run this only for multiple specific VMs like declaring as variable value. Because Get-view i found we can use filter using one VM name but not multiple VMs.

[LucD]

You can use the filter to select multiple VMs.
Since the right side is a RegEx, you can do.

Get-View -ViewType VirtualMachine -Filter @{Name='vm1|vm2|vm3'}

[sandy8]

any other ways to filter as i need to remove non-prod cluster VMs first which is 30+ and then we remove Prod cluster VMs which is 40+. any possible ways to input the VM names.

Thanks for you quick reply 🙂

[LucD]

When you have the names of the VMs in a variable, you could use the -contains operator.

$vmNames = 'vm1','vm2','vm3'

Get-View -ViewType VirtualMachine | where{$vmNames -contains $_.Name}

[sandy8]

that's perfect , i am able to modify the script for multiple VMs and test it.

Thanks for your inputs 🙂