re-ip without guest credentials

[prusacv]

I have found many examples of how I can execute a PowerShell script using the Invoke command to change the IP address (re-ip) of a VM, but this command requires Windows (guest) credentials. At the same time, I noticed that if I use VMware SRM, Veeam B&R, or Zerto to re-IP, they don't require Windows OS credentials.

I'm wondering if anyone can point me to an article that covers re-ip with VMware tools without guest credentials. So far I found only one article on the Zerto site that does not technically deeply explains how to create a package that VMware Tools will execute "https://help.zerto.com/ en- USA/KB/00000292"

[LucD]

I'm not sure where you see the link between the re-IP that those back/restore products do and doing the same via VMware Tools?

These products, most of the time, use something like what GuestOSCustomization is doing.
Since the products have full access to the files comprising the recovered VM, they inject the required files to do this GuestOSCustomization, including the change of the IP address.

Invoke-VMScript uses the GuestOperations to send commands to be executed by the Guest OS, including changing the IP address.

These are 2 completely different procedures.

[prusacv]

Not sure why the link I gave is wrong. In any case, the correct link, from where I understand that VMware tools is responsible for the re-ip, is "https://help.zerto.com/en-US/kb/000002926"

They mentioned the following:
- The deployment package is attached to the recovery VM.
- The recovery VM is powered on.
- The Vmtools service is started on the recovery VM.
- The Vmtools executes the package with the following actions:
* Opening package (extracting file);
* Running Script command (as described before);
* Removing package from the recovery VM, VM configuration, and datastore.

From this description, I understood that VMware tools have some ability to re-ip addresses inside Windows OS. I haven't found another article describing the process of re-ip from any other recovery/replication provider with more technical details.

[LucD]

Correct, but that doesn't change my remark.
To run a script, like OSCustomization, you need VMware Tools to be running.
Concerning the Guest Credentials, these backup tools have full access to your datastores, hence they can easily place a file/script in there.

[prusacv]

I fully understand what you've told me about the re-ip and ability of back/restore products to inject content to disk to perform OSCustomization after a restore. From Zerto's article, I understand that it is possible to do re-ip using VMware Tools "option" (like REST API or similar), and Zerto uses it.

Anyway, thanks for providing more details regarding re-ip.

[LucD]

I don't know how that Zerto procedure works, the KB is rather general.

But based on what they describe, I suspect it might be something like this:
- inject a file (script) in the Guest OS filesystem, which I assume they can do
- use the pendingCustomization property in the ToolsConfigInfo object attached to the VM
- start the VM, and then the VMware Tools will run that script

The challenging part might be injecting that file into the Guest OS filesystem.
A method that might work, is attaching the VMDK to another VM, which should be running an OS that can handle that filesystem.
Once the file is injected, detach the VMDK, and attach it again to the original VM.

But again, the would be my plan of attack.
I don't know how Zerto does it.

[prusacv]

Re-ip with the attached disk to my custom VM is not an option for me because I don't have access to the replicated repository of back/restore products, and modifying VM on the production site is not acceptable as a solution.

The following sentence from the Zerto article triggered me to ask a question here.

"The deployment package is attached to the recovery VM.
The result is that the deployment package has a unique name, and it can be seen at the VM Configuration section in the MOB. The package is located within the VM datastore at the same location as the VMDK."

From that sentence, I understand (and wanted to believe) that Zerto explored VMware's capability to execute the file that Zerto saved on the VMware datastore in the same folder as the VMDK file, is triggered by VMware tools (without injecting the file into OS), and this concept is all part of the VMware solution.

On the windows server, the VMware tools service is executed under the "Local System account" so it should be enough privileges to do changes in Windows OS including re-ip without supplying credentials.

Anyway, thanks for your suggestions.

[LucD]

If you ever find the details of that process, and if it confirms your assumption, I would be very interested in learning the details.

[prusacv]

This is a deal, if I find any new information I will share it. Also, I would like to ask you if you know if anyone from VMware (support or community) can confirm that injecting a customized script for re-IP is what they do in VMware Site Recovery Manager.

[LucD]

I'm afraid I don't.
Perhaps ask your TAM for a contact.