mamoth100's Posts

Well, I gave the code a shot It seems as though when the PS Object is passed to the job it only pulls from the last logged into server even though multiple vCenters are connected and the $global:DefaultVIServers shows all of them. Once passed to the job, the job only pulls data from the last vCenter connected to. Weird.

I think I solved it by parsing the array that is passed to the job $code = {      param (           [array]$arrServer,           [array]$arrSessionId      )      Set-PowerCLIConfiguration -DisplayDeprecationWarnings $false -Confirm:$false | Out-Null      $intCount = 0      foreach ($strServer in $arrServer)      {           Connect-VIServer -Server $strServer -Session $arrSessionId[$intCount] | Out-Null           $intCount++      }      (Get-VM).Count } $sJOb = @{      ScriptBlock  = $code      ArgumentList = $global:DefaultVIServers.Name, $global:DefaultVIServers.SessionId } Start-Job @sJOb Seems messy and not reliable since the SessionID may or may not be in the right order. Although, the way it is, it does work for either single entries or multiple entries. I'm just not 100% that the SessionID will always be in the same order as the vCenter servers list so they match up.

Is there a simple way to pass mutliple vCenters to a job? Using: $global:DefaultVIServers.Name and $global:DefaultVIServers.SessionId Seems like no matter how I pass those to the Job, it just doesn't reconnect like it does if it's a single vCenter (I even tried to force them to a string and connect)

This issue being, that isn't what I'm trying to do. The VM in vCenter is deleted. So, it's no longer there. When you delete a VM from vCenter, SRM sees the delete and says "Invalid. The VM has been removed". So, I was looking for a way to remove that from SRM via PowerCLI. The unprotect option seems to require me to do a Get-VM. But the VM is gone. If I go into SRM, select the deleted VM, I can do a Remove Protection and that gets rid of that entry. No stopping the vCenter service. I was wondering how to do the same thing with PowerCLI.

Thank you LucD! Unfortunatly the VM object is removed from vCenter (completely deleted). So there isn’t a way to interact with the VM object like the script on that KB article states. Was hoping there was a way to remove the invalid object in SRM like you would do by selecting the object in SRM and clicking Remove Protection. Thing is, with PowerCLI, to remove protection or add protection it seems to require you to get the VM object from vCenter and then pipe it to the add or remove protection cmdlets/API. But since the VM is gone from vCenter, I don’t see a way to force a removal from SRM except to use the web interface to clear it.

I saw his script. But it just seemed overkill for what I wanted to do. I was hoping for an easier route than all that code. But if that’s what I have to do, I’ll do that. I will I’ll give the Move-VM a shot. That seems much easier. Thank you!

Thanks for the response LucD! Yep. All connections are through FQDN of the vCenter machines. I have 2 vCenters hooked via Enhanced Linked Mode (each having their own external PSC). All components are 6.5U2. Thanks!

It does appear I can force days into the CSR with openssl. openssl x509 -req -days 1094 -in /certs/psc_ha_vip.csr -out /certs/psc_ha_vip.crt -CA /var/lib/vmware/vmca/root.cer -CAkey /var/lib/vmware/vmca/privatekey.pem -extensions v3_req -CAcreateserial -extfile /certs/psc_ha_csr_cfg.cfg So I was able to get the PSC Machine Cert to less than 3 years. But vCenter will be the next hurdle as that will probably end up with a 5 year cert. I really wish there was a way to just tell VMCA to only issue 3 year certs.

Thanks Adam Eckerle and daphnissov ! I did see this for the hosts within vCenter after posting the thread. However, there doesn't seem to be a way to control this for the PSC Machine Cert nor the cert vCenter gets from the VMCA. Once we get down to vCenter... there do seem to be controls for the hosts. I'm wondering if it's possible to actually do it more so on the PSC Machine certificate and the vCenter cert that it gets from the PSC. I tried today. I got the internal CA cert chain done (which has a validity period of 5 years.. as we do not expect this solution to be around in 5 years) and loaded it into the VMCA. It was successful. During that load, it goes through and issues a Machine cert to that same PSC. The cert was issues for the same validity period as the VMCA cert. And due to regulations, we need the cert validity period to be 3 years or less on all devices. What I didn't want to have happen was the VMCA certs expire at the same time the PSC Machine certs and vCenter certs. Below is the cert... I know I had to black out the Issued By... but I can validate that it was indeed the VMCA. You can see it chucked it out to the PSC's Machine Cert as 5 years.