mbabu1 Tracker

Re: Authentication Services - Join domain for ESXi hosts

mbabu1 — Fri, 23 Jun 2023 20:56:11 GMT

Thanks, that's worked perfectly.

Many thanks wetnose...legend

Re: Authentication Services - Join domain for ESXi hosts

mbabu1 — Fri, 23 Jun 2023 15:47:29 GMT

Thanks LucD,

I will give the script a try and report back with feedback.

Another question, is there a script I can run against a vCenter to check all esxi authentication services settings and see what hosts are missing the domains.

Thanks

Re: Authentication Services - Join domain for ESXi hosts

mbabu1 — Fri, 23 Jun 2023 11:11:32 GMT

I have found the following from a search:

Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain "prod.cyberintegration.net/cis/computers/esxi" -Username myusername -Password "mypassword"

How can I edit the script to run against a host.csv file which has a list of all the hosts...?

Authentication Services - Join domain for ESXi hosts

mbabu1 — Fri, 23 Jun 2023 10:57:13 GMT

Hi LucD,

We have a few clusters where the hosts don't seem to have joined to a domain under authentication services.

Is there a script available where a it will join the domain by providing the domain, username and password.

At the moment we have over 100 hosts with this issue.

See attached picture of the settings.

Thanks in advance.

Re: Add existing Domain service account to ESXi and map to role and add to exception users list

mbabu1 — Fri, 23 Jun 2023 10:46:14 GMT

Hi LucD,

Worked like a dreammmmmmmmmmmmmmmmmm...!

Again thank you and god bless you

Re: Add existing Domain service account to ESXi and map to role and add to exception users list

mbabu1 — Thu, 15 Jun 2023 13:01:24 GMT

Thanks LucD,

Can you let me know which lines to edit/change, so I can test the script please. Unfortunately, I'm not a scripter and trying my best to learn.

Thanks

Add existing Domain service account to ESXi and map to role and add to exception users list

mbabu1 — Thu, 15 Jun 2023 12:36:22 GMT

Hi,

I have the below script which was kindly put together by LucD.

The current script creates a local account, creates the role, maps the account to the role and adds user to the lockdown exceptions.

The change I wish to make is instead of creating a local account, I want the script to get the domain account RAC\svc_test_01 and carry out the rest accordingly.

Please help, any help will be much appreciated.

$newUsers = "svc_test_lt01","svc_test_lt02"
$newPassword = "VMware1!"
$roleName = "test_Role"
$privileges = 'Authorization.ModifyPermissions', 'Host.Config.SystemManagement', 'Host.Local.ManageUserGroups'

Import-Csv "C:\Temp\Mo\hosts.csv" |
ForEach-Object -Process {
$srv = Connect-VIServer -Server $_.Hostname -User 'root' -Password 'Password01'
$priv = Get-VIPrivilege | Where-Object { $_.Id -in $privileges }

# If Role exists assign new privileges, else create Role
$role = Get-VIRole -Name $roleName -ErrorAction SilentlyContinue
if ($role) {
$role = Set-VIRole -Role $role -AddPrivilege $priv -Confirm:$false
} else {
$role = New-VIRole -Name $roleName -Privilege $priv -Server $srv -Confirm:$false
}

$accounts = @()
$newUSers | ForEach-Object -Process {
# If Account exists set new password, else create Account
$account = Get-VMHostAccount -Id $_ -ErrorAction SilentlyContinue
if ($account) {
$account = Set-VMHostAccount -UserAccount $account -Password $newPassword
} else {
$account = New-VMHostAccount -Id $_ -Password $newPassword -GrantShellAccess:$true `
-Description 'test User Access' -UserAccount -Server $srv
}
$accounts += $account

# If Permission exists set new Role, else create Permission
$folder = Get-Folder -Name "root" -Server $srv
$perm = Get-VIPermission -Entity $folder -Principal $_ -ErrorAction SilentlyContinue
if (!$perm) {
$perm = New-VIPermission -Entity $folder -Principal $_ -Role $role -Server $srv -Propagate $true -Confirm:$false
} else {
$perm = Set-VIPermission -Permission $perm -Role $role -Propagate $true
}
}

# Add users to lockdown exceptions
$esx = Get-VMHost
$accessMgr = Get-View $esx.ExtensionData.ConfigManager.HostAccessManager

$oldLockDownMode = $accessMgr.LockdownMode
if ($oldLockDownMode -ne [VMware.Vim.HostLockdownMode]::lockdownDisabled) {
$accessMgr.ChangeLockdownMode([VMware.Vim.HostLockdownMode]::lockdownDisabled)
}

$accessMgr.UpdateLockdownExceptions($accounts)

if ($oldLockDownMode -ne [VMware.Vim.HostLockdownMode]::lockdownDisabled) {
$accessMgr.ChangeLockdownMode($oldLockDownMode)
}

Disconnect-VIServer -Server $srv -Confirm:$false
}

Re: All multiple privileges fao LucD

mbabu1 — Wed, 10 May 2023 18:33:22 GMT

Thanks LucD,

What do I need to do to achieve the following in the script:

The requirement for one of the environments is to add domain\username as per the attachment and I have done this manually via right click manage ---> permissions... Add user and select the role. So like to amend the script to do this.

Thanks

Re: All multiple privileges fao LucD

mbabu1 — Wed, 10 May 2023 16:44:30 GMT

Thanks LucD,

If i try to add a domain\username via security & users --> users --> add user I get the error 'Invalid characters found in user name. Please use only alpha-numeric characters. As discussed previously.

I hope that helps.

Please advise thanks

Many Thanks

Re: All multiple privileges fao LucD

mbabu1 — Wed, 10 May 2023 15:58:15 GMT

Hi LucD,

Quick question, is there a way to edit the script add a user via right click manage host > select permission and add the user domain\username and map to the role create earlier.

Pics attached for your reference.

Thanks in advance.

Re: New Domain user account Error

mbabu1 — Tue, 09 May 2023 16:49:50 GMT

Hi LucD,

I agree, as usual you have answered all my questions.

Thank you again LucD......!

Re: New Domain user account Error

mbabu1 — Tue, 09 May 2023 15:53:35 GMT

Hi LucD,

I have tried manually and I get the error 'Invalid characters found in user name. Please use only alpha-numeric characters.'

Re: New Domain user account Error

mbabu1 — Tue, 09 May 2023 11:39:43 GMT

HI LucD,

Yep, see attached. I have erased names of domains for security purposes.

Re: New Domain user account Error

mbabu1 — Tue, 09 May 2023 11:25:22 GMT

Hi LucD,

Yep, previous post is all correct and answered.

All hosts are added to the domain and added to the vcenter using FQDN.

Re: New Domain user account Error

mbabu1 — Tue, 09 May 2023 11:04:14 GMT

Error:

Create User
Key
haTask-ha-folder-root-vim.host.LocalAccountManager.createUser-3465430431

Description
Creates a local user account

Folder:
State
Failed - A specified parameter was not correct: id

Errors

New Domain user account Error

mbabu1 — Tue, 09 May 2023 10:48:53 GMT

Hi LucD,

As discussed in the previous post I have used a complex password and tried \ and @ and get the attached error.

Please advice.

Many Thanks

Re: All multiple privileges fao LucD

mbabu1 — Tue, 09 May 2023 09:53:03 GMT

Thanks LucD,

I have used a complex password and tried '\' and '@' and get the attached error.

Create User
Key
haTask-ha-folder-root-vim.host.LocalAccountManager.createUser-3465424481

Description
Creates a local user account

Folder:
State
Failed - A specified parameter was not correct: id

Errors

Please advise.

Thanks in Advance.

Re: All multiple privileges fao LucD

mbabu1 — Mon, 08 May 2023 21:02:02 GMT

Works like a dreammmmmmmm....!!!!

Thank you for all your help and answering all my queries.

One last question, some of our environments require the domainname\username e.g. (Prod\testuser01). The script returns an error 'user name or password has an invalid format'. But I can manually add the user with the domain in front successfully.

Is a parameter/variable required to the script to allow this.

Thanks

Re: All multiple privileges fao LucD

mbabu1 — Mon, 08 May 2023 19:25:10 GMT

Thanks LucD....GENIUS..!

That works perfectly, disabled the hosts within the cluster. What do I need to change to enable lockdown (Normal).

Thanks in advance

Re: All multiple privileges fao LucD

mbabu1 — Mon, 08 May 2023 19:05:41 GMT

Thanks LucD,

Sorry, where do i put the vcenter, username and password details. Still learning to script...apologies.

Thanks