vCenter

I am having some issue deploying a VM from template with guest customization. I have not been able to find any answers on the web.

Here is my setup:

vSphere 5.1.0

Build 1064983

1) Create a VM (WIN2K8R2) based on Windows Server 2008 R2 with Administrator password as P@ssw0rd

2) Install VMware Tools
3) Activate Windows

4) Shutdown VM (WIN2K8R2)

5) Clone VM (WIN2K8R2) to a template (WIN2K8R2T1)

6) Deploy a VM (WIN2K8R2T1S1) from template (WIN2K8R2T1) with Guest Customization Spec

7) VM (WIN2K8R2T1S1) successfully created from template (WIN2K8R2T1)

- Issue is, if i don't set "Automatically Logon as Administrator" in the Guest Customization Spec, i cannot logon to windows.

- If I set "Automatically Logon as Administrator", the VM automatically logon, but if i log-off, i cannot logon

- If I set "Automatically Logon as Administrator", the VM somehow removes the "Administrator" password. And if I go to "Edit Local Users", i get option "Set New Password" for the Administrator user. Once I set a new password, then i can use the new password to logon.

- I also see that the Windows is no longer activated.

- If i specify domain credentials in the customization spec for the VM to be joined to a domain, it does not join it.

- it looks like the guest customization is not really working?

Any idea what is going on here? I have been able to reproduce this with Windows Server 2008 R2 and Windows Server 2012.

I think I am seeing the same thing in the same build.  Whatever the password is being set to by the customization wizard, its not the same as what I am setting in the specification.  Are you using the web client to deploy?  I have some success when using the full client to deploy.

Yes, it seems to be a bug with the web client.

It works fine with the windows client. I'm not sure if this has been reported to VMware.

wasted a lot of time thinking its a bad install or something. Thank you very much for testing this!

Not had much of a chance to test the various scenarios but yeah the Windows client seems to work best.  I am downloading 5.1 Update 1a at the moment, and will try that over the weekend.  Nothing obvious in the release notes though.

Ok, thank you! looking forward to your findings! let me see if i can get that build. Thanks again.

Do you see anything related in guestcust.log, setup-act, setuperr , debug logs ? Just trying to see if we  could get clues..

-JD

Nope.  Nothing. 

From guestcust.log:-

[2013-06-01T12:05:50 DEBUG] SysprepDecrypter has unobfuscated the password successfully

[2013-06-01T12:05:50  INFO] GuestCustUtil exiting.

From VMware-cust-nativeapp.log:-

[INFO] Decrypting password.

[INFO] Encrypted password is A6AE77B320674431C321E6F5A2B380DB7D17E1EC57EE8A4D2134E8D1FA20884D

[INFO] Successfully decrypted passwords.

[INFO] Encrypted password is A6AE77B320674431C321E6F5A2B380DB7D17E1EC57EE8A4D2134E8D1FA20884D

[INFO] Successfully decrypted passwords.

[INFO] Successfully unobfuscated the sysprep passwords.

[INFO] Exiting with code 0.

[INFO] Deallocating all acquired space.

[INFO] Destroying heap.

If I autologin as administrator, and then reset password using lusrmgr.msc I can use the VM.  If I don't chose autologin then I can not login as administrator. 

Tired the latest build of vCenter and still the same.

yup - sounds like the same issue that i am having.

yes - after you change the administrator password, you can logon to windows.

if you try to join the vm to a domain from template, that fails as well - from the web client. domain joining works fine with the windows client.

The issue, as I have found it started with the Web Client and I am a little surprised it is still an issue in vSphere 5.1 Update 1 as it is such an annoying issue.  The problem as I see it is in the process of creating a Customization Specification using the Web Client and storing the Administrator password and the the account to attach the system to the domain.

I have found that if you create a NEW customization specification using the Windows client, you can then deploy a template using the customization specification from either the Windows client or Web Client without any issues.  You cannot "fix" a specification by editing it in the Windows client and re-entering the passwords.  My guess is there is a bug in the encryption process when saving the specification or the decryption process when using the web client for the passwords.

I have never opened a direct call with VMware on the issue as I have found this work around.  I planned on mentioning it to the support folks at VMWorld this fall when I am out there.

This issue is covered under the following KB (http://kb.vmware.com/kb/2051755)

This has been addressed in vSphere 5.5 and is currently projected to also be included in vSphere 5.1u3.

As the KB states, if you're unable to upgrade to 5.5, a workaround is available:
To work around this issue when you cannot upgrade, use vSphere Client to create and edit a guest operating system customization specification. When the customization specification is created, you can use vSphere Web Client for customization.