Powershell Add or Remove members from Remote Group Module

To show this demo I am using 2 computers, one is Windows 2012 R2 (192.168.33.11) and another is windows 7 (192.168.33.16), From Windows 2012 R2 I will be executing all the commands remotely on 192.168.33.16. Both the commands use ADSI API to do the Addition or removal task., To know more example use Get-Help CMDLET -full to know more information. 

Why I wrote this article or script?
Earlier I written article on how to add users to group using Group Policy, It is not easy if you want to add users or group certain computers, you can do that through creating OU. But again inventory thing is not possible using it.

Remove-GroupMember
In earlier article I showed how to get information remotely using Get-GroupMembers cmdlet. I showed some cool csv file containing the data.

Lets say now we have data, Next what you want to Remove them Remotely. This Remove-GroupMember cmdlet is handy. To show the demo I will be removing vcloud\Devil user from "Remote Desktop Users" Group.

Simply in the powershell run below command. (To check how loaded module check my previous article Get-GroupMembers ).

Get-GroupMembers -ComputerName 192.168.33.16 -RemoteGroups "Remote Desktop Users"

vKunal is the user in vCloud Domain. (vcloud\vkunal)
Remove-GroupMember -ComputerName 192.168.33.16 -RemoteGroup "Remote Desktop Users" -Domain vcloud -User vkunal

(Tip: You can run Get-Help Remove-GroupMember,  To know on additian help.)

It detect if machine is not reachable, and will not go checking the server, even if some parameters are incorrect it will show message. you can verify Group members using Get-GroupMembers again.

Download Module

Add-GroupMember
As Remove-GroupMember is handy command to Remove member remotely, Add-GroupMember has its own magic. Many times we get request to add users or groups to multiple server's group. Earlier I removed vcloud\vkunal from remote Desktop users, Now I will be using vCloud\Devil user and Group vCloud\DemoGroup.

Here is the Demo.

Add-GroupMember -ComputerName 192.168.33.16 -RemoteGroup "Remote Desktop Users" -Domain vCloud -User Devil

Add-GroupMember -ComputerName 192.168.33.16 -RemoteGroup "Remote Desktop Users" -Domain vCloud -User DemoGroup

It may be possible that both 192.168.33.11 and 192.168.33.16 may not be in same domain, at that time you can use -Credential (Get-Crendential) parameter, These parameters can be used in all the cmdlet Add-GroupMember, Remove-GroupMember or Get-GroupMembers.

Next is verification using Get-GroupMembers. 2 Members are listed.

Download Module

Other usefull Scripts
Get members from Remote Groups

Add or Remove members from Remote Group

Change username/password configured on logon tab of Windows Service

List account configured on logon of Windows Service - Powershell

Powershell Module Get members from Remote Groups

Keeping servers compliant is very challenging task when it comes to maintaining Administrators group or other privileges on the servers, Many times we apply changes on the servers, assign admin rights by adding User accounts in local server Administrators group or any other Groups example Remote Desktop Group which we are not suppose to do, and forget. When auditing days comes we do repetitive manual task, log onto each server pull reports, validate, and goes on...

Many times user account groups are added through some change management process or ticketing tool, some time those tools doesn't help to track or list what those users permissions are on the servers, or when we can revoke them, Specially when you want to go for some company ISO certification this is one of the condition to comply with. (I might be talking some high level stuff regarding compliance but I have seen people struggling with these small stuffs, and spent long time to nailed it but still end of the day some servers are still missing or due to human mistake)

Here PowerShell comes to rescue. I have written a simple module which can collect information whats members (users or Groups) are in Administrators Group on Remote Server, or any other group, Under the hood it uses WMI to get information. for addition and removal it uses ADSI., You can keep complete lifecycle of Group membership with this module.

Download Module

This module can be downloaded from here. I am using Windows 2012 R2 and windows 7 and 8.1 in my production, and written these scripts using Powershell version 4. To use commands Add-GroupMember and Remove-GroupMember this is the Article Powershell add or remove-members from Remote Group.


There are two files in the zip file, unzip them and keep it under your %Userprofile%\documents\WindowsPowerShell\Modules\GroupMembers as shown in the screenshot.

Open Powershell with Run as administrator, By default I was not able to execute any script, so to change the behavior I set my script execution mode to bypass using below command (You can ignore if you can already execute script)

Set-ExecutionPolicy Bypass

Next is Import-Module GroupMembers, it will load 3 commands in the powershell memory.

3 Cmdlets are

1. Get-GroupMembers
2. Add-GroupMember
3. Remove-GroupMember

(Tip: Even if you don't import module, when you execute any of above command, it will automatically, load module in Powershell 4 and above version.)

First demo I will be showing for command Get-GroupMember, it uses WMI to get all the information.

Get-GroupMembers -ComputerName 192.168.33.16, 192.168.33.17 -RemoteGroups Administrators, "Remote Desktop Users", Below is the results how they look.

Now in the below demo I will get information from AD computers and export it to CSV/Excel file. Also I have created log file for failed computers.

Get-ADComputer -Filter * | Get-GroupMembers -RemoteGroups Administrators -Logfile c:\temp\failed.txt | export-csv c:\temp\Mylist.csv

There are 2 files created under c:\temp, failed.exe contains, unable to get results, and mylist.csv file has the data.

Download Module

In the next article I will be writing how to use Add-GroupMember and Remove-GroupMember commands.

Other useful Scripts

List account configuredon logon of Windows Service - Powershell

Change username/password configured on logon tab of Windows Service

Powercli Get-Esxcli install VIB files

In my earlier blog Using Powercli to copy files from your computer to Esxi server I successfully able to install vib file using plink.exe tool but not through Powercli Get-Esxcli command. after lots of trial and error I have came to conclusion to install plain VIB you will have to use offline bundle only (If anyone knows the solution suggestions are welcome). I have downloaded offline bundle for Esxi web as a zip file and copied it on datastore.

Read my earlier blog for Using Powercli to copy files from your computer to Esxi server

Next is uninstalled the already installed software, I will be removing it using SSH again, my command is kept under c:\temp\command.txt and it contains line
esxcli software vib remove -n esx-ui

Next on the powershell console using plink tool i have executed command.txt on esxi server.
Write-Output "yes" |  plink.exe -ssh root@192.168.33.21 -P 22 -pw Computer@1 -m 'c:\temp\command.txt'

It has given me message operation finished successfully and VIB is removed.

Now we will need to create a esxcli connection to server over powercli.  

$esx =  Get-VMHost 192.168.33.21 | Get-EsxCli

all the session details will be saved in $esx. which can be used later against the connected esxi server.

$esxcli.software.vib.install("/vmfs/volumes/datastore1/esxui-offline-bundle-3023372.zip",$false,$true,$true,$true,$false,$null,$null, $null)

Above command is to install the offline bundle. make sure you are maintaining character caps and small letter while providing offline bundle path. You will get successful message on the server and it will require reboot.

Once i reboot the server and create I connected to esxi server again running connect-viserver, and Created connection to vmhost using esxcli and session is stored in $esx (to verify software is in the list and correctly installed).
$esx.software.vib.list() | ft

Although there is another command to install esxi offline bundle using Install-VMHostPatch, its fairly easy.

Using Powercli to copy files from your computer to Esxi server

My next article: Powercli Get-Esxcli install VIB files
 
This step by step guide on coping files using Powercli, for this you will have to install powercli on you computer. Open powercli.

 

Next fire up command connect-viserver to connect your esxi or vCenter, think it as, you are connecting through vsphere client GUI, It will ask for credentials (I am connected here to my esxi directly.)

Then next you will see powercli is connected to esxi server. Now we will be coping file on the datastore, All the datastores are listed under vmstore: or vmstores: drive (This is a drive letter for esxi datastores, think it as your c: or any other drive), to go to datastore directory type

cd vmstore:\ha-datacenter\datastore1

I have only one local datastore on my esxi server and name is Datastore1, To view the list of all datastores you can run command Get-Datastore. I have created new directory, as you can see that is visible on GUI as well.

I have downloaded vib file and kept it on my computer under c:\temp (this is my favorite location to keep my testing stuffs)

Next command I am mounting datastore1 as a mapped drive on powercli, it will be visible on the same only., and my mapped datastore drive volume is vDATA. (also this step is not require but i am showing you it as an extra one, always good to have multiple tricks in your memory, to copy files you will need to use special command which I will be showing next, you can also use vmware drive vmstore: as it is already mapped incase if you want to skip below command)
Get-Datastore datastore1 | New-DatastoreDrive -Name vDATA

I am into datastore now by running command cd vDATA:\VIb, it will change the location of current drive.

Below is the special command to copy files to datastore and vice versa, your powershell native command copy-item will not work as windows and vmware both are different drive providers.

Copy-DatastoreItem -Item c:\Temp\esxui-3015331.vib -Destination vDATA:\VIB

and run dir to verify file has been copied, you can verify the same in GUI client also.

Now we have copied file we will be installing it, for the installation i will be using plink.exe tool, (I tried using Get-EsxCli to install this plain VIB file, tried all the possible parameters but every time it failed, if anyone know the correct parameters or if anyone is successful, suggestions are welcome, Just to add I am able to successfully install offline bundles through Get-Esxcli command Powercli Get-Esxcli install VIB files). Plink.exe is putty tool and I will ssh into esxi, but it will be completely automated.
To use plink we will need to be enable SSH on the server. To enable run below command.
Get-VMHost 192.168.33.21 | Get-VMHostService | Where-Object {$_.Lable -eq 'SSH'} | Start-VMHostService
it will start ssh service on esxi.

 Next i created one text file on c:\temp and written one command. That command is actually going to be executed on esxi server, it will be completely automated. (If you check my earlier blogs, I have used plink tool heavily for the internal configuration which is not possible through GUI or Powercli example: Changing Motd banner and Download logs from esxi server where everything is completely automated through plink.exe) 

As below command is going to be run on esxi, make sure your folder name are proper in caps or small letters as esxi is case sensetive. File name is command.txt containing below command.
esxcli software vib install -v /vmfs/volumes/datastore1/VIb/esxu1-3015331.vib 

I have kept my plink file under c:\windows, this way I don't have to do extra configuration on environment variable, On my powercli console: 
Write-Output "yes" | plink.exe -ssh root@192.168.33.21 -P 22 -pw Computer@1 -m 'c:\temp\command.txt'

Once you execute command you will see message operation finished successfully, not reboot required no need to put server into maintenance mode for this software, and the name of vib which has been installed.

below step you can do earlier as well when you finished coping file, but I prefer in the last what if copied file is corrupted. Remove-PSDrive vDATA will unmap mapped datastore drive.

Vib file i installed was vmware host web client. you can find more on information on about this cool fling from vmware. https://blogs.vmware.com/vsphere/2015/08/introducing-vsphere-host-client-fling.html

Below is the summary from fling website for the ESXi Embedded host client.

Summary

This version of the ESXi Embedded Host Client is written purely in HTML and JavaScript, and is served directly from your ESXi host and should perform much better than any of the existing solutions. Please note that the Host Client cannot be used to manage vCenter. Currently, the client is in its development phase, but we are releasing this Fling to elicit early feedback from our users to help guide the development and user experience that we are creating. As such, the client is not fully featured and only implements a hand full of the most important features. Some of these include:

• VM operations (Power on, off, reset, suspend, etc).
• Creating a new VM, from scratch or from OVF/OVA (limited OVA support)
• Configuring NTP on a host
• Displaying summaries, events, tasks and notifications/alerts
• Providing a console to VMs
• Configuring host networking
• Configuring host advanced settings
• Configuring host services

We welcome any feedback and bug reports at this early stage. However, rather than reporting on missing features, we are very much interested in your thoughts on the layout, user experience, and performance of the host client.

Known Issues

• On ESXi hosts which are assigned a VMware vSphere Hypervisor license, all modification operations will fail silently. We are working on a solution to this issue.
• On ESXi hosts which have a sub-domain name with large, shared cookies a web console session may fail to initialize. A workaround is to clear cookies or run the host client in an incognito-type window.
• For ESXi 5.5U2 and prior, and ESXi 6.0 hosts upgraded from any 5.5U2 or prior version, you will get a 503 error returned after visiting https://<esxhost>/ui/. To resolve this issue, please remove the line starting with /ui from /etc/vmware/rhttpproxy/endpoints.conf and restart rhttpproxy with /etc/init.d/rhttpproxy restart
• For ESXi 5.5 hosts, in-browser consoles are not supported. Please use VMRC to access guest VM consoles.
• For ESXi 5.5U2 and prior hosts, you must ensure to append a trailing / (forward slash) to the URL after /ui. The URL must be https://<esxhost>/ui/
• For some Windows guests, send Ctrl-Alt-Del does not work.

Other
If you need an offline bundle of the VIB for use with VUM, you can download it here.

Configuring Microsoft iSCSI Target datastore on Esxi server and multipathing Step by Step

In Microsoft Windows 2012 and above there is cool role is introduced by Microsoft. Name of the role is iSCSI Target Server under File and Storage services. (Although there is same software provided by Microsoft earlier now they have given the same as role inbuilt in Server 2012, Earlier version iSCSI Target configuration), I used it to configure my Microsoft Clustering LAB, as it required shared storage. You can use Microsoft windows 2012 iSCSI Target is better substitute to freeNas or Openfiler.

Userful Script on reporting

vSphere Datastores inventory report powercli - Volume 2

What is iSCSI Target Server? 
This server provides Block level storage. iSCSI Target (Server) shares LUNs with initiators (Clients) using iSCSI protocol over TCP-IP Network. Shared block storage act as local disk to the OS.

In this article I will be using iscsi target to present Datastores to ESXi Servers with Multipathing. Here I have Esxi Servers with two dedicated network cards carrying only Storage traffic IP series 172.16.1.0/25. Both NIC cards are connected to separate switches and my iSCSI storage server has two Ethernet cards are connected to same Switch1 and switch2 respectively. This way I get redundancy if any one of my network card or any one of my switch fails still my traffic is flowing through another Path. In this Article I am going simulate the same thing.

As a start i want you to show how my Ethernet card IP address settings looks like. I have this configuration on my Windows iSCSI Target Server. There are 2 Ethernet cards and each terminated to its own switch. On the same switches my esxi server is connected.

On my esxi server I have completely separate virtual standard switch for Storage traffic. (Select esxi server from vcenter inventory, Select configuration tab, to Networking under hardware at left panel)

And this is my configuration for iSCSI-Storage 01 and 02 port group.  iSCSI-Storage01 has Active adapter  vmnic3  and others in unused (they will not be utilised) and vise versa setting on iSCSI-Storage02 portgroup. This is required to configure vmware multipathing.

Above was how my configuration on both iscsi target and esxi server looks, next I will be configuring iSCSI Target server from scratch. Open Server Manager, Click Manage at the right click top menu. And select Add roles and Features.

 Next 3 windows nothing to configure much click next trice

 Select checkmark iSCSI Target Server under File and storage Services, next is Feature nothing to configuration and click install after confirming the summary.

Once role is installed we will configure it.

On the server manager click File and storage Service on the right panel to configure further installed role.

 Select iSCSI and under task click New iSCSI Virtual Disk or click To create an iSCSI virtual disk, start the new iSCSI Virtual Disk Wizard.

Next provide the path where all the iSCSI virtual disks (vhdx) will be kept on servers local disk, Name the disk, it will suffix required extension vhdx automatically.

Next screen is what would be Lun size.  for size format I will be using vmware terminology.

Fixed Size -- Thick Provisioning

Dynamic Expanding -- Thin provisioning.

Differencing - Linked clone

Next Screen create a new iSCSI Target instance.

Name the target instance,  This is step where we will be adding esxi server IQN's I have added both esxi server's IQNs.

Where do you find those IQN's and what is IQN?
IQN is iSCSI qualified name it is same as something MAC address to NIC card, whenever Data is exchanged between iSCSI target and iSCSI initiator this IQN number is used as the identifier.

To find IQN on esxi server, go to Configuration tab of esxi server, select Storage Adapter from Hardware left panel, select iSCSI Software Adapter and you can copy past iSCSI name

 

Incase if are unable to fine iSCSI Software Adapter you will need to add it as show above and below screen will be pop up.

 Back to previous screen on windows. if you have found IQN number. Next screen has all the summary, start next.

It will take some time to fully create fixed virtual disk. an you will the result as one iSCSI target and attached disks, you can now add more disk you want. to the same target.

Here we are done with Windows server configuration and other all configuration is on Esxi server.
Go to iSCSI software adapter click Properties.

 On the Dynamic Discovery tab click and provide iSCSI server any of one IP, don't type all the IPs.

 Esxi will detect all the Target ports and they will be visible in the Static Discovery Port.

Next we need to configure Port binding in the Network Configuration tab click add and add both the iSCSI vmkernal and associated Physical adapter for both adapter do add bindings. (Above I had already make only one vmnic active to vmkernel port and others are in unused, without that step you will not see iscsi adapters in the binding or they will not be complient)

You should see something like this once you add both VMKernel port groups. Click close to rescan (refresh and discover luns presented for iSCSI target server)

Once rescan is completed you will see one LUN is visible right click it go to Managed Paths.

On the Managed Paths you will see there are 4 paths redundancy available. And path's status is active. 

Here I will simulate some real production scenario, what will happen if one of the physical switch is done. Lets pull the network cable from one of the ESXi Storage dedicated network card.

I pulled cable from vmnic3 and my 2 paths are dead and 2 paths are still available, Pretty cool haa....