I spoke about restarting some ESXi services when joining a domain in this post. Here’s how you might want to do it with PowerCLI. Firstly, you may need to modify the execution policy for PowerCLI. It’s worth checking out the Microsoft URL in the test here, as it’s very useful background on what you’re actually doing by setting this policy. Also, big thanks to my colleague Michael for coming up with the syntax here, he’s really the brains behind the operation.
PowerCLI C:\Windows\system32> Set-ExecutionPolicy RemoteSigned Execution Policy Change The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose you to the security risks described in the about_Execution_Policies help topic at http://go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy? [Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):
Then when you connect to your vCenter host, you’ll get warned about the certificate. This assumes that you’re not using the right certificates in your environment (why are you like this?).
PowerCLI C:\Windows\system32> Connect-VIServer 172.16.200.200 WARNING: There were one or more problems with the server certificate for the server 172.16.200.200:443: * The X509 chain could not be built up to the root certificate. * The certificate's CN name does not match the passed value. Certificate: [Subject] OID.1.2.840.113549.1.9.2="1382062929,d8ba9993,564d7761726520496e632e", CN=localhost.localdom, E=ssl-certificates@vmware.com, OU=VMware vCenter Server Certificate, O="VMware, Inc.", L=Palo Alto, S=California, C=US [Issuer] E=ssl-certificates@vmware.com, CN=localhost.localdom CA af1bb298, O="VMware, Inc.", L=Palo Alto, S=California, C=US [Serial Number] 01 [Not Before] 17/10/2013 12:22:09 PM [Not After] 16/10/2023 12:22:10 PM [Thumbprint] 4883C2F3DCD6E6F8693200E41BDE2A41A88C3930 The server certificate is not valid. WARNING: THE DEFAULT BEHAVIOR UPON INVALID SERVER CERTIFICATE WILL CHANGE IN A FUTURE RELEASE. To ensure scripts are not affected by the change, use Set-PowerCLIConfiguration to set a value for the InvalidCertificateAction option. Name Port User ---- ---- ---- 172.16.200.200 443 root
You can then get down to it. Firstly, you can join the domain with this command.
#To Join the domain: #get cred for joining the domain $cred=get-credential get-vmhost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "network.internal" -Credential $cred
Once you’ve done that, you might need to restart those services I spoke about at the end of a previous post.
#To restart these pesky services:
Get-VMHost | Get-VMHostService | ?{"lsassd","lwiod","netlogond" -contains $_.Key} | Restart-VMHostService
Once you’ve done that, you can check if it’s all working with this command.
#check to see if you have any auth issues get-vmhost | Get-VMHostAuthentication
And you should be good to go.