Virtual Geek

By default PowerShell scripts ps1 extension files are restricted to execute on windows system (For windows 2016 it is by default remotesigned), Generally whenever you run ps1 file you will see below error on Powershell console. This is not the authentication issue instead no one can execute ps1 files even administrator. To run script first need to make changes on OS, even if there is single line in the ps1 script file. For this article I will be using basic program line "Hello world!"

PS C:\> .\Script.ps1
.\Script.ps1 : File C:\Script.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\Script.ps1
+ ~~~~~~~~~~~~
    + CategoryInfo          : SecurityError: (:) [], PSSecurityException
    + FullyQualifiedErrorId : UnauthorizedAccess

Powershell script file extention is ps1. to execute it change the prompt with CD command to the folder where script is stored and . dot source it while running or give complete path as shown below. It will fail by default. 

The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose you to the security risks described in the about_Execution_Policies help topic at http://go.microsoft.com/fwlink/?LinkID=135170. Below policies list exists.

To view current execution policy check with command Get-ExecutionPolicy. By default result will be Restricted if no previous changes. After changing policy with command Set-ExecutionPolicy Unrestricted, press enter twice to accept yes. Choose appropriate one of the policy as per your environment hardening policy. Unrestricted is not recommended. As per below screenshot, script is executed successfully.

Set-ExecutionPolicy : Access to the registry key
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell' is denied. To change the execution policy for the default (LocalMachine) scope, start Windows PowerShell with the "Run as administrator" option. To change the execution policy for the current user, run "Set-ExecutionPolicy -Scope CurrentUser".
At line:1 char:1
+ Set-ExecutionPolicy Unrestricted
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (:) [Set-ExecutionPolicy], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand

To run Set-Executionpolicy unrestricted cmdlet administrator rights are required. If admin rights (Run as Administrator) not preset it shows access denied error. But still non administrators can bypass below error using command Set-ExecutionPolicy -Scope CurrentUser Unrestricted. It work without admin rights and changes are applicable to the current logged in user only. 

In the Background it is modifying registry key value data of HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\ExecutionPolicy. This requires non administrator rights. But editing localmachine scope or HKEY_Local_Machine requires Administrator rights.

This is another way I use a lot to run ps1 scripts in complete restricted environments. I can perform same from cmd (command prompt) as well.

1) Once PowerShell is lanuched, by default execution policy is restricted and script cann't be run,
2 & 3) Using Powershell -executionpolicy unrestricted, I have lifted restrictions. and I am into nested powershell mode (Powershell inside powershell).
4) I verified running script that I can run script.
5) Nested Powershell is exited using command Exit.
6 & 7) If you don't want nested console and run file directly, you can run one liner command Powershell -executionpolicy unrestricted -file 'c:\script.ps1', It will provide the result and close the unrestricted powershell session.
8) Powershell is still in restricted execution node.

This is another best way and doesn't require any special requirement. Copy content from ps1 file and paste on PowerShell directly. Or copy paste code in function script { code here }. Using function you will get more control, and run it whenever you want without need to copy paste, just need to run function command name as shown below. it can also be stored in powershell profiles if you run same script file frequently.

I found below is best way to bypass powershell execution policy but using infrequently and no need to open file in notepad by running cat c:\script.ps1 | Invoke-expression. The Invoke-Expression cmdlet evaluates or runs a specified string as a command and returns the results of the expression or command. Without Invoke-Expression, a string submitted at the command line would be returned (echoed) unchanged.

Last way in this article, Copy paste ps1 file content commands inside curly braces {} and use & and operator (also alias to invoke-expression/iex) to run it.

By default NTP - Network time protocol service is disabled on esxi server. ESXi servers always should be configured with NTP for below reasons.

Logs: Very first good reason is logs (events, /var/log). If your Esxi is not synchronized with Time server correctly, Details in logs will show incorrect dates and there will be hard time in finding or troubleshooting issues.
Snapshot creation: If your environment (mostly in test and development) is highly dependent on snapshots, Snapshot creation and resuming might have wrong time.
Virtual Machine startup and restart, Incorrect time will show in absence of NTP.
vMotion: In some environments virtual machine might take or sync timing from Esxi server directly using VMWare tools. While VM migration from esxi server to another esxi, if NTP is not configured, VM OS will pickup wrong time or may be out of sync.

VMWare Powercli: Time Configuration (NTP - Network Time Protocol) on multiple Esxi server

Timekeeping is a best practice in every environment. To enable and configure NTP services, on the esxi server, click Configure tab, from the left hand pane expand system select Time Configuration click Edit.

On the popup box select Use Network Time Protocol (Enable NTP client), Start service under NTP service status, and add NTP Servers. as inset screenshot you will see Time configuration is changed.

In case of NTP client is disabled, It can be enabled under security profile, firewall edit, check the NTP client status, This setting is not required as it is by default enabled in firewall.

Although I had written this script around 4 years back I have again revised it to work it in more better way with status report on console. I used this script again after long time to change/update DNS ip addresses on remote Windows servers, after introducing my new upgraded DNS servers. Same task I performed but this time  to replace DNS ips on an average 6000 remote windows servers. As it can be seen in below screenshot, There are 2 Nics In my environment, on all the server and I wanted to change DNS IPs on physical adapter with name Ethernet only. 

If you check on windows 2012 and above server OS, physical network adapter is named as Ethernet by default, unless it is modified.

Copy script in the Set-DnsIP.ps1 file, I have kept file on root c:\ drive. Run Set-ExecutionPolicy Unrestricted, so ps1 scripts are allowed to execute. Next by running below command I will replace existing DNS IPs and it also verify it and shows result on console. For simplicity I am running this command directly from domain joined server logged in with domain admin username and password, So there is no requirement to mention credentials.
.\Set-DnsIP.ps1 -Name DSC01 -NetworkName Ethernet -DnsIPs @('192.168.33.5','192.168.33.6')

PARAMETERS
-Name = Put computername here
-NetworkName = Type network physical adapter name here which is found under network connections, in most of the cases it will named as Ethernet.
-DnsIP = here you can put multiple ip in array with @()
-Protocol = This is optional and Dcom (Remote procedure call - RPC) or WSman (Windows Powershell remoting need to be enabled) can be used here. By default it connects using Dcom and does not require any special configuration.
-Credential = This is another optional parameter and here you can add credentials to connect remotely or locally.

Another way of performing same task on multiple system, Here in below example I am fetching computer names from active directory domain controller and updating IP on those servers with foreach loop.

Get-ADComputer -Filter * | foreach {.\Set-DNSIP -Name $_.Name -NetworkName Ethernet -DnsIPs 192.168.33.11}

In the last if you have list of servers in plain text file replace Get-Adcomputer -filter * with cat filename.txt. This script is based and built using CIM cmdlets.

to use different username and password credentials than the logged in user, use parameter -credential, it will popup for username and password.
.\Set-DnsIP.ps1 -Name DSC01 -NetworkName Ethernet -DnsIPs @('192.168.33.5','192.168.33.6') -Credential

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

#requires -version 3
<#
.SYNOPSIS
    Set or change DNS IP address in network adapter.
.DESCRIPTION
    The Set-DnsIP cmdlet changes DNS IP addresses of a local or remote etherenet card on windows. It requires parameternames computername, Ethernet Name, DNS IP addresses. This cmdlet uses CIM and WMI (DCom and winrm) protocol to connect remote computer. 
.PARAMETER Name
    Prompts you for local or remote computer hostname, Computername parameter is an alias, This value can be taken from pipline by property name.
.PARAMETER NetworkName
    This is physical network adapter name on the windows server or desktop, By default 2012 and above windows OS network name is Ethernet.
.PARAMETER DnsIPs
    This sets DNS Ip addresses, multiple DNS servers can be provided with this parameters.
.PARAMETER Protocol
    There are two protocols can be used while connecting to remote computer, first is DCOM which is default and need not to mention, Default will work in all scenario. Another protocol is WSman require PS remoting need to be enabled. 
.INPUTS
    No Input
.OUTPUTS
    Output is on console directly.
.NOTES
  Version:        2.0
  Author:         Kunal Udapi
  Creation Date:  12 February 2017
  Purpose/Change: Update to my existing script buit on 1 June 2013 (http://kunaludapi.blogspot.in/2013/06/change-dns-ip-address-remotely-on.html)
  Useful URLs: http://vcloud-lab.com/entries/powershell/powershell-ps-remoting-between-standalone-workgroup-computers
.EXAMPLE 1
    PS C:\>Set-DNSIP -Name MyServer01 -NetworkName Ethernet -DnsIPs @('192.168.33.5', '192.168.33.6')

    This command sets DNS ips on computername 'MyServer01'. Physical Adapter name is 'Ethernet'. IP addresses can be mentioned in arrays.
.Example 2
    Get-ADComputer -Filter * | ForEach-Object {Set-DNSIP -Name $_.Name -NetworkName Ethernet -DnsIPs 192.168.33.11}

    Here computer names are pulled from active directory computers. Process further with Foreach-Object loop.
.EXAMPLE 3
    PS C:\>Set-DNSIP -Name MyServer01 -NetworkName Ethernet -DnsIPs 192.168.33.11 -Protocol Wsman

    With optional parameter name 'Protocol', DCom and WSMan protocol can be used, Dcom is default protocol and works in every scenario, for WSman Ps remoting need to be enabled and check notes help section for more information.
#>

[CmdletBinding(SupportsShouldProcess=$True,
    ConfirmImpact='Medium',
    HelpURI='http://vcloud-lab.com')]
Param
(
    [parameter(Position=0, Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
    [alias('ComputerName')]
    [String]$Name = 'Localhost',
    [parameter(Position=1, Mandatory=$true,ValueFromPipelineByPropertyName=$true)]
    [alias('LAN', 'EthernetName')]
    [String]$NetworkName = 'EtherNet',
    [parameter(Position=2, Mandatory=$true, 
        ValueFromPipeline=$true)]
    [array]$DnsIPs = @('192.168.33.5','192.168.33.6'),
    [parameter(Position=3, Mandatory=$false)]
    [ValidateSet('Dcom','Default','Wsman')]
    [String]$Protocol = 'Dcom',
    [Switch]$Credential
)
Begin {
    $CimSessionOptions = New-CimSessionOption -Protocol $Protocol
    $Query = "Select * from  Win32_NetworkAdapter" #Where NetConnectionID='$NetworkName'"

    if (-not(Test-Connection -ComputerName $Name -Count 2 -Quiet)) {
        Write-Host -BackgroundColor DarkYellow ([char]8734) -NoNewline
        Write-Host " $Name is not reachable but still trying to connect...."
        #Break
    }
    else {
        Write-Host -BackgroundColor DarkGreen ([char]8730) -NoNewline
        Write-Host " $Name is reachable connecting...."
    }
}
Process {
    try {
        if ($Credential.IsPresent -eq $false) {
            $Cimsession = New-CimSession -Name $Name -ComputerName $Name -SessionOption $CimSessionOptions -ErrorAction Stop
        }
        else {
            $Cred = Get-Credential -Message 'Type Your credentials to connect remotely' -UserName (WhoAmI)
            $Cimsession = New-CimSession -Name $Name -ComputerName $Name -SessionOption $CimSessionOptions -Credential $Cred -ErrorAction Stop
        }
        $AllNICs = Get-CimInstance -Namespace 'root/CIMv2' -Query $Query -CimSession $Cimsession
        if ($AllNICs.NetConnectionID -contains $NetworkName) {
            $Nic = $AllNICs | Where-Object {$_.NetConnectionID -eq $NetworkName}
            $NICConf = Get-CimAssociatedInstance -InputObject $NIC -ResultClass Win32_NetworkAdapterConfiguration -CimSession $Cimsession
            $NICConfituraion = $NICConf | Invoke-CimMethod -MethodName SetDNSServerSearchOrder -Arguments @{DNSServerSearchOrder = $DnsIPs}
            $NICConf = Get-CimAssociatedInstance -InputObject $NIC -ResultClass Win32_NetworkAdapterConfiguration -CimSession $Cimsession
            $errorcode = $NICConfituraion.ReturnValue
        }
        else {
            Write-Host -BackgroundColor DarkRed ([char]215) -NoNewline
            Write-Host " Connected to $Name successfully but no NIC found with name $NetworkName"
        }
    }
    catch {
        Write-Host -BackgroundColor DarkRed ([char]215) -NoNewline
        Write-Host " DNS IP on $Name did not changed, check manually." 
        $errorcode = -1
    }
}
end{
    switch ($errorcode) { 
        -1 {Write-host -NoNewline ''}
        0 {Write-Host -BackgroundColor DarkGreen ([char]8730) -NoNewline; " Successful completion, no reboot required, New DNS IPs are $($NICConf.DNSServerSearchOrder -join ', ')"; break}
        1 {'Successful completion, reboot required'; break}
        64 {'Method not supported on this platform'; break}
        65 {'Unknown failure'; break}
        66 {'Invalid subnet mask'; break}
        67 {'An error occurred while processing an Instance that was returned'; break}
        68 {'Invalid input parameter'; break}
        69 {'More than 5 gateways specified'; break}
        70 {'Invalid IP address'; break}
        71 {'Invalid gateway IP address'; break}
        72 {'An error occurred while accessing the Registry for the requested information'; break}
        73 {'Invalid domain name'; break}
        74 {'Invalid host name'; break}
        75 {'No primary/secondary WINS server defined'; break}
        76 {'Invalid file'; break}
        77 {'Invalid system path'; break}
        78 {'File copy failed'; break}
        79 {'Invalid security parameter'; break}
        80 {'Unable to configure TCP/IP service'; break}
        81 {'Unable to configure DHCP service'; break}
        82 {'Unable to renew DHCP lease'; break}
        83 {'Unable to release DHCP lease'; break}
        84 {'IP not enabled on adapter'; break}
        85 {'IPX not enabled on adapter'; break}
        86 {'Frame/network number bounds error'; break}
        87 {'Invalid frame type'; break}
        88 {'Invalid network number'; break}
        89 {'Duplicate network number'; break}
        90 {'Parameter out of bounds'; break}
        91 {'Access denied'; break}
        92 {'Out of memory'; break}
        93 {'Already exists'; break}
        94 {'Path, file or object not found'; break}
        95 {'Unable to notify service'; break}
        96 {'Unable to notify DNS service'; break}
        97 {'Interface not configurable'; break}
        98 {'Not all DHCP leases could be released/renewed'; break}
        100 {'DHCP not enabled on adapter'; break}
        default {'Other - Error code 101–4294967295'; break}
    }
}

Logging into SSH required in some of the common troubleshooting scenario or fetching information: ie  checking logs, telnet, ping, esxtop etc, Although subject title of this blog is mentioned Powercli, but I am showing all ways to enable SSH service on esxi including GUI as well, By default SSH server service is disabled on ESXi, VMware recommends the same for security best practices reason. For more on Esxi hardening follow this official guides. Whenever you need to login into Esxi directly through SSH (putty), this service (daemon) can be enabled using one of the method VMWare web client. 

Select Esxi server, go to Configure tab on the right side, collapse System and click Security Profile, here all required services are listed, SSH is is stopped. Press Edit button, 

In Edit Security Profile, select SSH daemon, service name from the list, down below expand Service Details, under status click Start button, and status will change to running. below screenshot is after starting service. Same procedure is used to stop it. Three types of startup policy exist.

Start and stop with host: If service is running it will start automatically once host is restarted. Same with if service is stopped, service status will persist with ESXi reboot.
Start and stop manually: This is self explanatory. service need to manually start or stop depending on status, Once Esxi is rebooted, service will be stopped. 
Start and stop with port usage: Start automatically if any ports are open, and stop when all ports are closed

Port status can be checked using withing Esxi firewall itself, make sure SSH port number 22 is open (by default it is open), If you are not able to putty also check physical firewall. Under Secure shell there are 2 option SSH server and SSH client. Server is esxi and used to connect. Client is once logged onto esxi you can use it as client to connect remote servers.

Next open putty and login to server and test server.

In this next tutorial I am using VMWare Powercli for starting and stopping SSH server, for Configuring and installing Powercli check my previous article VMWARE VSPHERE POWERCLI INSTALLATION AND CONFIGURATION STEP BY STEP. 

Once logged onto vcenter or esxi successfully. I will check the the status of TSM-SSH service on Esxi Server, In my case it is not running and says false.
Get-VMHostService -VMHost esxi001.vcloud-lab.com | Where-Object {$_.Key -eq 'TSM-SSH'}

To start it use this one-liner powercli command.
Get-VMHostService -VMHost esxi001.vcloud-lab.com | Where-Object {$_.Key -eq 'TSM-SSH'} | Start-VMHostService -Confirm:$false

It is my daily task to login to esxi for troubleshooting or getting information, and each time I don't want to run above long one liner commands, Instead for my preference I have created below functions and copied it in powershell profiles. Profiles are startup script, whenever you open new powershell console by default it will execute those profile script and save in console memory. Run command $PROFILE to know the the profile file path. For ISE this path is different. 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

function Start-SSHService {  
   [CmdletBinding()]  
  #####################################   
  ## http://vcloud-lab.com
  ## Version: 1   
  ## Tested this script on successfully  
  ## 1) Powershell v3   
  ## 2) Windows 7
  ## 3) vSphere 5.5 (vcenter, esxi, powercli)
  #####################################   
  Param (  
     [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true, Position=0)]  
     [ValidateNotNullOrEmpty()]  
     [Alias("Name")]  
     [string]$VMHost  
   )  
   begin {}  
   Process {  
     $AllServices = Get-VMHostService -VMHost $VMHost   
     $SShService = $AllServices | Where-Object {$_.Key -eq 'TSM-SSH'}   
     if ($SShService.running -eq $false) {  
       $SShService | Start-VMHostService -confirm:$false  
     }  
     else {  
       Write-Host -BackgroundColor DarkGreen -Object "SSH service on $VMHost is already running"  
     }  
   }  
   end {}  
 }  

function Stop-SSHService {  
  #####################################    
  ## http://vcloud-lab.com   
  ## Version: 1    
  ## Tested this script on successfully   
  ## 1) Powershell v3    
  ## 2) Windows 7  
  ## 3) vSphere 5.5 (vcenter, esxi, powercli)  
  #####################################   
   [CmdletBinding()]  
   Param (  
     [Parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true, Position=0)]  
     [ValidateNotNullOrEmpty()]  
     [Alias("Name")]  
     [string]$VMHost  
   )  
   begin {}  
   Process {  
     $AllServices = Get-VMHostService -vmhost $VMHost   
     $SShService = $AllServices | Where-Object {$_.Key -eq 'TSM-SSH'}   
     if ($SShService.running -eq $true) {  
       $SShService | Stop-VMHostService -confirm:$false  
     }  
     else {  
       Write-Host -BackgroundColor darkGreen -Object "SSH service on $VMHost is already stopped"  
     }  
   }  
   end {}  
 }  

Once Profiles are loaded or opened powershell, I can simply run below oneliner smaller commands to do their jobs.
Start-SSHService -VMHost Esxi001.vcloud-lab.com               #To start service
Stop-SSHService  -VMHost Esxi001.vcloud-lab.com               #To stop service

This is third technique you can use to enable or disable SSH service as well as esxi shell. Login to DCUI (Direct console user interface), This is accessible when in front of the server physically or through medium of remote console ie Dell Rac., log in into pressing F2 button.

Scroll to Troubleshooting Options, go to enable SSH hit enter to change it, It will either enable or disable according to current state.