Posts

Change ESXi Host Access Groups With PowerCLI

IT security, accountability and auditability are critical today. Securing vCenter Server using auditable identities, for instance via an Active Directory identity source, is likely common for most vCenter consumers. This ensures individual access can be used to audit actions back to an admin as well as provide higher security through strong password policies and the absence of a shared account credentials, such as the SSO administrator. Something that can be overlooked is the security of the ESXi hosts themselves.

Wednesday, November 4, 2020 | 2 minutes Read

SRM 8.3 Certificate Management

Following on from my last post on vSphere 7.0 certificate Management, I wanted to continue with another certificate related post. This one being Site Recovery Manager (SRM) 8.3. Like vSphere 7.0, this version seems simpler than previous versions I have used. With SRM, it’s the Appliance Certificate replacement that I am going to take you through in this blog post. Firstly log into the SRM appliance management console via https://<srm-fqdn>:5480 and select the ‘Certificates’ option on the left, followed by ‘Generate CSR’ in the top right.

vSphere
SRM

Wednesday, October 28, 2020 | 2 minutes Read

vSphere 7.0 Certificate Management

vCenter 7.0 brings many new features, one of which is a much smoother certificate management experience. There are now 4 main ‘modes’ for certificate management. These are; Fully Managed Mode, Hybrid Mode, Subordinate CA Mode and finally Full Custom Mode. There is a great article here from Bob Plankers explaining the difference between each. As mentioned in Bob’s blog, Hybrid Mode is the recommend option, and I will show you that process here in this blog.

vSphere

Tuesday, October 20, 2020 | 2 minutes Read

DFS NameSpace Issues - Migrating From FSR To DFSR Following AD Upgrade

I recently assisted a friend who had an issue with DFS Namespaces following an Active Directory Upgrade from 2008R2 to 2012R2. They were faced with not being able to access the NameSpace following the demotion of the last 2008R2 controller and promotion of the final 2012R2 controller. Upon opening the DFS NameSpace management console, the following error was displayed when selecting the required NameSpace - “The namespace cannot be queried. Element not found.”

Active-Directory

Tuesday, October 6, 2020 | 3 minutes Read

VM and vSAN Encryption

In this day an age, securing data is a must. In this post I’d like to show you two options for protecting your data; vSAN Encryption & VM Encryption. To achieve either of these you need to have connected a Key Management Server (or Cluster) to your vCenter server. Check out my previous post of how to do that - Deploying and Connecting a Key Management Server to vCenter. Lets talk though VM Encryption first.

Wednesday, September 9, 2020 | 4 minutes Read

Deploying and Connecting A Key Management Server to vCenter

Is it secure? This has to be one of the first things you consider with any technology solution or decision today. So when I was lucky enough to receive a NFR license from HyTrust for their KeyControl Key Management System I was excited to get this into my lab so I can make use of VMware’s vSAN and VM Encryption. In this post I will be going through the process of deploying a HyTrust Key Control appliance and creating a trust with vCenter. It was surprisingly straight forward and I was up and running in no time at all!

vSphere

Monday, August 24, 2020 | 3 minutes Read

Configuring ESXi for iSCSI Storage Using PowerCLI

Configuring host VMKernel adapters for iSCSI can be a time consuming process. PowerCLI can take away a lot if not all of the effort. Below is an example of using PowerCLI to create a Standard Virtual Switch (vSS), configure a VMKernel adapter, set the VLAN, enable the software iSCSI adapter (if that’s what you are using), bind it to the required network adapter and finally, add a dynamic Discovery target and rescanning the HBA’s.

Monday, August 10, 2020 | 4 minutes Read

Centos Based Certificate Authority For The VMware Lab

A useful thing for a home lab or VMware lab, is a certificate authority. There are Windows based CA’s as well as Linux based and many others. I wanted to take the Linux based route for my home lab to give me some administration time in Linux, being that Windows is my safe place! After a bit of googling, I settled on Easy-RSA as it looked like it would do what I needed in the lab. There are already a few guides out there for this, but this is my take on it for use in my VMware home lab.

Monday, July 27, 2020 | 7 minutes Read

Configuring Encrypted vMotion With PowerCLI

Encrypted vMotion is a feature available in vSphere 6.5 onwards. It is something that is always used to secure vMotions of encrypted virtual machines, its a required option, but is optional for non encrypted virtual machines. By default, non encrypted virtual machines will be set to ‘opportunistic’. If both the source and destination hosts support it (so ESXi 6.5 onwards), vMotions will be encrypted. If the source or destination does not support it, then the vMotion traffic will not be encrypted.

Thursday, July 9, 2020 | 2 minutes Read

Exporting and Importing Active Directory OU Structures

Recently I needed to build out some test Active Directory Forests that resemble production in order to complete some testing. One of the forests contained a significant amount of OU’s that I had no intention of manually recreating. To run the New-ADOrganizationalUnit cmdlet, you need to provide the OU name and the Path where you want to create it. However, Get-ADOrganizationalUnit doesn’t provide the path, so you need to determine it from the DistinguishedName.

Thursday, July 2, 2020 | 2 minutes Read