VMWare ESXi Accounts - PowerCLI Powershell module

By default, Passwordstate will use a standard script which uses SSH to connect to VMWare servers, to reset passwords on local accounts, perform account heartbeats or discover accounts on the servers.

This Powershell module written by VMWare will connect to your servers over HTTPS on port 443, and can also perform all Resets, Heartbeats and Account Discoveries.

To use the PowerCLI Powershell module, you must install this on your Passwordstate web server, or anywhere you may have the Remote Site Locations agent installed. This can be installed by opening Powershell as an Administrator, and running the command below, and more information about this can be found here: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.esxi.install.doc/GUID-F02D0C2D-B226-4908-9E5C-2E783D41FE2D.html

Install-Module VMware.PowerCLI -Force

This Powershell module also has a built-in feature which can upload statistics and usage of the PowerCLI module. This can upload anonymous statistics about your usage, but best practice is to turn this feature off, by running the following command on your Passwordstate webserver in Powershell:

Set-PowerCLIConfiguration -Scope AllUsers -InvalidCertificateAction Ignore -ParticipateInCEIP $false -Confirm:$false

Warning: This VMware module uses a parameter called Set-VMHostAccount which does not currently accept SecureString values to be passed to it. If you have detailed Powershell logging enabled at the operating system level, this command will log passwords for resets in clear text in the Powershell Event Logs. We’d recommend turning off Powershell logging on your webserver if using this module, otherwise use the existing Linux/SSH scripts instead. Heartbeats and Discoveries are not affected by this.