How to unlock and reset SSO password in vSphere 6.x (2146224)

So I have a bit of a embarrassing confession to make. I forgot to record the Administrator password for my VCSA Appliance. Total disclosure, I was freaking out and I really thought I was going to have to start from scratch. I did some research I was surprised to find out that you can actually reset the Administrator account on a VCSA appliance as long as you have the root password for the appliance and you have access to the VCSA Console. Below are a list of the links to the KB Articles from VMware.

Resetting SSO Administrator Password
https://kb.vmware.com/s/article/2034608
Resetting SSO Administrator - VCSA 6.x

Below is the PUTTY session as an example.

shinnk@Computer:~$ ssh root@devvcsa01.xxxx.xxxxx
ssh: Could not resolve hostname devvcsa01.xxx.xxxxx: Name or service not known
shinnk@Computer:~$ ssh root@172.26.44.18
The authenticity of host '172.26.44.18 (172.26.44.18)' can't be established.
ECDSA key fingerprint is SHA256:7E4K1HVpg2ExWz+vEkkRdJ0M5jUYftb3HZw6OSDKFEICSOEPWWKYERe4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.26.44.18' (ECDSA) to the list of known hosts.

VMware vCenter Server Appliance 6.5.0.21000

Type: vCenter Server with an embedded Platform Services Controller

Password:
Connected to service

    * List APIs: "help api list"
    * List Plugins: "help pi list"
    * Launch BASH: "shell"

Command> shell.set --enabled true
Command> shell
Shell access is granted to root
root@devvcsa01 [ ~ ]# /usr/lib/vmware-vmdir/bin/vdcadmintool


==================
Please select:
0. exit
1. Test LDAP connectivity
2. Force start replication cycle
3. Reset account password
4. Set log level and mask
5. Set vmdir state
6. Get vmdir state
7. Get vmdir log level and mask
==================

3
  Please enter account UPN : Administrator@vsphere.local
New password is -
/a+p|8M?vRl`%"p4*+oZ


==================
Please select:
0. exit
1. Test LDAP connectivity
2. Force start replication cycle
3. Reset account password
4. Set log level and mask
5. Set vmdir state
6. Get vmdir state
7. Get vmdir log level and mask
==================

Once you go through all these steps you are now able to log into VCSA with that temporary password that you are given and you are also able to reset it as well.

I hope you find this post helpful, and if you do please share it out to your friends.

Getting past Certificate issue in Power CLI

So I recently started working more with PowerCLI. After my time at VMWorld 2019 (which I will cover in another post) I realized how powerful that PowerCLI actually is (pun not intended). In starting to work with PowerCLI I came across the following message whil: trying to connect to my vCenter

Connect-vIServer : xx-x-xxxx xx:xx:xx Connect-VIServer Error: Invalid server certificate. Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Prompt if you’d like to connect once or to add a permanent exception for this server.

I did some googling and I found this article,so shout out to Ivo Beerens for his article.

https://www.ivobeerens.nl/2018/07/18/quick-tip-powercli-invalid-server-certificate-error/

In his article he goes on to share this command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false

After putting that into PowerShell and pressing enter you will no longer get the Invalid Certificate message.

I hope you found this post helpful, I will be posting about some of the scripts that I have been posting on my Github. Please share with your friends if you found this helpful. 

Enable a Remote Mailbox in Office 365

So I recently ran into an issue where I had a user who's Local AD account had been deleted but their Office 365 Mailbox was still showing up. We tried to bring the user account back, however the AD recycle bin was not enabled. So we had to create a brand new account for the user and then work from there.

We originally planned to create a new mailbox and let the user start from scratch. However we ran into an issue were the old mailbox would not go away, and it was preventing us from migrating a new mailbox into Exchange Online for the user.

I then found the following Exchange Management Shell command which will allow you to connect the local AD account to the Exchange Online Mailbox.

Enable-RemoteMailbox USERNAME -RemoteRoutingAddress Alias@domain.onmicrosoft.com

After running the command the user is now able to log in with their new AD account and have access to their mailbox.

I hope you found this post helpful, and if you did, please share it with your friends.

VMWorld is in 2 days!!!

VMWorld 2019 will be in 2 days!! I will be attending this year for my first time. I must say I am very excited and anxious to go. I am looking forward to all the people I will meet and events that I will have the opportunity to take part in. 

I will do my best to post updates throughout the week. Be sure to follow me on twitter @kenbshinn where I am sure I will be posting updates as well. 

Microsoft Active Directory Time Sync Settings

So I was recently asked by a client: "Why is the time on my PC 5 minutes off from my phone?"

Now this is a small environment, a very small environment (1 Server and 7 workstations). The first thing I thought about was what does the server clock look like? So I remoted into the server and sure enough it had the same time as the workstation.

I went and checked the registry and found that the server was pointed get its time from time.windows.com, but for some reason that was not working.

I then used the following command to point it to several of the pools hosted by NIST.gov

w32tm /config /manualpeerlist:time-a-g.nist.gov,time-b-g.nist.gov,time-c-g.nist.gov,time-d-g.nist.gov /syncfromflags:manual /reliable:yes /update

After that I restarted the W32Time (Windows Time) service to make the update work.

Once that is done it should force a resync of the time service which could take some time to update and to sync with all the workstations.

I hope you find this post helpful, and if so please share it with your friends.

Power off entire Virtual Environment using a PowerShell Script and PowerCLI

So I have a lab that I manage where we have had several scheduled power outages in the last few months. So it is my job to make sure that we power off the lab so none of our equipment have issues when we bring it back up.

I would estimate that our lab is comprised of about 90% VMware ESXi Hosts, and after going through the exercise of powering off the whole lab 1 or 2 times, it became it bit of a pain.

So I created a PowerShell Script using PowerCLI to not only power off all the Virtual Machine, but also the Virtual Hosts, and the VCSA appliance itself.

I have posted the script to my Github which you an check out here:

https://github.com/kenbshinn/Poweroff_VirtualEnvironment

Feel free to check it out and let me know what you think.

I hope you found this post helpful, and if so, please share it with your friends.

Home Automation.... reinventing the wheel

A few months back I had a catastrophic failure with the Raspberry Pi that had been running my Home Automation Platform (Home Assistant). Long Story short, I reached the physical limit of writes available on an SD Card. Who knew you could reach that limit on less than 2 years if you are running an a Home Automation System, Logging Location Services, Temperature monitoring, well as an MQTT Broker on the same box?? 

Unfortunately my schedule did not allow for me to rebuild my Raspberry Pi sooner, and I am kind of glad that it did. During the time of being Home Assistant-less, I learned that I was really not using it to it's fullest extent and that overtime most of the features that I depended on it for had been transitioned over to my Google Home/Smart Things Hub, or my kids ended up reprogramming (more on this later).

I started to think about what I really needed Home Assistant for, well besides turning on my Z Wave Controlled office lights for me (that was very handy). I also thought about how my Google Homes had been taking over my life. Then it occurred to me. 90% of what I use my Google Homes for is Voice controlling my lights. That is not Automation, 4 times out of 10 I have to repeat myself to get it to work, and the effort of turning on a light switch with my hand is not very taxing. 

Really, I am just being lazy..... End of Story!

Just kidding....

In all seriousness I decided to get back to basics and figure out what I had going on in my house that could use Automating and here is a list of projects I have come up with that I will do blog posts about in the future.

• Install Philips Hue Lights (the wife bought me these about a year ago, Time I put them to work)
• Automating Dehumidifier - using a Z Wave humidity sensor and a WEMO Outlet
• Automating Basement Space Heater - Same concept as above
• Automating Office Fan - Now this one is going to be tricky. I am not sure if I want it to turn on when I open the door, or at a certain temperature. 
• Automating my Bearded Dragon's Lights - Using a WiFi Enabled power strip
• Automating Exterior lights - Using Presence of all family members and time of day

I have other lists of things that I would like to do down the road, but for now, this should keep me busy. 

Just so you are aware, I do have vanilla Home Assistant running on my Raspberry Pi 3 B+ and I am still trying to figure out what I am going to do about an MQTT Broker to communicate with my Smart Things Hub. I have been playing around with Docker and I am thinking that is a good place for it to live, as well as hosting it on a separate Pi or Linux machine. 

Come September my schedule will be going back to crazy, if not worse with some additional things I am putting on my plate which I hope to talk about soon.