Category Archives: VMware

How do I remove an iSCSI Software Adapter in VMware?

While messing with some options in my lab, I noticed that once I added an iSCSI software Adapter, every option to remove it is greyed out.

Crazy enough, the only way to remove an iSCSI adapter in VMware is to:

  1. Right click->Properties on the adapter
  2. Click on the Configure… button
  3. Uncheck Enabled under Status in the General Properties dialog box
  4. Restart the ESXi host (yep, you literally have to restart the whole box)

Upon restart, the adapter will be removed automatically. ¬†If anyone finds another solution, please drop a comment below and let me know ūüôā

Adding a host to vCenter – Datacenter.QueryConnectionInfo Error

Symptom: When adding a host to your vCenter Datacenter, you receive the following error:

Permission to perform this operation was denied. You do not hold privilege “System > View” on folder””

Error Stack
Call “Datacenter.QueryConnectionInfo” for object “DATACENTERNAME” on vCenter Server “myhost.mydomain” failed.
VMware - Error Datacenter.QueryConnectionInfo

Resolution: Make sure you have not enabled Lockdown mode on the host. To change the setting, use the direct console user interface (DCUI), and press F2. Login with your credentials and arrow down to Configure Lockdown Mode and hit enter. Make sure this option is disabled (unchecked) when the prompt opens. With Lockdown Mode disabled, try adding the host to vCenter.

Additionally, make sure that you can fully resolve the DNS name to the actual ESXi host.  If the DNS entry does not exist or points to an invalid ESXi host, the warning will be prompted as well.

If you still have issues, you can try restarting the Management Agents using the troubleshooting menu. Use the DCUI, press F2, login with your credentials, and arrow down to Troubleshooting Options and press Enter. Arrow down to Restart Management Agents and hit enter. This will restart some of the ESXi services on the host and should allow it to connect to vCenter.

VMware vCenter Server 5.1 Install Error – “Create standalone instance VMwareVCMSDS” failed

When installing VMware vCenter Server 5.1, I came accross this issue after I had uninstalled an instance of vCenter running on the machine.

Symptom: When installing vCenter Server 5.1, you are presented with a dialog box saying¬†Creation of instance VMwareVCMSDS failed: The name ‘VMwareVCMSDS’ is already in use as an AD LDS instance name; and are presented with options to force install or cancel. ¬†I didn’t just keep blowing through the installer as I felt it would probably bite me in the butt later. ¬†Instead I decided to figure out what the problem was and how to make the vCenter installer happy.

As the dialog box says, you can find information inside of the jointool.log and status.txt files stored inside of your user’s TEMP directory during installation (which can probably be found here: C:\Users\myusersdirectory\AppData\Local\Temp).

Here is what my log files showed:

jointool.log

[2013-01-08 10:46:53,833 com.vmware.vim.jointool] Failed to find instance config at: “C:\ProgramData\VMware\VMware VirtualCenter\instance.cfg”, assuming defaults
[2013-01-08 10:46:53,833 com.vmware.vim.jointool] Storage directory not found in instance.cfg.
[2013-01-08 10:46:54,223 com.vmware.vim.jointool] Skipping DB init as we are attempting to initialize without force/recovery/upgrade.
[2013-01-08 10:46:54,223 com.vmware.vim.jointool] JoinTool started
[2013-01-08 10:46:54,223 com.vmware.vim.jointool] Storage directory for LDAP instance: C:\ProgramData\VMware\VMware VirtualCenter\\VMwareVCMSDS
[2013-01-08 10:46:54,223 com.vmware.vim.jointool] Operation Mode: initialize
[2013-01-08 10:46:54,254 com.vmware.vim.jointool] Creating directory services instance VMwareVCMSDS
[2013-01-08 10:46:54,254 com.vmware.vim.jointool] LDAP port = 389
[2013-01-08 10:46:54,254 com.vmware.vim.jointool] Base DN = dc=virtualcenter,dc=vmware,dc=int
[2013-01-08 10:46:54,254 com.vmware.vim.jointool] Storage dir = C:\ProgramData\VMware\VMware VirtualCenter\VMwareVCMSDS
[2013-01-08 10:46:56,080 com.vmware.vim.jointool] Operation “Create standalone instance VMwareVCMSDS” failed: : Action: Create Standalone Instance
Action: Creation of standalone instance
Action: Create Instance
Problem: Creation of instance VMwareVCMSDS failed: The name ‘VMwareVCMSDS’ is already in use as an AD LDS instance name. Type a different instance name.

 

[2013-01-08 10:46:56,080 com.vmware.vim.jointool] Recovering from failed Operation “Create standalone instance VMwareVCMSDS”

[2013-01-08 10:46:56,080 com.vmware.vim.jointool] Recovery successful

[2013-01-08 10:46:56,080 com.vmware.vim.jointool] Execution error.

status.txt

—————–
Operation “Create standalone instance VMwareVCMSDS” failed:
Action: Create Standalone Instance
Action: Creation of standalone instance
Action: Create Instance
Problem: Creation of instance VMwareVCMSDS failed: The name ‘VMwareVCMSDS’ is already in use as an AD LDS instance name. Type a different instance name.

 

—————–
Recovering from failed Operation “Create standalone instance VMwareVCMSDS”

—————–
Recovery successful

—————–
Execution error.

Resolution:
To fix this issue, I ended up navigating to C:\ProgramData\VMware and removing the VMware VirtualCenter folder (you could move it to a different directory to save as a backup just in case).

Now, rerun the installer and a clean copy of vCenter should install fine.

Notes: If you are prestaging your SSL certificates prior to installation, go ahead and recreate the folder structure of C:\ProgramData\VMware\VMware VirtualCenter\ssl and place your rui.crt, rui.key, and rui.pfx files in there.

vCenter 5.1 – vSphere Web Client – Log Browser – Unauthorized access ‘ faultDetail:’null’ Error

Symptom: When you click on the Log Browser link from the vSphere Web Client, you receive the following error:

faultCode:Server.Processing faultString:’javax.servlet.ServletException : java.lang.Exception: https://MYVCENTER.MYDOMAIN.local:12443/vmwb/logbrowser: Unauthorized access ‘ faultDetail:’null’

Resolution: You need to replace the SSL certificate for the Log Browser service with a valid one. Assuming you have applied a valid certificate on your SSO instance, Web Client, and have done the necessary steps to generate the rui.pfx, rui.key, and rui.crt files, here are the steps to apply the certificate:

  1. Stop the VMware Log Browser service
  2. Navigate to C:\Program Files\VMware\Infrastructure\vSphereWebClient\logbrowser\conf via Windows Explorer
  3. Backup the rui.crt, rui.key, rui.pfx to your Desktop (or some other folder incase we have to roll-back)
  4. Replace the rui.crt, rui.key, rui.pfx files with the ones you have created.
  5. Next, we need to create a new java keystore with the chain trust for our certificate
    1. Open up an elevated command prompt
    2. Change directories to the VMware JRE
      1. cd /d C:\Program Files\VMware\Infrastructure\jre\bin
    3. Generate the new keystore (Do not change the testpassword or changeit password) (Change the Paths to point to your pfx certificate and the destination path to output the java Keystore)
      1. keytool -v -importkeystore -srckeystore C:\PATHTOYOURSSOCERTPFXFILE\rui.pfx -srcstoretype pkcs12 -srcstorepass testpassword -srcalias rui -destkeystore C:\OUTPUTPATHYOUKNOWMAYBEYOURDESKTOP\rui.jks -deststoretype JKS -deststorepass changeit -destkeypass changeit
    4. Copy the C:\OUTPUTPATHYOUKNOWMAYBEYOURDESKTOP\rui.jks to:
      1.  C:\Program Files\VMware\Infrastructure\SSOServer\Security\
    5. Login to your vSphere Web Client with the [email protected] account
    6. Navigate to Administration > Sign-On and Discovery > Configuration
    7. Click on the STS Certificate tab and the click Edit
    8. Select the rui.jks file from C:\Program Files\VMware\Infrastructure\SSOServer\Security\
    9. When prompted for a keystore password enter changeit
    10. Click on the rui line to highlight it, then click OK
    11. Enter changeit again for the password
    12. Acknowledge the dialog box that says you need to restart the server in order for the changes to take effect.
      1. Note, if you receive the following error below, that means you have not fully established a certificate trust.  If you have an intermediate certificate, you will need to put all of those certificates inside of your pfx file (see my notes at the end).
        1. The last operation failed for the entity with the following error message.An error ocurred while updating server configuration

    13. Reboot your server
  6. Log back into your vSphere Web Client
  7.  Click on the Log Browser link and verify the error has been resolved

—-Notes for people with tiered PKI environments—-
If you have intermediate certificates, when you generate the pfx file you HAVE to import the entire chain into the pfx, otherwise the certificate will not be imported when using the vSphere Web Client.  To include the chain in your pfx file, use the following command:

openssl.exe pkcs12 -export -in C:\PATHTOMYSSOCERT\rui.crt -inkey C:\PATHTOMYSSOPRIVATEKEY\rui.key -name “rui” -chain -CAfile C:\PATHTOCACHAIN\certs.pem -passout pass:testpassword -out C:\PATHTOOUTPUTPFXFILE\rui.pfx

Notice the certs.pem file I have created.  This includes the public keys from each intermediate cert, and then followed by the root certificate.  I.e. Your file will look something like this:

—–BEGIN CERTIFICATE—–
INTERMEDIATECERTIFICATEBASE64STUFFHERE.crt
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
ROOTCERTIFICATEBASE64STUFFHERE.crt
—–END CERTIFICATE—–

Where the first BEGIN CERTIFICATE would be your intermediate certificate, and the second certificate your root certificate.  If you have multiple intermediate certificates, always put them before the root.  The root certificate should be the last in the pem file.

The official VMware KB article on how to do this can be found here (note, it does not cover the pfx file creation for tiered PKI environments): http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2037927

VMware vCenter 5.1 – Preappend domain name

After upgrading from vCenter 5.0 to 5.1 (and installing the new Single-sign On service), you may have noticed that you now have to use the DOMAIN\Username format when logging into your vCenter instance. Personally, I find this very agrevating; luckily, there is an easy way to have vCenter just figure out what domain you are on.

In order to get this job done, this guide assumes you have the vCenter Web Client installed (I don’t believe this can be done from the vSphere Client for Windows — if there is a way, please leave a comment below with the instructions, so I can add them here).

  1. Navigate to your vCenter Web Client
  2. Login using your [email protected] account
  3. On the left side, click on Administration
  4. Underneath Sign-On and Discovery, click on Configuration
  5. Click on the Add Identity button underneath the identity sources tab (it looks like a green + sign).
  6. Enter in your domain info if it isn’t already there, test the connection, and click OK.
  7. Select your domain from the Identity Sources list and click on the Add to default domains button (Looks like a globe with an arrow on it)
  8. Click the Save button in the Default Domains list below the Identity Sources list.

That should do it. ¬†Try logging in without the domain appended and it should be good to go ūüôā

VMware VirtualCenter Server Service – service-specific error code 2

If you receive the following error:

Windows could not start the VMware VirtualCenter Server on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.

Here is how to figure out what is going on (as you probably found out, event viewer is useless giving you the following info:

The description for Event ID 1000 from source VMware VirtualCenter Server cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Failed to intialize VMware VirtualCenter. Shutting down…

the message resource is present but the message is not found in the string/message table

To figure out what is going on, open up the vpxd-1.log file (mine was in the following directory: C:\ProgramData\VMware\VMware VirtualCenter\Logs)

Towards the bottom, you should see the error. In my case, I found the following error:

2013-01-05T13:23:54.267-06:00 [01912 error ‘Default’] SSLStreamImpl::DoClientHandshake (000000000a01aec0) SSL_connect failed. Dumping SSL error queue:
2013-01-05T13:23:54.267-06:00 [01912 error ‘Default’] [0] error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
2013-01-05T13:23:54.267-06:00 [01912 error ‘Default’] [1] error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed
2013-01-05T13:23:54.267-06:00 [01912 error ‘Default’] [2] error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib
2013-01-05T13:23:54.267-06:00 [01912 error ‘Default’] [3] error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
2013-01-05T13:23:54.267-06:00 [01912 error ‘HttpConnectionPool-000001’] [ConnectComplete] Connect failed to ; cnx: (null), error: class Vmacore::Ssl::SSLVerifyException(SSL Exception: Verification parameters:
–> PeerThumbprint: 45:9E:FA:36:44:E1:51:9D:03:D6:FA:A3:56:DE:01:91:0D:93:78:C8
–> ExpectedThumbprint:
–> ExpectedPeerName: MYHOST.MYDOMAIN.local
–> The remote host certificate has these problems:
–>
–> * certificate signature failure)
2013-01-05T13:23:54.267-06:00 [01152 error ‘[SSO][SsoFactory_CreateFacade]’] Unable to create SSO facade: SSL Exception: Verification parameters:
–> PeerThumbprint: 45:9E:FA:36:44:E1:51:9D:03:D6:FA:A3:56:DE:01:91:0D:93:78:C8
–> ExpectedThumbprint:
–> ExpectedPeerName: MYHOST.MYDOMAIN.local
–> The remote host certificate has these problems:
–>
–> * certificate signature failure.
2013-01-05T13:23:54.267-06:00 [01152 error ‘vpxdvpxdMain’] [Vpxd::ServerApp::Init] Init failed: Vpx::Common::Sso::SsoFactory_CreateFacade(sslContext, ssoFacadeConstPtr)
–> Backtrace:
–> backtrace[00] rip 000000018018a8ca
–> backtrace[01] rip 0000000180102f28
–> backtrace[02] rip 000000018010423e
–> backtrace[03] rip 000000018008e00b
–> backtrace[04] rip 0000000000405c2c
–> backtrace[05] rip 0000000000426512
–> backtrace[06] rip 000000013ffd0701
–> backtrace[07] rip 000000013ffca51c
–> backtrace[08] rip 00000001401ec92b
–> backtrace[09] rip 000007fefefba82d
–> backtrace[10] rip 000000007765652d
–> backtrace[11] rip 000000007788c521
–>
2013-01-05T13:23:54.267-06:00 [01152 warning ‘VpxProfiler’] ServerApp::Init [TotalTime] took 6505 ms
2013-01-05T13:23:54.267-06:00 [01152 error ‘Default’] Failed to intialize VMware VirtualCenter. Shutting down…
2013-01-05T13:23:54.267-06:00 [01152 info ‘vpxdvpxdSupportManager’] Wrote uptime information
2013-01-05T13:23:59.774-06:00 [01312 warning ‘VpxProfiler’ opID=SWI-184910ec] VpxUtil_InvokeWithOpId [TotalTime] took 12012 ms
2013-01-05T13:24:11.786-06:00 [01312 warning ‘VpxProfiler’ opID=SWI-82674fff] VpxUtil_InvokeWithOpId [TotalTime] took 12012 ms
2013-01-05T13:24:23.799-06:00 [01312 warning ‘VpxProfiler’ opID=SWI-699faf4] VpxUtil_InvokeWithOpId [TotalTime] took 12012 ms
2013-01-05T13:24:35.811-06:00 [01312 warning ‘VpxProfiler’ opID=SWI-6e861832] VpxUtil_InvokeWithOpId [TotalTime] took 12012 ms
2013-01-05T13:24:47.823-06:00 [01312 warning ‘VpxProfiler’ opID=SWI-f1537246] VpxUtil_InvokeWithOpId [TotalTime] took 12012 ms
2013-01-05T13:24:48.057-06:00 [01152 info ‘Default’] Forcing shutdown of VMware VirtualCenter now

As you can see from the error above, we are having some SSL issues. To fix this issue, you need to replace the SSL certificate for the SSO service with a trusted certificate (either by your own internal CA or an external one).

How do I install vCenter 5.1

Check out Derek Seaman’s multi-step blog post. It is the most up-to-date guide with tons of information to get you going. It also refer’s to many of the installation issues that were found in previous versions of vCenter. As I write this, the blog has already begun making notes for 5.1a instead of 5.1 GA. At this time, 5.1B is out (which I would recommend you install), but you should be able to get through the installation just fine.

http://derek858.blogspot.com/2012/09/vmware-vcenter-51-installation-part-1.html

And as a reference, I would recommend looking over the release notes for 5.1  There is a plethora of info you may want to know as a heads up, prior to the installation.

https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-510b-release-notes.html

https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-510a-release-notes.html

 

Good luck!

Replacing SSL Certificates on View Connection Servers 5.1

Here are the steps involved to change the SSL certificates from the default VMware Self-Signed certificate to one signed by either your internal CA or a public CA.  This tutorial works for both the View Connection Server or Security Server services.  An official KB article by VMware on this subject can be found here: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2020913

In this particular guide, we cover generating an SSL certificate with an Internal CA.¬† If we wanted to sign our server with a public CA, we could use a tool like openSSL to generate a certificate request, send the request to a public CA.¬† Next, we would import a PFX12 file with the private and public key into the Local computer’s Personal certificates and change set Friendly Name to vdm.

Opening the Certificates Management Console

  1. In the Connection Server, click Start, type mmc, and click OK.
  2. Click File > Add/Remove Snap-in.
  3. Select Certificates and click Add.
  4. Select Computer account and click Next.
  5. Select Local computer and click Finish > OK.

Requesting a new certificate

  1. Expand Certificates and click Personal.
  2. Under Object Type, right-click and select All Tasks > Request New Certificate.
  3. Read the information on certificate enrollment and click Next.
  4. Click Active Directory Enrollment Policy > Next.
  5. Select the template for certificate enrollment and click Details > Properties.
    1. Notes:
      1. Ensure you choose the Windows Server 2003 certificate template option. Do NOT choose Windows Server 2008.
        For information on creating a certificate template, see the Microsoft Technet article Creating Certificate Templates.
      2. If you notice that the service starts but you are unable to navigate to the SSL page, this is because the Windows Server template was set to Server 2008.
  6. Click the General tab.
  7. Under Friendly name, type vdm.
  8. Click the Private Key tab.
  9. Click the arrow next to Key options and select the Make private key exportable option.
  10. Click OK > Enroll.
  11. Click Finish.
  12. Restart the Connection Server service.Notes:
    • If you use any browser other than Internet Explorer to access the View Administration console, you must add an exception for the connection to be trusted.
    • It may take a few minutes for the certificate to be recognized as valid in the View Administration console.

All credit for this guide goes to VMware for this information. This post is merely for archival purposes and self-reflections on the subject.

Replacing SSL Certificates on View Connection Servers 5.0

This process does NOT work for VMWare View 5.1 only 5.0

Here are the steps involved to change the SSL certificates from the default VMware Self-Signed certificate to one signed by either your internal CA or a public CA.  This tutorial works for both the View Connection Server or Security Server services.

  1. Navigate to the following directory via command prompt (if running server 2008, make sure you run command prompt as an administrator):
    1. C:\Program Files\VMware\VMware View\Server\jre\bin
  2. Execute the following command to generate a new Java Keystore:
    1. keytool -genkeypair -keyalg “RSA” -keysize 2048 -keystore keys.jks -storepass secret
      1. Note: This will ask for your first and last name, type in your FQDN here (I.e. viewserver.mydomain.com); also hit RETURN to use the same password as your keystore password when you are done.
  3. Execute the following command to generate a CSR:
    1. keytool -certreq -file certificate.csr -keystore keys.jks -storepass secret
  4. Sign the certificate.csr file that was just generated with your certificate authority (GoDaddy, Verisign, Internal CA, etc.)
  5. Copy the signed .cer or .crt file that you just received from your CA to the same keytool directory
  6. Copy any root or intermediate public certificates to the same keytool direcotry
  7. Execute the following commands for each of your root and intermediate certificates
    1. Root CA Example
      1. keytool -importcert -keystore keys.jks -storepass secret -alias rootCA -file rootCA.cer
    2. Intermediate CA Example
      1. keytool -importcert -keystore keys.jks -storepass secret -alias intermediateCA -file intermediateCA.cer
  8. Execute the following command to import your public certificate for your certificate.csr file:
    1. keytool -importcert -keystore keys.jks -storepass secret -keyalg “RSA” -trustcacerts -file certificate.cer
  9. Next, we need to configure a View Connection Server Instance or Security Server to use the new certificate
    1. Move the keys.jks file that we just created (C:\Program Files\VMware\VMware View\Server\jre\bin\keys.jks) to the following directory:
      1. c:\Program Files\VMware\VMware View\Server\sslgateway\conf\keys.jks
    2. Next, we need to add the keyfile, keypass, and storetype properties to the locked.properties file
      1. If the locked.properties file does not already exist,go ahead and create a new file with notepad.
      2. Once the locked.properties file is open, ensure the following lines are in it:
        1. keyfile=keys.jks
        2. keypass=secret
        3. storetype=jks
  10. Restart the View Connection Server service or Security Server service for your changes to take effect.
  11. Once you have verified the new certificate works, delete the following files from C:\Program Files\VMware\VMware View\Server\jre\bin
    1. certificate.cer
    2. rootCA.cer
    3. intermediateCA.cer
    4. certficate.csr

 

Allowing Copy/Paste/Clipboard access between View Desktop and Local Machine

Want to allow users to copy/paste rich-text from their local machine to their View VM?  Here is how to do it.
  1. Go to your View Connection server and browse to the following directory:
    1. c:\Program Files\VMware\VMware View\Server\extras\GroupPolicyFiles\
  2. Copy the pcoip.adm template and paste it on your domain controller’s desktop/whereever you modify group policies for the domain.
  3. Create a new policy on the OU that you want for your virtual desktops (view clients)
  4. Edit the policy
  5. Expand Computer Configuration->Policies
  6. Right click on Administrative Templates and click Add/Remove Templates
  7. Click the Add… button and browse to the pcoip.adm file
  8. Click the Close button
  9. Expand Computer Configuration->Policies->Administrative Templates->Classic Administrative Templates (ADM)->PCoIP Session Variables->Overridable Administrator Defaults
  10. Modify the following policies to enable clipboard access
    1. Configure clipboard redirection
      1. I.e set this option to Enabled and configure clipboard redirection for Enabled in both directions.
    2. Configure PCoIP virtual channels
      1. Set this option to enabled
  11. Restart the desktop to ensure policies take over

Notes:

  • Overridable Administrator Defaults allow administrators to change the values.
  • Non-Overridable Administrator Settings prevent Administrators from changing the settings as well.
  • It is only possible to copy/paste rich-text. ¬†Files are not supported at this time.