PowerCLI: RE: Disallowing Multiple VM Console Sessions


Frank Denneman posted today about disallowing multiple VM console session in a high-secure virtual infrastructure design: http://frankdenneman.nl/2010/11/disallowing-multiple-vm-console-sessions

The first thing popped up in my mind was why not automate this setting with PowerCLI. So I created a function called Set-MaxMKSConnections:

Function Set-MaxMKSConnections{
param(
    [parameter(Mandatory = $true)]
    [string[]]$vmName,
    $Sessions
)
    $vmConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec

       $extra = New-Object VMware.Vim.optionvalue
    $extra.Key="RemoteDisplay.maxConnections"
    $extra.Value="$Sessions"
    $vmConfigSpec.extraconfig += $extra

        $vm = Get-VM $vmName | Get-View
        $vm.ReconfigVM($vmConfigSpec)
}

You can run this function by copying the code into the PowerCLI window. To run it on a single VM, you can use the following line:

Set-MaxMKSConnections -vmName Thinapp -Sessions 1

To run it on all your VM’s, you can use the following foreach loop:

$vms = Get-VM
foreach($vm in $vms){
    Set-MaxMKSConnections -vmName $vm -Sessions 1
}

The configuration is changed even on Virtual Machines that are powered on (you need to restart the VM to activate the new setting):

image

If you want to raise the maxConnections value back to 2 or another value, you can change the –Sessions parameter with the correct value and run the script again.

Advertisements

7 thoughts on “PowerCLI: RE: Disallowing Multiple VM Console Sessions

  1. Pingback: Disallowing multiple vm console sessions | frankdenneman.nl

  2. Alastair Cooke

    Hi Arne,

    Nice site, great conent.

    One corection, according to the hardening guide the .vmx setting is “RemoteDisplay.maxConnections” without a dot between Remote and Display.
    My testing confirms that having the dot does not result in the required security.

    Al.

    Reply
  3. Pingback: VMware PowerCLI Function to Modify Virtual Machine Configuration Options : My Geek Finds

  4. Pingback: My Week in Geek – February 11, 2011 : My Geek Finds

  5. Pingback: VMware PowerCLI Function to Modify Virtual Machine Configuration Options | vHersey

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s