Block or Restricting execution of PowerCLI commands or Scripts

[nicholas1982]

Hi All,

I can't seem to find a way of doing this and it may turn out not to be possible. But I have some ops guys with vSphere client access to our vSphere 5.5 environment and some of them like to tinker with PowerCLI which we would like to restrict.

Reason being they have the ability to cause some serious damage if the wrong script is executed, I do trust my guys but it not a matter of trust its a matter of defined access control. They do need the level of access they have now to administer the environment but the ability to make mass changes via a script need to go through an approval process. We just had a script run to unmount all ISO/CDROMS for all VM's and due to the nature of how Linux OS locks the media it crashed the server.

So what I'm asking is there anyway to allow vSphere access but deny or restrict access to run commands via any other means like PowerCLI ?

[LucD]

If I understand this correctly, you want a user to have different roles, depending on the type of access (web client/PowerCLI) ?

[nicholas1982]

Hi Luc,

Yes, just because a user has permissions to vSphere via the Windows client or web client doesn't me they should be able to run commands via PowerCLI. Is there anyway to lock down PowerCLI access to specific users?

[LucD]

I'm afraid that there is no way to limit (afaik) the vCenter access based on the application used to access it (web client/PowerCLI...).

All these use the same vSphere API under the covers.

[nicholas1982]

Hi Luc,

Thanks for the info, so I figured this would be the case. Let me ask you this then, is there anyway to audit how tasks were preformed, i.e is it possible to know if it was done via vSphere client or PowerCLI? In this case we already suspected PowerCLI was used as the tasks were 5 seconds apart by the same user which would be extremely difficult done via the client.

[LucD]

Not at the moment afaik, but in the PowerShell v5 preview some new features were introduced that will allow tracking (see for example More New Stuff in PowerShell V5: Extra PowerShell Auditing).