Problem changing root password with Invoke-VMScript

[AyazXerox]

I am using the following powershell script to automate changing the default root password of the VM ( Red Hat Linux) during VM customization step to the user supplied password. The script actually changes the password but it is returning non-zero return code (-1) thus causing a failure while trying to copy the script out to local temp folder in local host where script being executed from. I tried changing output folder by modifying environment variable $env:temp to shared folder in the local host but the script is still trying to copy the file to 'C:\Windows\TEMP\.  The error message is confusing , not sure if the issue on the guest OS or the host from where the script is being executed. We are using the default root credentials to perform the password change and root should have privileges to copy files from /tmp folder. Has anyone encountered anything similar to this problem? Does any one has any suggestion? I will be happy if I could some how suppress or redirect the out to somewhere else to bypass this copy file error.

Thanks Ayaz

Add-PSSnapin VMWare.VIMAutomation
Core Connect-VIServer -server $args[0] -user $args[1] -password $args[2]
$newPasswd=$args[5]
$cmdline="echo -e " + $newPasswd + " |  passwd --stdin root"
Invoke-VMScript -VM $args[3]  -GuestUser root -GuestPassword $args[4]-ScriptType Bash -ScriptText $cmdline

Invoke-VMScript : 7/30/2013 9:08:23 AM    Invoke-VMScript While performing operation 'Copy file '/tmp/vmware7' to 'C:\Windows\TEMP\tmp8CF7.tmp'. The file contains script output for VM 'AyazVM'' the following error occured: 'Authentication failure or insufficient permissions in guest operating system'    At C:\VMTemp\TEO_WorkingDir_d8caf83a-3da1-4557-bc6d-065def0e066a\TEO_PSScript_d8caf83a-3da1-4557-bc6d-065def0e066a.ps1:5 char:16+ Invoke-VMScript <<<

[LucD]

I think the error comes from the passwd command you are trying to execute inside the guest OS.

Have a look at the first solution this thread, that should work.

[AyazXerox]

Thanks Luc. The solution provided in the threads works only when the Machines are powered on but we are trying to change the password before the VMs are powered on. it seems like we may have to change our customization strategy as suggested by my colleague.

[LucD]

I see, but when the VM is not powered on, you won't be able to use Invoke-VMScript.

Perhaps an OSCustomizationSpec, that you change for each VM deployment (provided you need different passwords), could be a better solution ?

[AyazXerox]

Actually, the script works when the VM is powered off. The password is changed to the desired password but only that the script returns non-zero code because of the copy command failure. If I run the same script with -RunAsync switch it works like a charm, however I have no way of knowing if the password change failed because of some other reasons, such minimum length or special character requirements.

[LucD]

You got me completely confused now :smileyshocked:

My understanding is the following:

The Invoke-VMScript relies on the VMware Tools to execute a script inside the guest OS.

When the VM is powered off, the VMware Tools are not running, and the Invoke-VMScript can not run.

Perhaps I'm missing the bigger picture here, but:

• do you run the script containing the Invoke-VMScript with the RunAsync switch or not ?
• I guess the deployment of a the new VM is done with a New-VM cmdlet. When and through what do you start the script to change the root password ? You have to make sure the VM is powered on and that the customization is completed (which is quite fast on a Linux box)
• The output of the script you launch with the Invoke-VMScript is stored in the /tmp folder (your /tmp/vmware7 file from the message). Could the whole thing be a catch-22 in the end ?
  • You authenticate as root on the Invoke-VMScript cmdlet to logon to the guest OS
  • You change the root password
  • The Invoke-VMScript tries to copy the temp file with the output of your script, but since the password has been changed, the authentication fails

[AyazXerox]

Luc, I take back my previous statement, yes the VM is powered on before running the script, we are using 3rd party workflow engine for automation, which internally powers on the VM before running the scripts on Linux flavors but not for Windows. So, I was confused as we handle power on/off through another workflows right after and network setup and domain registration just before the VM goes live on the external network. Most of API for VMware is hidden behind the workflow engine and they are using Java Web API for most of the work, It has password reset option for Windows but not for Linux and that's why we are using the power shell cmdlets. All the files in the /tmp are 0 zero length, so I am not sure exactly the permission issue is coming from.

[LucD]

Ok, that I understand.

But since the VM is powered on, can you try the method from the thread I mentioned earlier ?

[b_abhishek]

My VM is in powered On state and vmtools running.

I am trying to change the credentials for root user, with which I am authenticating to guest OS.
The code is actually changing the password for root user but returning non zero error code, may be the because the information from guest Os is not returned back becuase now the guest credential is changed.

Is there a way to fix it ?

PS C:\BA> Get-VM template_abhitest | Invoke-VMScript -ScriptType Bash -GuestUser root -GuestPassword test -ScriptText "echo root:Test1234 | chpasswd"
Invoke-VMScript : 12/30/2022 11:35:34 AM Invoke-VMScript Failed to authenticate with the guest operating system using the supplied
credentials.
At line:1 char:41
+ ... _abhitest | Invoke-VMScript -ScriptType Bash -GuestUser root -GuestPa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Invoke-VMScript], InvalidGuestLogin
+ FullyQualifiedErrorId : Client20_VmGuestServiceImpl_GetProcessOutputInGuest_ViError,VMware.VimAutomation.ViCore.Cmdlets.Comman
ds.InvokeVmScript

But When I try to manually login to console with changed password it works.

 

[LucD]

Yes, see my earlier reply where I explained that when Invoke-VMScript is trying to download the file with the output, it still uses the old password.
Hence the error.

One way of avoiding this is to change the password with a scheduled job (Windows Scheduled Task or a cron job).
Use Invoke-VMScript to set up that scheduled job.
When the scheduled job has run, and all went well, you should be able to logon with the new password.