Distributed vswitch security policies PowerCLI

Whatever your chosen acronym for distributed vSwitches, the default security policy is to accept MAC address changes and forged transmits. Even the hardening guides think this is a bad idea (and we know how checking those security those checkboxes from the hardening guide spreadsheet makes us feel, miright?).

GeekAfterFive has the code from his vCloud deployment that also works handy for 5.0 VDS's (and probably 5.1 and 5.5).

Even the 5.0 and 5.1 hardening guides don't have PowerCLI code to change the setting from the default insecure to reject this traffic. Pretty awesome resource there, GeekAfterFive. Good and bad that you're not blogging anymore from "the mothership".

Export / Import vCenter permissions.

These scripts, written by Alan and LucD, have been invaluable to me. I now have them set to run weekly as backups for production and I can do a manual export for my dev environment if needed (and that's where I've used the import, twice now, with vCSA upgrade issues).
Thank you, Darren for posting them up, and yes! they still work for vSphere 5.1!

I did need to change the domain from the shorthand to longhand version in the xml file importing into 5.1 from 5.0, but this might have been the way I put the domain in SSO.

Drink Up!

powershell security warning

Microsoft being helpful again...

Security Warning
Run only scripts that you trust. While scripts from the Internet can be useful, this script can potentially harm your computer. Do you want to run <script>?
[D] Do not run [R] Run once [S] Suspend (default is "D"):

I thought this was related to the file path that was in the script so I started going down the path of disabling UNC Paths... this wasn't the issue.

• Right-click the ps1 file and choose properties
• Hey, hey! There's this obnoxious Security bit here at the bottom of the General tab:
• This file came from another computer and might be blocked to help protect this computer. [Unblock]
• Click Unblock
• OK
• Get back to work