So, last friday I was about to patch templates in different systems, and this time it needed some special care for Spectre/Meltdown patches and workarounds. Figured I may as well finally start scripting this procedure as it needed to be repeated on several templates. Most of this is done with Invoke-VMScript and the use of different powershell modules, and utilize some pre-standardisation of our templates (same DVD drive letter, same user/password, script in c:\install etc.).
In broad terms, the script (in it's current revision) does the following:
- Checks for powered on VMs in folders named "Templates" that has guestID matching "windows"
- Adds registry value so January security patches gets installed (No AV in base image, except Windows Defender)
- Adds NuGet package provider
- Installs PSwindowsupdate PS Module
- Downloads all windows updates (filtered if needed)
- Install all Windows Updates and reboots the machine
- Runs DISM with some parameters to ensure a small image
- Maps the ISO for VMware Tools and runs the installation silently, then dismounts the CD
- Shutting down the VM when complete
.. everything is logged to c:\temp\<name of VM>.txt
I have been trying to figure out why some VMs work, and some don't. Often the failure is due to problems with powershell, and I'm guessing that is because the machine is not logged on (or have some intrusive patch installed).
The errors I get are these:
Join-Path : Cannot bind argument to parameter 'Path' because it is null.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:47 char:77
+ ... osoft.PowerShell.Management\Join-Path -Path $env:LOCALAPPDATA -ChildP ...
+ ~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [Join-Path], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.JoinPathCommand
The variable '$script:PSGetAppLocalPath' cannot be retrieved because it has not been set.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:48 char:86
+ ... werShell.Management\Join-Path -Path $script:PSGetAppLocalPath -ChildP ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (script:PSGetAppLocalPath:String) [], RuntimeException + FullyQualifiedErrorId : VariableIsUndefined
The variable '$script:PSGetAppLocalPath' cannot be retrieved because it has not been set.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:51 char:81
+ ... werShell.Management\Join-Path -Path $script:PSGetAppLocalPath -ChildP ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (script:PSGetAppLocalPath:String) [], RuntimeException + FullyQualifiedErrorId : VariableIsUndefined
WARNING: The property 'Values' cannot be found on this object. Verify that the property exists.
WARNING: The property 'Keys' cannot be found on this object. Verify that the property exists.
WARNING: The variable '$script:PSGetModuleSourcesFilePath' cannot be retrieved because it has not been set.
PackageManagement\Install-Package : No match was found for the specified search criteria and module name 'PSWindowsUpdate'. Try Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1772 char:21
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Exception + FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage
So far, it seems to be working if the console is logged on, or if the OS is 2008 R2.
Here's the script (it has no error handling or much intelligense yet, but it does the job..)
$guestuser = "administrator"
$guestpass = "password"
$skipupdates = "KB4033369,KB4033342"
$toolspath = "[Isofiles] VMware/VMware Tools/10.2.0/vmtools/windows.iso"
if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
$rawUI = $Host.UI.RawUI $oldSize = $rawUI.BufferSize $typeName = $oldSize.GetType( ).FullName $newSize = New-Object $typeName (120, $oldSize.Height) $rawUI.BufferSize = $newSize }
Clear-Host
foreach ($vm in (Get-Folder Templates | Get-VM | Sort-Object Name | Where-Object {$_.PowerState -eq "PoweredOn" -and $_.guestid -match "windows" })) {
Write-Host Processing: $vm.name $file = "c:\temp\$($vm.name).txt" $now = get-date add-content $file "Actions started on $now" Write-host " - Adding registry values for Spectre/Meltdown patches" add-content $file "Adding registry values for Spectre/Meltdown patches" $output = Invoke-VMScript -vm $vm -ScriptText "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat /v cadca5fe-87d3-4b96-b7fb-a231484277cc /t REG_DWORD /d 0 /f" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType bat add-content $file $output Write-host " - Installing NuGet package provider" add-content $file "Installing NuGet package provider" $output = Invoke-VMScript -vm $vm -ScriptText "Install-PackageProvider nuget -force" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output Write-host " - Installing PSWindowsUpdate module" add-content $file "Installing PSWindowsUpdate module" $output = Invoke-VMScript -vm $vm -ScriptText "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass; Import-Module PowerShellGet; Start-Sleep -Seconds 10; Install-Module -Name PSWindowsUpdate -force -scope AllUsers" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output if ($skipupdates -eq "") { Write-host " - Downloading all Windows Updates" add-content $file "Downloading all Windows Updates" $output = Invoke-VMScript -vm $vm -ScriptText "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass; Import-Module PSWindowsUpdate; Start-Sleep -seconds 10; Get-WindowsUpdate -Download -Verbose -AcceptAll" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output Write-host " - Installing all Windows Updates" add-content $file "Installing all Windows Updates" $output = Invoke-VMScript -vm $vm -ScriptText "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass; Import-Module PSWindowsUpdate; Start-Sleep -seconds 10; Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot -Verbose" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output } else { Write-host " - Downloading all Windows Updates, except $skipupdates" add-content $file "Downloading all Windows Updates, except $skipupdates" $output = Invoke-VMScript -vm $vm -ScriptText "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass; Import-Module PSWindowsUpdate; Start-Sleep -seconds 10; Get-WindowsUpdate -Download -Verbose -AcceptAll -NotKBArticleID $skipupdates" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output Write-host " - Installing all Windows Updates, except $skipupdates" add-content $file "Installing all Windows Updates, except $skipupdates" $output = Invoke-VMScript -vm $vm -ScriptText "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass; Import-Module PSWindowsUpdate; Start-Sleep -seconds 10; Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot -NotKBArticleID $skipupdates -Verbose" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType PowerShell add-content $file $output } Write-Host " - Waiting 180 seconds for reboot to complete" Start-Sleep -Seconds 180 Write-host " - Running cleanup script" add-content $file "Running cleanup script" $output = Invoke-VMScript -ToolsWaitSecs 360 -vm $vm -ScriptText "c:\install\cleanup.cmd" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType bat add-content $file $output Write-Host " - Upgrading VMware Tools" add-content $file "Upgrading VMware Tools" Get-CDDrive -vm $vm | Set-CDDrive -IsoPath $toolspath -Connected:$true -Confirm:$false | Out-Null Write-Host " - Waiting for ISO to be mounted" Start-Sleep -Seconds 15 $output = Invoke-VMScript -ToolsWaitSecs 360 -vm $vm -ScriptText "Z:\setup64.exe /s /v ""/qn REBOOT=Force ADDLOCAL=ALL REMOVE=Hgfs""" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType bat add-content $file $output #sleep added due to vmware tools upgrade trashing the connection Write-Host " - Waiting five minutes for VMware Tools installation to complete" Start-Sleep -Seconds 300 Write-Host " - Dismounting ISO file" Get-CDDrive -vm $vm | Set-CDDrive -NoMedia -Connected:$false -Confirm:$false | Out-Null Write-host " - Shutting down the VM" add-content $file "Shutting down the VM" $output = Invoke-VMScript -vm $vm -ScriptText "shutdown /s /f /t 10 /d p:0:0" -GuestUser $guestuser -GuestPassword $guestpass -ScriptType Bat add-content $file $output
}
Have anyone else encountered problems with Invoke-VMScript and powershell?
(Note, I could prepare a BAT/CMD that does all the above, but this can be used for other purposes as well when automating customer patching later on)
Message was edited by: Andreas Cederlund
Forgot to edit out password :-)
