Virtualization, Cloud, Infrastructure and all that stuff in-between

I ran into this, my dirsync was running ok (new objects copied out from on-prem AD to AAD ok) but password changes on-prem were not going out.

Weird, wasn’t related to this post as no recent password change of the admin account used in the lab.

I can highly recommend using the built-in PowerShell diagnostics tool on your AAD Sync server – just run it by using Invoke-ADSyncDiagnostics in a PowerShell session and follow the prompts.. in my case, it discovered the the password hash sync service wasn’t running, script restarted it.

Not sure if this was some hiccup due to me recently enabling password write-back and some MFA config. but it fixed it for me.

Adjust the minus ( AddDays(-8) value to how many days back you want to check and run, it will output a list of files (with full path) that have a modified date later than the number you specified, handy for sorting out complex data merge issues.

$lastdate = get-date.AddDays(-8) ‘set the minus number to how many days you want to go back
Get-ChildItem -Recurse -File | Where-Object { $_.LastWriteTime -ge $lastdate } | format-table -autosize -property FullName

I have to do this every so-often to reverse engineer the cabling in my lab (which isn’t easily accessible, well.. without some walking and moving things), and by the time I have to do it, I’ve invariably forgotten the command fro the last time and waste time googling the many variants to do so, so – parking it here for reference!

show mac address-table | include

note: MAC needs to be in aaaa.bbbb format (don’t ask me why, you can also search for partial MACs, e.g the last 2 digits)

show mac address-table | include e50d

Will give you an output like..

100 0418.d6ac.e50d DYNAMIC Fa0/44

Given in the public cloud you’ve not got much visibility of what’s going on under the hood in your IaaS VMs this is a handy tool from MSFT – instructions and downloads here

Or you can install it from the Azure portal by following these steps (You’ll need the name and key for one of your storage accounts.

If you install it via the portal you don’t have to login to the VM to enable it.

ok, a little more than a 1-liner; but a shell loop that you can use to do *something* to all hosts in a given cluster (in this case the cluster is called L2-C2; 2nd level of virtualization, e.g. not physical which is L1, 2nd cluster if you’re interested in my naming convention)

in this case it’s adding an iSCSI software adapter and pointing it at some targets – pause is optional (assumes you’re already connected to a vCenter via connect-vihost)

# Generic shell
$cluster = get-cluster L2-C2 | get-vmhost
foreach ($hypervisor in $cluster) {

write-host Doing config for $hypervisor
#Do stuff here for each host in the cluster $hypervisor is the hostname variable
Get-VMHostStorage -VMHost $hypervisor | Set-VMHostStorage -SoftwareIScsiEnabled $True
get-vmhost -name $hypervisor | Get-VMHostHba -Type iScsi | Where {$_.Model -eq “iSCSI Software Adapter”}
Get-VMHost -name $hypervisor | Get-VMHostHba -Type iScsi | New-IScsiHbaTarget -Address “172.16.20.20”
Get-VMHost -name $hypervisor | Get-VMHostHba -Type iScsi | New-IScsiHbaTarget -Address “172.16.20.21”
get-vmhost -name $hypervisor | get-VMhostStorage -refresh -RescanAllHba -RescanVmfs
write-host “————————————————————————————-”
pause #wait for keypress

Connect-VIServer L2-mgt-vcsa01.theborg.int
Get-VMHost | Add-VMHostNtpServer -ntpserver “pool.ntp.org”
Get-VMHost | Get-VMHostFirewallException | where {$_.Name -eq “NTP client”} | Set-VMHostFirewallException -Enabled:$true
Get-VMHost | Get-VmHostService | Where-Object {$_.key -eq “ntpd”} | Start-VMHostService
Get-VMhost | Get-VmHostService | Where-Object {$_.key -eq “ntpd”} | Set-VMHostService -policy “automatic”

Original script from this blog post Modified to add -ntpserver parameter and public NTP server name incase you don’t have your own

Populate variables

$targetdisk = Get-Datastore -name vd03*
$target = get-vmhost -name l1-mgt-slotXX.theborg.int

#Deploy VM from template
new-vm -name L2-C2-NXX -Template TPL_vESXI -vmhost $target -Datastore $targetdisk -runasync

#rinse & repeat

#Connect to vCenter server
$vc = connect-viserver -name l2-mgt-vcsa01.theborg.int
Add-VMHost -server $vc -name L2-C1-N4.theborg.int -location theBORG -user root -Password YourPassword -force -RunAsync

#then add to cluster L2-C1
Move-VMHost L2-C1-N1.theborg.int -destination L2-C1

#Add a bunch of hosts to vCenter 1 liner
for($i=99; $i -le 102; $i++) {$runline= “L2-C2-N” + $i +”.theborg.int” ; Add-VMHost -server $vc -name $runline -location theBORG -user root -Password VMware1! -force -RunAsync}

#put hosts following a naming pattern into maintenance mode
get-vmhost -name L2-c2* | set-vmhost -state maintenance

#move ESX host called L2-C2-N$i to L2-C2 cluster

for($i=2; $i -le 8; $i++) {$runline= “l2-c2-n” + $i +”.theborg.int” ; move-VMHost $runline -server $vc -destination L2-C2}

I hit this and scratched my head for ages. I was using a Mac (so I’ve not tried this in IE or Edge, where I would expect it to work).

if i hit the configure button under “device enrolment” / “Android for Work enrolment” it does nothing in Chrome or Safari (my 2 normal browsers)

spent ages disabling plugins, Private mode etc. however, weirdly – it worked 1st time in FireFox…

So if you hit the same issue and have found this via Google – try that.

online UI and docs are moving quickly for InTune as it’s absorbed into Azure.

weird.