#This script is a Generic Host Profile that could be applied to an ESXi host after it is newly built from ISO or from a base build.  The configurations are for reference. Most commands are not required but do conform to most configuration baselines suggested in Performance and third party documents.  The commands do not require the host to be in Maintenance Mode to complete but some commands could cause an outage if not executed correctly.  Some commands below may require some additional changes, (editing the IP Address or vmnic numbers.)  Please review the commands before running against your Production hosts.

### Set the Vars
$myhost = “esx01.pcli.me”
$myDomain = “pcli.me”
$myDNSServer1 = “8.8.8.8”
$myDNSServer2 = “208.67.222.222”
$myNTPServer = “ntp.pcli.me”
$mySyslogServer = “loginsight.pcli.me”

$vmotionIP1 = “10.10.10.10”
$vmotionIP2 = “10.10.10.11”
$vmotionSubnetMask = “255.255.255.0”
$vmotionVlanID = “0”

$myVDSwitch = “dvs-pcliCore”
$myVDSSwitchNICs = “vmnic6″,”vmnic7″,”vmnic8″,”vmnic9”

### Run the commands…
##Set the domain
get-vmhostnetwork -VMHost $myhost | set-vmhostnetwork -searchdomain $yourDomain -domain $yourDomain -DnsAddress @($myDNSServer1,$myDNSServer2)

##Set the NTP server and restart the service.
if(get-vmhostntpserver -vmhost $myhost){remove-vmhostntpserver -host $myhost -ntpserver (get-vmhostntpserver -vmhost $myhost) -confirm:$false}
add-vmhostntpserver -vmhost $myhost -ntpserver @($myNTPServer)
Get-VmHostService -VMHost $myhost | Where-Object {$_.key -eq “ntpd”} | Set-VMHostService -Policy “on” -Confirm:$false
Get-VmHostService -VMHost $myhost | Where-Object {$_.key -eq “ntpd”} | ReStart-VMHostService -confirm:$false

##Set the syslog server and open the firewall
set-VMHostAdvancedConfiguration -VMHost $myhost -Name “Syslog.global.logHost” -Value $mySyslogServer -confirm:$false
Get-VMHostFirewallException -name ‘syslog’ -vmhost $myhost | Set-VMHostFirewallException -Enabled:$true

##Enable SSH, restart service and set session vars to meet Security Requirements
Get-VmHostService -VMHost $myhost  | Where-Object {$_.key -eq “TSM-SSH”} | Set-VMHostService -Policy “on” -Confirm:$false
Get-VmHostService -VMHost $myhost  | Where-Object {$_.key -eq “TSM-SSH”} | ReStart-VMHostService -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.SuppressShellWarning” -Value “1” -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.ESXiShellTimeOut” -Value “900” -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.ESXiShellInteractiveTimeOut” -Value “900” -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “Security.AccountLockFailures” -Value “5” -confirm:$false

##Rename the local datastore to “hostname-local”
$localDS = “”+(($myhost).split(“.”))[0]+”-local”
if(get-vmhost $myhost |get-datastore | where {$_.name -match “datastore”}){get-vmhost $myhost | get-datastore | where {$_.name -match “datastore”} | set-datastore -name $localDS}

##Create a new standard switch for vmotion, add two physical nics, set the security policy, then create two vmotion vmknics
#### ** BE SURE to edit the VMNIC numbers below (vmnic2 and vmnic3) to match your physical nic numbers.
#### ** If you want to combine vmotion vmknics on the management vSwitch (vSwitch0) skip to the code below this.
$thevmotionswitch = new-virtualswitch -vmhost $myhost -name “vSwitchVMotion” -mtu 9000 -nic “vmnic2″,”vmnic3”
$esx=get-vmhost $myhost
$esxid=$esx |% {get-view $_.Id}
$esxidconfig=$esxid.configmanager
$esxns=$esxidconfig.networksystem
$esxnsview=get-view $esxns
$esxvSwitch=$esxnsview.NetworkConfig.Vswitch | where {$_.Name -eq $thevmotionswitch}
$specChange= $esxvSwitch.Spec
$specChange.policy.security.allowPromiscuous=$false
$specChange.policy.security.forgedTransmits=$false
$specChange.policy.security.macChanges=$false
$esxnsview.UpdateVirtualSwitch($esxvSwitch.name,$specChange)
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion0 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion0 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP1 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion0” | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic3” -MakeNicStandby “vmnic2”
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion1 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion1 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP2 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic2” -MakeNicStandby “vmnic3”
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion1” | get-nicteamingPolicy

##**** If you want to run vmotion on your management switch (vSwitch0) use this code instead.
##** Again, edit the vmnic numbers below as needed.
$thevmotionswitch = get-virtualswitch -vmhost $myhost -name “vSwitch0”
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion0 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion0 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP1 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion0” | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic0” -MakeNicStandby “vmnic1”
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion1 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion1 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP2 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion1” | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic1” -MakeNicStandby “vmnic0”

##Add the host to a vDS then add its Physcial NICs to the switch
Add-VDSwitchVMHost -vdswitch $myVDSwitch -vmhost $myhost
$hostadapter = get-vmhost -name $myhost | Get-vmhostnetworkadapter -physical -name $myVDSSwitchNICs
get-vdswitch $myVDSwitch  | add-vdswitchphysicalnetworkadapter -vmhostnetworkadapter $hostadapter -confirm:$false

##Create a portgroup on an existing Standard Switch
$vswitch0 = get-virtualswitch -vmhost $myhost -name “vSwitch0”
new-VirtualPortGroup -virtualswitch $vswitch0 -name “10.10.10.0”

##Set the host Power Policy to “High Performance” to reduce cpu latency.
$view = (Get-VMHost $myhost | Get-View)
(Get-View $view.ConfigManager.PowerSystem).ConfigurePowerPolicy(1)

##Move the local datastore into a datastore folder named “localdisk”  Folder must exist.
get-vmhost $myhost | get-datastore | where {$_.name -match “-local”} | move-datastore -destination (get-folder “localdisk”)

##Make sure both physical adapters on your management switch (vSwitch0) are set to active,active to prevent an outage.
$theManagementSwitch = get-virtualswitch -vmhost $myhost -name “vSwitch0”
$thenics = get-virtualswitch -vmhost $myhost -name $theManagementSwitch | Get-vmhostnetworkadapter | where {$_.name -notmatch “vmk”}
$vnicchange = get-virtualswitch -vmhost $myhost -name $theManagementSwitch | Get-virtualportgroup -name “Management Network” | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive $thenics

##If you use NFS storage, set the host NFS Advanced Vars to NFS Storage Vender Specs:
$Cmyhost = Get-VMHost $myhost
$Cmyhost | get-advancedsetting -name VMFS3.hardwareacceleratedlocking | set-advancedsetting -Value 1 -confirm:$false
$Cmyhost | get-advancedsetting -name Net.TcpipHeapSize | set-advancedsetting -Value 32 -confirm:$false
$Cmyhost | get-advancedsetting -name Net.TcpipHeapMax  | set-advancedsetting -Value 1536 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.MaxVolumes  | set-advancedsetting -Value 256 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS41.MaxVolumes  | set-advancedsetting -Value 256 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.MaxQueueDepth  | set-advancedsetting -Value 64 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatMaxFailures  | set-advancedsetting -Value 10 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatFrequency  | set-advancedsetting -Value 12 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatTimeout  | set-advancedsetting -Value 5 -confirm:$false

##If you need to add a vmknic for NFS traffic on a Virtual Distributed Switch:
$theswitch = get-vdswitch “myNFSVDSwitch”
$thePG = $theswitch | get-vdportgroup | where {$_.name -match “10.10.10.0-NFSvPG”}
New-VMHostNetworkAdapter -VMHost (Get-VMHost $myhost) -virtualswitch $theswitch -PortGroup $thePG -IP “10.10.10.9” -SubnetMask “255.255.255.0”

##Mount up some NFS vols
Get-VMHost $myhost| New-Datastore -Nfs -Name “MyNFSDevice” -Path “/NFSShare1/MyNFSShare” -NfsHost “10.10.10.2”

 

#Here is the PowerCLI 6.5 Command Reference to look up these commands.
https://www.vmware.com/support/developer/PowerCLI/PowerCLI651/html/

After reviewing this Blog and KBs from VMware, it appears that security wins again.   VMware plans to disable Transparent Page Sharing (TPS) in all future releases.
http://kb.vmware.com/kb/2080735
http://kb.vmware.com/kb/2097593
blogs.vmware.com/vsphere/2015/01/assess-the-performance-impact-of-the-security-change-in-transparent-page-sharing-behaviour.html
*The above blog has a great GUI if you like GUIs.  Below I will post some simple Powershell code if you like exporting to Excel etc.  Quick note to Mark: Thank you for the script idea!  Check out my Plink command below so you can reduce your SSH sessions in half.  I also made some powershell commands so we don’t need to export and import text files.  This script was able to scan over 500 ESXi hosts across seven vcenters in under seven minutes.

What this script does:
1 – Pulls all hosts in your vcenter and collects the name, clusterMoRef, and if its in lock down mode
2 – Pulls all clusters in your vcenter and collects the name, MoRef, and total memory allocated in the cluster.
3 – It then uses Plink.exe to SSH into every ESX host (that is not in lockdown mode) and run two commands.
4 – It returns those commands into a fancy report that can be exported to CSV.

From there, you can make some fancy calculations between total cluster memory and TPS savings.  What I did was group all hosts by cluster, add up all of the “Free memory” reported by each host, then check if that number was smaller than the amount saved from TPS.
Thus :  if (Free Mem < TPS saved) then {bad news}

 

#####################################
#edit the following four vars – then paste the code below it
###### The Vars:
cd e:\plink
$PuttyUser = “root”
$PuttyPwd = “salsa”
$avcenter = “MyvCenter”

#####  The Code:
$Plink = “./plink.exe”
$cmd1 = ‘vsish -e get /memory/comprehensive‘
$cmd2 = ‘vsish -e get /memory/pshare/stats‘
$RCommand = ‘”‘ + $cmd1 + ‘ & ‘+ $cmd2 + ‘”‘
$report = @()
$clusterReport = @()
Add-PSSnapin VMware.*
connect-viserver $avcenter -User “administrator@vsphere.local” -password “salsa”
$hostlist = get-view -viewtype hostsystem -property name,Parent,config | select name,parent -expandproperty config | where {$_.admindisabled -ne $true} | select name,parent
$allclusters = get-view -viewtype ClusterComputeResource -property name,summary | select name,moref -expandproperty summary | select name,moref,totalmemory
$clusterReport += $allclusters
foreach($hostname in $hostlist.name){
echo Y | ./plink.exe -l $PuttyUser -pw $PuttyPwd $hostname exit
$command = $Plink + ” -v -batch -pw ” + “`””+$PuttyPwd + ”`” -l ” + $PuttyUser + “ ” + $hostname + ” ” + $RCommand
$data1 = “”
$data1 = Invoke-Expression -command $command
$VMKernelMem = ((($data1 | where {$_ -match “Given to VMKernel”}).split(‘:’)[1]) -replace ‘kb’) / 1048576
$FreeMem = ((($data1 | where {$_ -match “Free:”}).split(‘:’)[1]) -replace ‘kb’) / 1048576
$Pageshared = ($data1 | where {$_ -match “psharing”}).split(‘:’)[1]
$PageZero = ($data1 | where {$_ -match “zero-pages”}).split(‘:’)[1]
if($pageshared -gt 0){$Pageshared=[math]::Round((([int]$Pageshared*4)/1048576),2)}
if($pageZero -gt 0){$pageZero=[math]::Round((([int]$Pagezero*4)/1048576),2)}
$row = “” | select vcenter,cluster,hostname,VMKernelMemGB,FreeMemGB,PagesharedGB,PageZeroGB
$row.vcenter = $avcenter
$row.cluster = ($allclusters | where {$_.moref.value -match ($hostlist | where {$_.name -match $hostname} | %{$_.parent.value})}).name
$row.hostname = $hostname
$row.VMKernelMemGB = $VMKernelMem
$row.FreeMemGB = $FreeMem
$row.PagesharedGB = $Pageshared
$row.PageZeroGB = $PageZero
$report += $row
}
Disconnect-viserver -confirm:$False
$report | export-csv c:\temp\TPSHostdata.csv
$clusterReport | select name,totalmemory | export-csv c:\temp\TPSClusterData.csv

Quick Report script to find those VMs that span more than one Numa Boundary.
Meaning:  If your ESX host has two – quad core CPUs and your VM is configured for six vCPUs,  then your VMs is spanning two NUMA boundaries.
Also, if your VM is configured with 32GB of memory but you only have 24GB of ram Per CPU Socket, your VM will cross memory NUMA boundaries!

Add-PSSnapin VMware.*
$report=@()

Connect-VIServer myvcenter.pcli.me

$temp = get-view -viewtype virtualmachine -property name,runtime.host,config.hardware
$temphost = get-view -viewtype hostsystem -property name,hardware.cpuinfo,hardware.MemorySize
foreach($a in $temp){
$row = “” | select VMname,VMTotalvCPUs,VMSockets,VMCores,CPUCalcNumaNodes,MemCalcNumaNodes
$row.VMname = $a.name
$row.VMTotalvCPUs = $a.config.hardware.numcpu
$row.VMsockets = ($a.config.hardware.numcpu)/($a.config.hardware.NumCoresPerSocket)
$row.VMcores = $a.config.hardware.NumCoresPerSocket
$t = $temphost | where {$_.moref -eq $a.runtime.host}
$nodesCalc = try{[system.math]::ceiling($a.config.hardware.numcpu /($t.hardware.cpuinfo.numcpucores / $t.hardware.cpuinfo.NumCpuPackages))}catch{}
$row.CpuCalcNumaNodes = if($nodesCalc -gt $t.hardware.cpuinfo.NumCpuPackages){$t.hardware.cpuinfo.NumCpuPackages}else{$nodesCalc}
$nodesCalc = if(((($t.hardware.memorysize)/1048576)/$t.hardware.cpuinfo.NumCpuPackages) -lt ($a.config.hardware.MemoryMB)){$nodescalc + 1}else{$nodescalc}
$row.MemCalcNumaNodes = if($nodesCalc -gt $t.hardware.cpuinfo.NumCpuPackages){$t.hardware.cpuinfo.NumCpuPackages}else{$nodesCalc}
$report += $row
}

### format the below output as needed.  It currently reports any VMs that span across more than one NUMA boundary.
$report | where {($_.CPUCalcNumaNodes -ge 2) -or ($_.MemCalcNumaNodes -ge 2)} | ft

 

 

 

#Upgrading a cluster from 5.1 to 5.5 or even updating past the Heart Bleed and need a quick double check that all of the host got the new build?
#I throw this at the entire vcenter but you can narrow it down to per datacenter or cluster if you like…

### Here is the quick (cluster only) code…

$Report = @()
get-cluster myCluster | get-vmhost | %{
$vmhost = Get-View $_.ID
$ReportRow = “” | Select-Object Hostname, build
$ReportRow.Hostname = $vmhost.Name
$ReportRow.Build = $vmhost.summary.config.product.build
$Report += $ReportRow
}
$report | FT

 

### If you want to be more fancy, here is a multi vCenter scan… (check ALL the hosts!)

Add-PSSnapin VMware.VimAutomation.Core

$vcenters = @()
$vcenters += “vcenter1”
$vcenters += “vcenter2”
$vcenters += “vcenter3”

$Report = @()
foreach($vcenter in $vcenters){
Connect-VIServer $vcenter

$clusters = get-cluster
foreach($a in $clusters){
$a | get-vmhost | %{
$vmhost = Get-View $_.ID
$ReportRow = “” | Select-Object vcenter,cluster,Hostname, build
$ReportRow.vcenter = $vcenter
$ReportRow.cluster = $a.name
$ReportRow.Hostname = $vmhost.Name
$ReportRow.Build = $vmhost.summary.config.product.build
$Report += $ReportRow
}
}
Disconnect-viserver -confirm:$False
}
$report | FT

#this code will scan all hosts in your vcenter and check for duplicate IPs. You can narrow the scan by placing a get-cluster or get-datacenter object when loading the “$thedata” var.

$thedata = get-vmhost | Get-VMHostNetwork | Select Hostname, VMkernelGateway -ExpandProperty VirtualNic
$report = @()
$temp = $thedata | %{$_.ip}
$h = @{}
$temp | foreach {$h[“$_”] += 1}
$dups = $h.keys | where {$h[“$_”] -gt 1}
foreach($a in $dups){
$report += $thedata | where {$_.ip -eq $a} | select hostname,ip,ManagementTrafficEnabled,VMotionEnabled
}
$report | ft

######
#sample output :
#HostName     IP                        ManagementTrafficEnabled       VMotionEnabled
#———-         ———-             ———                                             —————-
#esx01              192.168.0.101    False                                                True
#esx06             192.168.0.101    False                                                 True

#if you want the report to include more information you can edit the “report +=” line and add extra fields  (to the select area).
#example : You can add the Devicename and PortGroupName if you need help finding the exact vmk with the dup IP.
$report += $thedata | where {$_.ip -eq $a} | select hostname,ip,devicename,portgroupname,ManagementTrafficEnabled,VMotionEnable

#Looks like playing with vFlash can cause some vCenter Webclient issues….
#KB = http://kb.vmware.com/kb/2072392

#If you want to “remove” all vflash from your hosts so you can get things working again, you can use PowerCLI.
#1 – Download the “Extensions” for vflash (and vsan) here
– – https://labs.vmware.com/flings/powercli-extensions
#2 – Place that folder into your powershell > Modules directory.
– – The most common places is : C:\Windows\System32\WindowsPowerShell\v1.0\Modules
#3 – Import the Extensions : Import-Module VMware.VimAutomation.Extensions
#4 – Verify that the Extensions loaded : get-command -Module VMware.VimAutomation.Extensions
– – Output should show ten new command-lets
#5 – Review your current vFlash config :
– – $hosts = get-cluster pcli.me | Get-VMHost
– – Get-VMHostVFlashConfiguration -VMHost $hosts
– – Output will look close to this:
– – – Name CapacityGB SwapCacheReservationGB Extents
– – – esx1.pcli.me 731 0 {eui.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:P1}
– – – esx2.pcli.me 731 0 {eui.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:P1}

#6 – Remove the config with this command (you can make it smaller but this command worked best for me)
– – get-vmhost esx1.pcli.me| get-VMHostVFlashConfiguration | Set-VMHostVFlashConfiguration -RemoveVFlashResource
– – get-vmhost esx2.pcli.me| get-VMHostVFlashConfiguration | Set-VMHostVFlashConfiguration -RemoveVFlashResource

#7 – Then to verify that things are removed, throw another Get-VMHostVFlashConfiguration -VMHost $hosts

####

This will check your ESXi host and tell you which LUNs support VAAI primitives.

 
$hostname = “myhost.pcli.me”

$report2 = @()
$Datastorelist = get-vmhost $hostname | Get-Datastore
foreach ($ds in $datastorelist) {
$reportrow = “” | Select DatastoreName,CName
$reportrow.DatastoreName = $ds.Name
$reportrow.CName = $ds.extensiondata.info.vmfs.extent | %{$_.diskname}
$report2 += $reportrow
}
$temp = get-esxcli -vmhost $hostname | %{$_.storage.core.device.vaai.status.get()}
$report = @()
foreach($a in $temp){
$ReportRow = “” | Select-Object Hostname,LunName,Device,ATSStatus,CloneStatus,DeleteStatus,VAAIPluginName,ZeroStatus
$ReportRow.hostname = $hostname
$ReportRow.LunName = $report2 | where {$_.cname -eq $a.Device} | %{$_.datastorename}
$ReportRow.Device = $a.Device
$ReportRow.ATSStatus = $a.ATSStatus
$ReportRow.CloneStatus = $a.CloneStatus
$ReportRow.DeleteStatus = $a.DeleteStatus
$ReportRow.VAAIPluginName = $a.VAAIPluginName
$ReportRow.ZeroStatus = $a.ZeroStatus
$report += $reportrow
}
$report | Ft -a

This will enable lockdown mode for your host.
Be careful with this because it will disable your ability to use the root account when you SSH to your host.

(get-vmhost “host1.pcli.me” | get-view).EnterLockdownMode()

To disable use:
(get-vmhost “host1.pcli.me” | get-view).ExitLockdownMode()

This will set the Advanced Setting “CPU Power Policy” for a host.
Keep in mind that some servers require that the BIOS CPU Power management setting be changed to “OS Control” for the ESX Host setting to work. Setting the BIOS to High Performance may use more watts but may reduce CPU wait time for VMs. Waiting for a CPU to “power up / boost to full speed” will create CPU wait time.

Set-VMHostAdvancedConfiguration -vmhost (get-vmhost “MyHost”) -Name Power.cpupolicy -Value static

The value options are:
Static = High Performance
Dynamic = Balanced
Off = Not Configured

This code will get the current value of the host:
Get-VMHost “MyHost” | Select Name,@{N=”Power Policy”;E={
$powSys = Get-View $_.ExtensionData.ConfigManager.PowerSystem
$powSys.Info.CurrentPolicy.ShortName
}}

You can add a host list array, or remove the hostname from the get-vmhost part if you want to check vcenter or cluster wide settings. The same goes for the Set-VMHostAdvancedCOnfiguration line. Creating a foreach loop for each host in a cluster will keep all hosts configured the same.

Vmware Link:
https://www.vmware.com/support/developer/windowstoolkit/wintk40u1/html/Set-VMHostAdvancedConfiguration.html