Remove computer from AD using vCO during vCAC Decommission

As vCloud Automation Center (vCAC) gains traction, so too does the need for details on how to extend it using vCenter Orchestrator (vCO). I have kept an eye out for good articles on vCAC and just saw a great one at the DailyHypervisor.com blog around Adding a computer account to Active Directory OU. This is something that we had done for LifeCycleManager (LCM) quite some time back and feel it is a good candidate for a vCO-centeric article. So a quick thanks to Sid Smith for his article. Our focus will be on deleting the Computer Object from Active Directory when the Machine gets decommissioned. The techniques described here will help understand the steps needed for other integrations as well. This task can obviously be performed by PowerShell, dsrem.exe, and any other number of methods, but this article will provide you with a vCO way to do it. It should also be noted that vCAC has an AD Clean-Up wizard that will remove the machine record form AD when configured, but it may not have the logging capabilities that are used in this vCO example.

Dependencies

vCloud Automation Center (vCAC)

  • Configured with at least one vCO Endpoint
  • Configured with at least one Windows Template
  • Design Center installed/configured

vCenter Orchestrator (vCO)

Before getting started, we'll need to create a vCO workflow that gets triggered by vCAC. For the input, we'll just want the name and a true/false to indicate whether the computer account should be deleted or just disabled (default).

vCO Workflow - Delete or Disable ComputerAD by Name

vCO_Workflow_-_Delete_or_Disable_ComputerAD_by_Name_58fd98513621934a6dc4606540e8363b_add0ede6225d7ccebb6ce1844cc629ba_1c42217c88376a47c15873c9c0151987.png

The workflow shown above is contained in the attached package file. It consists of a custom action that gets an AD:ComputerAD object from the computer name string that is passed into it. It then, checks the "deleteComputer" input variable to see whether the workflow should Delete or simply Disable the computer account. Once the action is determined, it is logged and performed. In the case of an error during the action, System and Server logging takes place and an exception is thrown.

Here's a look at the content of the getComputerADbyName action:

var computers = ActiveDirectory.getComputerADRecursively(computerName);
//System.log("Computer count: "+computers.length);
for each (pc in computers){
    //System.log("Checking computer: "+pc.name);
    if (computerName.toLowerCase() == pc.name.toLowerCase()){
        //System.log("Found Computer: "+pc.name);
        return pc;
    }
}

// Nothing found so throw exception:
throw "No matching Computer found: " + computerName;

As you can see, the script performs a recursive search of Active Directory to locate the computer account. It then checks each result's lowercase value to against the input computerName's lowercase value to ensure a match. Once the match is found, it is returned to the calling workflow. If no match is found, an exception is thrown and logged.

Modify vCAC Workflow Stub to execute vCO Workflow

You'll now need to open the vCAC Designer (Start -> Programs -> VMware -> vCAC Designer) so that the workflow stub can be modified. Since we want this particular workflow to execute upon decommission, we'll need to modify the WFStubMachineDisposing workflow. (You could optionally use the WFStubUnprovisionMachine instead of WFStubMachineDisposing)
After you Open the vCAC Designer:

  1. Click on Load in the Menu bar
  2. Select the WFStubMachineDisposing workflow.
  3. Click OK

media_1366136009779_8ea140d5adf3ba89a154bcb4c7d48356_06d57827d13372b34657210ab03de2cb_91c067241749ed05c319c21eaace22e9.png

Double-Click "Machine Disposing"

media_1366137053371_590cc635fcf46846e3ca1f8edb8c7f89_7dc48dddc32ec4541b83a3a175cfb22c_f8567e032552d7b8e2f1db7d175464b0.png

Double-Click "Custom Code"

media_1366137247967_a09b5c8492fa5986dde1efd995410294_6090b5e97e937f564fdf117cf2ad8db8_adca865d59704794d1675472a3e9a3e0.png

The first thing you'll need to get before you can call the vCO workflow is the Machine information. We'll need a variable to store the computerName we extract from the workflow:
At the bottom of the Custom Code Window:

  1. Click Variables
  2. Now Click the Create Variable line directly under the mgmtContext variable, and name the new variable computerName (This variable will be used later and it IS Case sensitive). Leave the Variable type as String and Scope as Custom Code

media_1366138803634_a005ac4d6cafcd88c390feb4dbdc1dde_817892391724ef4c9381f3d90e0e9e8d_7df6e36debb58b3baef361db7353f818.png

So, Drag the GetMachineName activity and position it below the Start

media_1366137511541_01418b84b56f2083fb7b1ebcac714aee_a86e2e40733c36276235a8626672e74d_780af7813b4684c27c0f68d7e2f14e09.png

  1. Now connect Start to GetMachineName by hovering over start until you see the little connectors show up, then click and drag down to GetMachineName
  2. Double-click the GetMachineName activity and fill in the Machine Id and Machine Name as follows.

media_1366137797698_a5a7e061588e3f10157ee1f3bd3c8ace_94131924cc17d8d40de5f40cc427ef2c_b7f2267d3d172ed6d4e8292d36c9f46c.png

Fill in the boxes as follows:
Note: Case Sensitive

  1. Machine Id to "virtualMachineId"
  2. Machine Name = computerName
  3. Now Click Custom Code at the top of the screen to return to the custom part of the workflow

media_1366139250136_66cd3e564d8572515c82806ede070a70_acba715c13ab4bea07e358541582e17f_c3de35d5761bdf2a6259d0045196ce78.png

  1. Click and Drag the Invoke vCO Workflow activity onto the workflow and connect it to the GetMachineName activity
  2. Click the elipsis button to select the Workflow

media_1366140649294_6cbad5d0d686db269da46da83a250bc8_51dabf979be8c93eb5fffc03cbfe6731_318f006458bcfe4898d0dbf47f70f26d.png

  1. Start typing "Delete or Disable" in the top filter box
  2. Select the Delete or Disable ComputerAD by Name workflow
  3. Click OK

media_1366140683424_b14668e608266e1f2c0bb98cb15d995f_38286802535dbd16474c807719c79946_1d18dc9714de34f0479b8ff5e2fcb09c.png

  1. Enter the variable we created earlier into the computerName field... note that our variable name is also "computerName" and is case sensitive
  2. Enter "True" for the delete Computer field. If you prefer to simply Disable the computer account in AD instead of Delete, then enter False in this box
  3. Enter virtualMachineId in the VirtualMachineId proprties field in the right pane

media_1366141472235_e5f5ea3cd56bb810d61f8af2ee1ce6a7_d38588edec2919199347c3f547ef7f56_60c4ed4731214e2d26eb00c3501bed99.png

Confirm that there are no Errors in the workflow. Errors will be indicated by a red exclamation point icon in the top right of workflow activities. Once you have confirmed there are no errors, click the Send button in the toolbar.

media_1366141644081_74b583ea8cc68b84a287791f95df0450_e85003422c0463ae5ddec91a4bcf744e_b47b3e7296da7d4b7d55ff2dc5cb85b0.png

Enter a brief description in the box provided and click OK

media_1366141793634_350fa907c85bdbee01eb104f4758fbca_f3961f45c44e40c85c07009a78a83cb3_e2dc5d1fbd8653a3b71538375f912d09.png

Click OK on the Success message window

Configure_vCAC_to_use_the_call-out_to_vCO_d108e8dc0bc5d3670b4e9ab4c257ce59_6d43931c5c5b9ec608ddea0bb5a4f677_65f2ae53890eb61d41f7d6b002676f8b.png

Configure vCAC to use the call-out to vCO

In order for the custom work to actually be used by vCAC we need to configure a custom property that tells it to enable one of the stubs. In our case, this is the MachineDisposing stub. You may refer to page 18 of the vCAC 5.1 Extensibility guide for a table listing each of the stubs and the corresponding property.

To enable this particular call-out, add the following property to a blueprint that is to be added to a domain:
ExternalWFStubs.MachineDisposing

Note: no value is required for the property above, the property simply has to exist and be bound to the blueprint in order for it to be used.

media_1366142368254_5ffa4495a387e99ddbba9b2d7f0889d2_f0b41fb505cc4be05a431f496b2e4439_5d8e1f0c73ddf3078ab8b17ffea30cdc.png

Now, go ahead and provision a VM using that blueprint and confirm that a domain account was created in the Computers container or whatever OU it was configured to be placed in. Once you have confirmed that an account exists, Use the vCAC interface to Destroy the computer. This should trigger the MachineDisposing stub that we have created, resulting in the AD account beling deleted (or disabled) depending on how you configured your workflow.

NUC Lab Kit

Below are my thoughts for a vSAN nuc lab. Since I already have cables, not including them here. I ordered (and received by Nov 30, 2016)
3 x nuc, 3 x 32GB Crucial mem, 3 x Toshiba NVMe drive, 3 x Startech USB to GB NIC, and 3 x Crucial 1TB SSD. I've also been very happy with my Cisco SG300-10 so I bought one more since my existing one only has one port available. Each of the items listed here are linked below - all were purchased using the provided links below.
single NIC (See this post for details on using the USB -> GB NIC item listed below

I stayed with the i5 for the power consumption and form factor vs. the i7 Skull Canyon ;)

 

Search

Experts Exchange