PortGroup Permissions

[edkane]

I am looking for help from community in building a script to report permissions on Portgroups.  I have been working to work with get-vipermission, but have been having difficulties figuring out the proper formatting.

[LucD · Accepted solution]

The current Get-ViPermission cmdlet doesn't seem to handle portgroups correctly.

Try something like this

$authMgr = Get-View AuthorizationManager 
$roles = @{}
$authMgr.RoleList | %{
    $roles.Add($_.RoleId,$_.Name)
}

$report = foreach($esx in Get-VMHost){
    foreach($net in (Get-View $esx.ExtensionData.Network)){
        $authMgr.RetrieveEntityPermissions($net.MoRef,$true) | 
        Select @{N="Host";E={$esx.Name}},
            @{N="Portgroup";E={$net.Name}},
            @{N="Propagate";E={$_.Propagate}},
            @{N="Permission on";E={(Get-View $_.Entity).Name}},
            Principal,@{N="Role";E={$roles[$_.RoleId]}}
    }
}

$report | Format-Table -AutoSize 

The script will also list the inherited permissions.

If you only want the permission applied on the portgroups themselves replace this line

        $authMgr.RetrieveEntityPermissions($net.MoRef,$true) | 

with this line

        $authMgr.RetrieveEntityPermissions($net.MoRef,$false) |