Automating the change of Remove Console Connection limit of a Virtual Machine

Products

• VMware vCenter Server

Issue/Introduction

vSphere Security Guide suggests to "Minimize Use of the Virtual Machine Console" by limiting the number of parallel connections to the virtual machine console.

However, documented procedure suggests changing the settings across the fleet of virtual machine one by one using the UI options. 

This document provides an automation approach using PowerCLI so that set of virtual machines can be updated in batches

 

Environment

VMware vCenter Server

Resolution

Advanced setting that limits the console connections is named as "RemoteDisplay.maxConnections". We can change this using the PowerCLI based automation.

Though this setting can be changed using automation, changes are effective only after the virtual machine process is cold started. You can use the VMotion feature to achieve the same effect as migrating the virtual machine to another host will restart the virtual machine process. 

1. Install PowerCLI 
2. Open PowerCLI Session
3. Connect to the vCenter Server:

      Connect-VIServer -Server VCENTER_SERVER -Protocol https

• Replace VCENTER_SERVER with the IP/FQDN of the vCenter Server hosting the Virtual Machines that you want to change the settings.
• Depending on the configuration, you may be asked for authentication information or SSO will used. 

Updating Settings for a named Virtual machine

Get-VM -Name VMNAME| New-AdvancedSetting -Name RemoteDisplay.maxConnections -Value X -Force

• Replace VMNAME with the name of the Virtual Machine for which the setting need to be changed
• 'X' is the number of connections you want the limit to be set. Optimal value will be based on the requirement in the environment. 

Updating Setting for all virtual machines in a cluster. 

Get-Cluster -Name CLUSTER_NAME | ForEach-Object -Process {
   Get-VM | ForEach-Object -Process {
        New-AdvancedSetting -Entity $_ -Name RemoteDisplay.maxConnections -Value X -Confirm:$false -Force
   }
}

• Replace CLUSTER_NAME with the name of the Cluster of which the Virtual Machines need to be updated
• 'X' is the number of connections you want the limit to be set. Optimal value will be based on the requirement in the environment. 

Note: This action on some solution virtual machines like vCLS Virtual Machines may fail as altering the settings is not supported. While running the changes cluster wide, on screen error for these virtual machines can be safely ignored. Script would continue to update other virtual machines. 

Post applying the changes, migrate the virtual machine to another host using VMotion in order to make the changes effective. 

Additional Information

VMotion of virtual machine will also disconnect all the existing HTML console connections to the virtual machine. This approach can be used to forcefully disconnect any existing connections in case they are deemed stale.