Since PowerCLI 13 is released last week (November the 22nd, 2022), I started the update process on my Windows and MacOS device. I needed the latest version to be able to create a customized ESXi 8 ISO installer for the vExpert Maxtang NUC that has the Realtek USB NIC drivers in it.
I found out it isn’t as straightforward as the PowerCLI documentation would suggest, which I want to share with you.
PowerCLI 13.1 is released which has broader Python version support. Version 3.7.1 and all later ones are supported according to VMware. Based on my experience and feedback from readers is that v3.7.9 is the one to be used to prevent all sort of ISO creation issues.
When looking for a MacOS version on this matter, check out William Lam his post about ‘How to install PowerCLI 13.0 and use new Image Builder & Auto Deploy cmdlets on Apple Silicon‘. He wrote it for Apple Silicon devices, but with a few modifications it’s perfectly usable for Intel based Macs also.
The update process for Windows is pretty straightforward. Use the Update-Module command for my 12.2 version and off you go. Well, almost…
PS C:\Users\User> Update-Module VMware.PowerCLI -Scope CurrentUser Untrusted repository You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'? [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): Y Install-Package: Authenticode issuer 'Efirstname.lastname@example.org, CN="VMware, Inc.", O="VMware, Inc.", L=Palo Alto, S=California, C=US' of the new module 'VMware.VimAutomation.Sdk' with version '184.108.40.20691442' from root certificate authority 'CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US' is not matching with the authenticode issuer 'CN="VMware,Inc.", O="VMware, Inc.", L=Palo Alto, S=California, C=US' of the previously-installed module 'VMware.VimAutomation.Sdk' with version '220.127.116.1131155' from root certificate authority 'CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US'. If you still want to install or update, use -SkipPublisherCheck parameter.
I saw two possible solutions. First, skip the issue by using the “-SkipPublisherCheck” parameters and second, uninstall the previous PowerCLI version as described in the PowerCLI documentation. I chose to go the latter route while reasoning it would prevent me from future certificate issues.
I uninstalled the old PowerCLI and installed the latest one by using:
(Get-Module VMware.PowerCLI -ListAvailable).RequiredModules | Uninstall-Module -Force Get-Module VMware.PowerCLI -ListAvailable | Uninstall-Module -Force
Still getting Authenticode issuer errors?
I found a post on the blog “http://vcloud-lab.com” which also mentions the Authenticode issuer error. A long story short, it seems like I installed PowerCLI a while ago without the “scope user” option. Therefore the PowerCLI modules got installed in “C:\Program Files\WindowsPowerShell\Modules“, instead of in your profile “C:\Users\<user>\Documents\PowerShell\Modules”.
After the uninstalling all PowerCLI modules in the previous section, I manually deleted all the remaining PoweCLI related modules (VMware.*) from the “C:\Program Files\WindowsPowerShell\Modules” and hope this will permanently solve the “Authenticode issuer” error.
When you get errors uninstalling PowerCLI, start a new PowerShell session using the “Run as Administator” option and try again. That worked for me. Before install Now go ahead and install the latest 13.x version of PowerCLI using normal permissions again.
Install-Module VMware.PowerCLI -Scope CurrentUser
Python for ImageBuilder
AutoDeploy and ImageBuilder are multi-platform since PowerCLI 13 of which the latter now requires Python to be installed. For ImageBuilder to work, Python 3.7, pip, some additional modules and the “Set-PowerCLIConfiguration” are required as shown below.
Without Python being properly configured the error shown below is thrown.
PS C:\Users\User\Downloads> Get-DepotBaseImages -depot VMware-ESXi-8.0-20513097-depot.zip Get-DepotBaseImages: Could not initialize the VMware.ImageBuilder PowerCLI module. Make sure that Python 3.7 is installed and that you have set the path to the Python executable by using Set-PowerCLIConfiguration -PythonPath. See the PowerCLI Compatibility Matrixes for information on the Python requirements.
To my taste the PowerCLI documentation section that describes “Install Python on Windows” is too brief, so let’s get started.
Download Python v3.7.9 (despite v3.7.16 is the latest version) and start the Installer. I used the 3.7.9 version because all the newer ones don’t have a binary (installer) version. Based on my experience and feedback from readers is that v3.7.9 is the one to be used to prevent all sort of ISO creation issues.
Check the box to add Python to the PATH variable and hit “Install Now” which installs in:
After the installation of Python is finished, download and execute get-pip.py in a terminal window, using the path above. This step could get you confused, since pip3.7.exe is already installed as part of the Python installer. The pip version that came with the Python installer is an old version (10.0.1), which the get-pip.py script updates to the latest one (22.3.1) as can be seen below.
PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe C:\Users\<User>\Downloads\get-pip.py Collecting pip Downloading pip-22.3.1-py3-none-any.whl (2.1 MB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.1/2.1 MB 16.3 MB/s eta 0:00:00 Collecting wheel Using cached wheel-0.38.4-py3-none-any.whl (36 kB) Installing collected packages: wheel, pip WARNING: The script wheel.exe is installed in 'C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Attempting uninstall: pip Found existing installation: pip 10.0.1 Uninstalling pip-10.0.1: Successfully uninstalled pip-10.0.1 WARNING: The scripts pip.exe, pip3.7.exe and pip3.exe are installed in 'C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Successfully installed pip-22.3.1 wheel-0.38.4
Instead of downloading and executing get-pip.py, pip should also be updated to the latest version by executing the line below.
PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe -m pip install --upgrade pip #If pip is already updated it shows: Requirement already satisfied: pip in c:\users\<User>\appdata\local\programs\python\python37\lib\site-packages (22.3.1)
Additional pip modules for ImageBuilder
When the update of pip (mentioned above) is not performed the installation of the additional Python modules will fail with a message that your version of pip is old and secondly a message that ‘Microsoft Visual C++ 14.0 or greater is required’, which you obviously don’t need when pip is up-to-date.
Errors with outdated pip
For informational purposes the error message when pip is not updated, is:
... copying psutil\tests\__main__.py -> build\lib.win-amd64-cpython-37\psutil\tests running build_ext building 'psutil._psutil_windows' extension error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/ ---------------------------------------- Command "c:\users\<User>\appdata\local\programs\python\python37\python.exe -u -c "import setuptools, tokenize;__file__='C:\\Users\\<User>\\AppData\\Local\\Temp\\pip-install-u8srqv0e\\psutil\\setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record C:\Users\<User>\AppData\Local\Temp\pip-record-pz43kgey\install-record.txt --single-version-externally-managed --compile" failed with error code 1 in C:\Users\<User>\AppData\Local\Temp\pip-install-u8srqv0e\psutil\ You are using pip version 10.0.1, however version 22.3.1 is available. You should consider upgrading via the 'python -m pip install --upgrade pip' command.
When on the other hand pip is up-to-date, the installation of the additional modules in the “Scripts” sub-folder is a breeze.
PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts> .\pip3.7.exe install six psutil lxml pyopenssl Collecting six Downloading six-1.16.0-py2.py3-none-any.whl (11 kB) Collecting psutil Downloading psutil-5.9.4-cp36-abi3-win_amd64.whl (252 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 252.5/252.5 kB 15.1 MB/s eta 0:00:00 Collecting lxml Downloading lxml-4.9.2-cp37-cp37m-win_amd64.whl (3.8 MB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.8/3.8 MB 27.4 MB/s eta 0:00:00 Collecting pyopenssl Downloading pyOpenSSL-22.1.0-py3-none-any.whl (57 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 57.0/57.0 kB ? eta 0:00:00 Collecting cryptography<39,>=38.0.0 Downloading cryptography-38.0.4-cp36-abi3-win_amd64.whl (2.4 MB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.4/2.4 MB 51.5 MB/s eta 0:00:00 Collecting cffi>=1.12 Downloading cffi-1.15.1-cp37-cp37m-win_amd64.whl (179 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 179.3/179.3 kB ? eta 0:00:00 Collecting pycparser Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 118.7/118.7 kB ? eta 0:00:00 Installing collected packages: six, pycparser, psutil, lxml, cffi, cryptography, pyopenssl Successfully installed cffi-1.15.1 cryptography-38.0.4 lxml-4.9.2 psutil-5.9.4 pycparser-2.21 pyopenssl-22.1.0 six-1.16.0
Set PowerCLI Python path
Set-PowerCLIConfiguration -PythonPath C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe -Scope User
If this step fails with the error ‘Set-PowerCLIConfiguration: A parameter cannot be found that matches parameter name ‘PythonPath’.‘, in my case PowerCLI 13.x was not yet installed.
After setting the ‘Set-PowerCLIConfiguration -PythonPath’ the PowerShell session needs to be re-opened before using ImageBuilder. Else it still fails.
Set PowerCLI InvalidCertificateAction
In my case. I still got an error when performing the “Get-DepotBaseImages” command. It says:
Get-DepotBaseImages: The InvalidCertificateAction setting 'Warn' is not supported on this platform. Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Fail or Ignore.
I fixed the issue by running:
PS C:\Users\<user>> Set-PowerCLIConfiguration -InvalidCertificateAction Fail
After setting the ‘Set-PowerCLIConfiguration‘ the PowerShell session needs to be re-opened before using ImageBuilder. Else it still fails.
After performing the steps in this post, you can go ahead and use ImageBuilder to create a customized ESXi8 ISO Image.
I have never had so much trouble getting PowerCLI to work and needing to read so much blogs and documentation pages to fix just a single issue, which basically was to use ImageBuilder to create a custom ESXi ISO.
Anyway, I hope it helps fixing you issues with PowerCLI.
VMWare PowerCLI 13 release blog
VMware PowerCLI 13.1 release blog
PowerCLI Documentation – Install Python on Windows
DACBARBOS Brand · March 22, 2023 at 02:34
Thanks for sharing this. It helped me save valuable time.
Daniël Zuthof · March 22, 2023 at 08:28
Thanks for your kind reaction. Great to hear it helped 👍