Installation guide

Table Of Contents

In-line: The default WCI filter uses an in-line script to collect basic information about the PowerShell

version, .NET version, and execution policy settings. The in-line option requires a collection script that is

represented as a single line of PowerShell code. Because the filter runs an in-line script on the

PowerShell command line, instead of using a file, the execution policy does not apply.

Script file: For script-based filters in WCI, the default script type command line includes options to set

the process-level execution policy to Remote Signed. The script requires that the execution policy be set

to Remote Signed at the most restrictive level because the script runs from a file that resides locally on

the VCM managed Windows machine. For WCI, VCM can execute collection scripts on managed

machines where the machine and user level signing policies are set to any level, without requiring you

to change the setting.

Built-In PowerShell Policy Settings

Before you use the WCI collection filter to run file-based PowerShell scripts on the VCM Collector and

your VCM managed machines, you must change the execution policy on the VCM managed machines.

PowerShell contains built-in execution policies that limit its use as an attack vector. By default, the

execution policy is set to Restricted, which is the primary policy for script execution.

The following policy settings apply to PowerShell scripts.

AllSigned: PowerShell scripts must be signed by a verifiable certificate from the Software Publishing

Certificate store. The typical file extension is .ps1. For signed scripts, you can set the execution policy

to All Signed. You must sign the scripts and distribute the appropriate certificates before you collect

WCI data.

RemoteSigned: A verifiable certificate must sign any PowerShell script that you download from the

Internet using a supported browser such as Internet Explorer. Script files that are not required to be

signed are scripts that you create locally or scripts that you download using a method that does not

support flagging the file source. For unsigned scripts, you must set the execution policy to the most

restrictive level of Remote Signed. You can set the policy directly by using a Group Policy Object (GPO)

with a VCM remote command. You can use a registry change action or enforceable compliance. For

example:

HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell

"ExecutionPolicy"="RemoteSigned"

Unrestricted: All PowerShell script files run regardless of whether they are signed by a verifiable

certificate.

Restricted: You can use PowerShell interactively or to run commands directly from the command line.

This setting is the default.

References on PowerShell and Script Signing

For information about Windows PowerShell and script signing policies, see the Microsoft Web site.

Create an Example PowerShell Script for Scheduled Tasks

Use a custom PowerShell script to collect Windows Custom Information (WCI) data from VCM managed

Windows machines. With this example, you can learn how to use PowerShell scripts to collect WCI data

for scheduled tasks.

Windows provides the schtasks.exe utility to report on scheduled tasks that you create in the Task

Scheduler user interface or by using the AT command. The schtasks.exe utility enables you to manage

scheduled tasks on a local or remote computer and to report on the scheduled tasks.

vCenter Configuration Manager Administration Guide

VMware, Inc.