PowerCLI 13 update and installation hurdles on Windows

Since PowerCLI 13 is released last week (November the 22nd, 2022), I started the update process on my Windows and MacOS device. I needed the latest version to be able to create a customized ESXi 8 ISO installer for the vExpert Maxtang NUC that has the Realtek USB NIC drivers in it.

I found out it isn’t as straightforward as the PowerCLI documentation would suggest, which I want to share with you.

Update 9-5-2023

PowerCLI 13.1 is released which has broader Python version support. Version 3.7.1 and all later ones are supported according to VMware. Based on my experience and feedback from readers is that v3.7.9 is the one to be used to prevent all sort of ISO creation issues.

Update 4-1-2024

PowerCLI 13.2 is released and added a new post how to do the same for Linux (See below).

Linux

Now also created for Ubuntu Linux.

PowerCLI 13 installation hurdles on Linux

MacOS

When looking for a MacOS version on this matter, check out William Lam his post about ‘How to install PowerCLI 13.0 and use new Image Builder & Auto Deploy cmdlets on Apple Silicon‘. He wrote it for Apple Silicon devices, but with a few modifications it’s perfectly usable for Intel based Macs also.

Windows

The update process for Windows is pretty straightforward. Use the Update-Module command for my 12.2 version and off you go. Well, almost…

PS C:\Users\User> Update-Module VMware.PowerCLI -Scope CurrentUser

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): Y

Install-Package: Authenticode issuer 'E=noreply@vmware.com, CN="VMware, Inc.", O="VMware, Inc.", L=Palo Alto, S=California, C=US' of the new module 'VMware.VimAutomation.Sdk' with version '13.0.0.20791442' from root certificate authority 'CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US' is not matching with the authenticode issuer 'CN="VMware,Inc.", O="VMware, Inc.", L=Palo Alto, S=California, C=US' of the previously-installed module  'VMware.VimAutomation.Sdk' with version '12.2.0.17531155' from root certificate authority 'CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US'. If you still want to install or update, use -SkipPublisherCheck parameter.

I saw two possible solutions. First, skip the issue by using the “-SkipPublisherCheck” parameters and second, uninstall the previous PowerCLI version as described in the PowerCLI documentation. I chose to go the latter route while reasoning it would prevent me from future certificate issues.

I uninstalled the old PowerCLI and installed the latest one by using:

(Get-Module VMware.PowerCLI -ListAvailable).RequiredModules | Uninstall-Module -Force
Get-Module VMware.PowerCLI -ListAvailable | Uninstall-Module -Force

Still getting Authenticode issuer errors?

I found a post on the blog “http://vcloud-lab.com” which also mentions the Authenticode issuer error. A long story short, it seems like I installed PowerCLI a while ago without the “scope user” option. Therefore the PowerCLI modules got installed in “C:\Program Files\WindowsPowerShell\Modules“, instead of in your profile “C:\Users\<user>\Documents\PowerShell\Modules”.

After the uninstalling all PowerCLI modules in the previous section, I manually deleted all the remaining PoweCLI related modules (VMware.*) from the “C:\Program Files\WindowsPowerShell\Modules” and hope this will permanently solve the “Authenticode issuer” error.

Install PowerCLI

When you get errors uninstalling PowerCLI, start a new PowerShell session using the “Run as Administator” option and try again. That worked for me. Before install Now go ahead and install the latest 13.x version of PowerCLI using normal permissions again.

Install-Module VMware.PowerCLI -Scope CurrentUser

Python for ImageBuilder

AutoDeploy and ImageBuilder are multi-platform since PowerCLI 13 of which the latter now requires Python to be installed. For ImageBuilder to work, Python 3.7, pip, some additional modules and the “Set-PowerCLIConfiguration” are required as shown below.

Without Python being properly configured the error shown below is thrown.

PS C:\Users\User\Downloads> Get-DepotBaseImages -depot VMware-ESXi-8.0-20513097-depot.zip
Get-DepotBaseImages: Could not initialize the VMware.ImageBuilder PowerCLI module. Make sure that Python 3.7 is installed and that you have set the path to the Python executable by using Set-PowerCLIConfiguration -PythonPath. See the PowerCLI Compatibility Matrixes for information on the Python requirements.

To my taste the PowerCLI documentation section that describes “Install Python on Windows” is too brief, so let’s get started.

Install Python

Download Python v3.7.9 (despite v3.7.16 is the latest version) and start the Installer. I used the 3.7.9 version because all the newer ones don’t have a binary (installer) version. Based on my experience and feedback from readers is that v3.7.9 is the one to be used to prevent all sort of ISO creation issues.

Check the box to add Python to the PATH variable and hit “Install Now” which installs in:

C:\Users\<User>\AppData\Local\Programs\Python\Python37

Update pip

After the installation of Python is finished, download and execute get-pip.py in a terminal window, using the path above. This step could get you confused, since pip3.7.exe is already installed as part of the Python installer. The pip version that came with the Python installer is an old version (10.0.1), which the get-pip.py script updates to the latest one (22.3.1) as can be seen below.

PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe C:\Users\<User>\Downloads\get-pip.py
Collecting pip
  Downloading pip-22.3.1-py3-none-any.whl (2.1 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.1/2.1 MB 16.3 MB/s eta 0:00:00
Collecting wheel
  Using cached wheel-0.38.4-py3-none-any.whl (36 kB)
Installing collected packages: wheel, pip
  WARNING: The script wheel.exe is installed in 'C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts' which is not on PATH.
  Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
  Attempting uninstall: pip
    Found existing installation: pip 10.0.1
    Uninstalling pip-10.0.1:
      Successfully uninstalled pip-10.0.1
  WARNING: The scripts pip.exe, pip3.7.exe and pip3.exe are installed in 'C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts' which is not on PATH.
  Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
Successfully installed pip-22.3.1 wheel-0.38.4

Instead of downloading and executing get-pip.py, pip should also be updated to the latest version by executing the line below.

PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe -m pip install --upgrade pip

#If pip is already updated it shows:
Requirement already satisfied: pip in c:\users\<User>\appdata\local\programs\python\python37\lib\site-packages (22.3.1)

Additional pip modules for ImageBuilder

When the update of pip (mentioned above) is not performed the installation of the additional Python modules will fail with a message that your version of pip is old and secondly a message that ‘Microsoft Visual C++ 14.0 or greater is required’, which you obviously don’t need when pip is up-to-date.

Errors with outdated pip

For informational purposes the error message when pip is not updated, is:

...
copying psutil\tests\__main__.py -> build\lib.win-amd64-cpython-37\psutil\tests
running build_ext
building 'psutil._psutil_windows' extension
error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/

----------------------------------------
Command "c:\users\<User>\appdata\local\programs\python\python37\python.exe -u -c "import setuptools, tokenize;__file__='C:\\Users\\<User>\\AppData\\Local\\Temp\\pip-install-u8srqv0e\\psutil\\setup.py';f=getattr(tokenize, 'open', open)(__file__);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, __file__, 'exec'))" install --record C:\Users\<User>\AppData\Local\Temp\pip-record-pz43kgey\install-record.txt --single-version-externally-managed --compile" failed with error code 1 in C:\Users\<User>\AppData\Local\Temp\pip-install-u8srqv0e\psutil\
You are using pip version 10.0.1, however version 22.3.1 is available.
You should consider upgrading via the 'python -m pip install --upgrade pip' command.

Pip up-to-date

When on the other hand pip is up-to-date, the installation of the additional modules in the “Scripts” sub-folder is a breeze.

PS C:\Users\<User>\AppData\Local\Programs\Python\Python37\Scripts> .\pip3.7.exe install six psutil lxml pyopenssl
Collecting six
  Downloading six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting psutil
  Downloading psutil-5.9.4-cp36-abi3-win_amd64.whl (252 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 252.5/252.5 kB 15.1 MB/s eta 0:00:00
Collecting lxml
  Downloading lxml-4.9.2-cp37-cp37m-win_amd64.whl (3.8 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.8/3.8 MB 27.4 MB/s eta 0:00:00
Collecting pyopenssl
  Downloading pyOpenSSL-22.1.0-py3-none-any.whl (57 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 57.0/57.0 kB ? eta 0:00:00
Collecting cryptography<39,>=38.0.0
  Downloading cryptography-38.0.4-cp36-abi3-win_amd64.whl (2.4 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.4/2.4 MB 51.5 MB/s eta 0:00:00
Collecting cffi>=1.12
  Downloading cffi-1.15.1-cp37-cp37m-win_amd64.whl (179 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 179.3/179.3 kB ? eta 0:00:00
Collecting pycparser
  Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 118.7/118.7 kB ? eta 0:00:00
Installing collected packages: six, pycparser, psutil, lxml, cffi, cryptography, pyopenssl
Successfully installed cffi-1.15.1 cryptography-38.0.4 lxml-4.9.2 psutil-5.9.4 pycparser-2.21 pyopenssl-22.1.0 six-1.16.0

Set PowerCLI Python path

Set-PowerCLIConfiguration -PythonPath C:\Users\<User>\AppData\Local\Programs\Python\Python37\python.exe -Scope User

If this step fails with the error ‘Set-PowerCLIConfiguration: A parameter cannot be found that matches parameter name ‘PythonPath’.‘, in my case PowerCLI 13.x was not yet installed.

After setting the ‘Set-PowerCLIConfiguration -PythonPath’ the PowerShell session needs to be re-opened before using ImageBuilder. Else it still fails.

Set PowerCLI InvalidCertificateAction

In my case. I still got an error when performing the “Get-DepotBaseImages” command. It says:

Get-DepotBaseImages: The InvalidCertificateAction setting 'Warn' is not supported on this platform. Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Fail or Ignore.

I fixed the issue by running:

PS C:\Users\<user>> Set-PowerCLIConfiguration -InvalidCertificateAction Fail

After setting the ‘Set-PowerCLIConfiguration‘ the PowerShell session needs to be re-opened before using ImageBuilder. Else it still fails.

Success

After performing the steps in this post, you can go ahead and use ImageBuilder to create a customized ESXi8 ISO Image.

To conclude

I have never had so much trouble getting PowerCLI to work and needing to read so much blogs and documentation pages to fix just a single issue, which basically was to use ImageBuilder to create a custom ESXi ISO.

Anyway, I hope it helps fixing you issues with PowerCLI.

Cheers, Daniël

Useful links

VMWare PowerCLI 13 release blog

VMware PowerCLI 13.1 release blog

PowerCLI documentation

PowerCLI Documentation – Install Python on Windows

Uninstall PowerCLI

Download get-pip.py

vcloud-lab.com – Authenticode issuer