After three great sessions at VMUG Connect Amsterdam and VMUG Connect Online, and VMUGNL Summer Sessions. I’ve had requests to share the slides for my session “What You Can Learn from a Minimum Resources 2 Node VCF 9 Lab Deployment to a Real Scenario“.
The response was great.
In the slide deck you will find:
✅ The Start of My VCF Story
✅ First Challenge
✅ Why i wanted to build a real Senario
✅ Why i choise going to a build a real VCF scenario
✅ The Road
✅ The Lessions Learned & Next Steps
Powering your VMware Cloud Foundation “lab” environment on and off shouldn’t be a manual process.
A complete shutdown of a VMware Cloud Foundation (VCF) environment is uncommon, but for some energy savings and some time you does not use your lab often, you want a repeatable, reliable, and automated procedure, manually powering dozens of virtual machines in the correct order is both time-consuming and error-prone.
To solve this problem, I created two lightweight PowerCLI scripts:
vCenter and ESX hosts are manual (For vSAN cluster I did not find the correct code yet!)
Let me know if you have any questions or addons
Both scripts are available on GitHub and are designed to automate the startup and shutdown of a VMware Cloud Foundation management domain.
GitHub Repository
Note: Both Scripts do not work with VCF 9.1!!!!
Why These Scripts?
Although VMware Cloud Foundation automates the deployment and lifecycle of the platform, a full platform shutdown still requires the administrator to respect service dependencies.
For example:
Powering everything on simultaneously often results in services that need additional time—or even manual intervention—to recover.
These scripts automate the entire sequence descripted als following:
Start the Management Domain (VCF 9.0)’
Shut Down the Management Domain (VCF 9.0)
Typical Use Cases
These scripts are useful in many environments, including:
I personally use them in my VCF lab, where powering the environment up or down manually became repetitive and unnecessarily time-consuming. Automating the sequence not only saves time but also ensures a consistent and predictable startup every time.
Customizing the Scripts
Every VMware Cloud Foundation deployment is different.
The scripts are intentionally straightforward so you can easily adapt them by:
Because everything is written in PowerCLI, modifications are simple and require only basic scripting knowledge.
Future Improvements
Some ideas I’m considering for future releases include:
Contributions and suggestions from the community are always welcome.
Lessons Learned
During development I discovered:
Download
You can download the latest version from my public GitHub repository:
You can also find more VMware Cloud Foundation automation projects, PowerCLI scripts, and lab guides on my website:
Conclusion
A VMware Cloud Foundation environment consists of many interconnected services, and those services should be started and stopped in the correct order.
These lightweight PowerCLI scripts automate that process, making startup and shutdown predictable, repeatable, and significantly less error-prone. Whether you’re running a production management domain or a small VCF lab, automating these operational tasks saves time and reduces the risk of mistakes.
If you have ideas for improvements or additional features, feel free to open an issue or submit a pull request on GitHub. Happy automating!
In June 2026 Secure boot certs start to going to expire for physical en virtual machines Servers en Clients. PS not only Windows but also Linux!!
PS. Make sure Client en Servers all installed with latest updates!!
Made a little Risk Assessment:
The expiration and replacement of Microsoft Secure Boot certificates pose a high risk to IT environments. If not properly managed, systems may fail to boot, updates may fail, and security risks may increase. This is particularly critical in automated and virtualized environments.
Key risks:
Recommended actions:
A phased rollout and proper validation are essential to prevent disruptions.
1. Scope
This document describes the risks, impact, and mitigations related to the expiration of Microsoft Secure Boot certificates in enterprise environments.
2. Affected Components
3. Risk Analysis
Key risks:
4. Risk Matrix
5. Mitigations
6. Validation & Testing
7. Conclusion
Changes to Secure Boot certificates must be treated as critical infrastructure updates. Proper preparation, testing, and phased implementation are essential to avoid disruptions.
Microsoft has released patch’s for the following OS.
Windows 11 (23H2/24H2/25H2)
Windows Server 2016/2019/2022/2025.
VMware is creating a “Fix or Update” for this
* I did not test versions with extended support like Windows 2012 R2 and Windows 10.
Get your list with:
Get-VM | Where-Object { $_.ExtensionData.Config.Firmware -eq “efi” -and
$_.ExtensionData.Config.BootOptions.EfiSecureBootEnabled } | Select-Object Name,
@{N=”OS”;E={$_.ExtensionData.Guest.GuestFullName}}, PowerState
There is a updated coming from VMware by Broadcom: Check this article: @{N=”OS”;E={$_.ExtensionData.Guest.GuestFullName}}, PowerState
https://knowledge.broadcom.com/external/article/423893
Extra Info
Microsoft Info:
I hope that most People have Read: Windows Secure Boot certificate expiration and CA updates
and Secure Boot playbook for certificates expiring in 2026
Redhat:
Secure Boot Certificate Changes in 2026: Guidance for RHEL Environments
Broadcom:
Secure Boot Certificate Expirations and Update Failures in VMware Virtual Machines
Manual Update of the Secure Boot Platform Key in Virtual Machines
I recently created 3 version of a FixSecureBoot script — a lightweight alternative inspired by the excellent work of haz-ard-9, the author of FixSecureBootBulk.ps1. Their script is powerful and absolutely the right choice if you rely on BitLocker or need a fully automated, safety‑first workflow.
However, at roughly 3,000 lines of code, the original script is understandably complex. It includes many checks and safeguards, which are great for production environments but made it harder for me to fully understand what was happening under the hood. I wanted something simpler, easier to read, and tailored to my own workflow.
So I took the time to study the original script, copied only the parts I needed, and built a much more compact version that gives me exactly the result I want — which show the verification step that every thing is correct updated.
What My Script Does
Here’s the full sequence of actions my simplified script performs:
I’ve tested this workflow successfully on:
Downloads
** link the links for downloading the original files from Microsoft Github page.
WindowsOEMDevicesPK.der
microsoft corporation kek 2k ca 2023.der
Rename microsoft corporation kek 2k ca 2023.der to kek2023.der
Current Limitation: Packer Integration
CLEAN PACKER BUILD IS NOT SAFE!! AFTER THE BUILD YOU NEED TO RUN FIX SECURE BOOT!!
I don’t yet have a complete fix for integrating this into a full Packer build. For now, I simply pre‑stage the certificates:
Build file:
provisioner “file” {
source = “./setup/SecurebootCert/”
destination = “C:/Windows/Temp”
}
I have build three versions:
Fix_Secure_Boot_Manual.ps1
Fix_Secure_Boot_Single.ps1
Fix_Secure_Boot_Multi.ps1
If you want a script that’s easier to read, easier to modify, and still gets the job done (as long as you’re not using BitLocker), this simplified version might be exactly what you need.
Let me know if you want me to share the script itself or write a follow‑up post about how it works internally.
Template Check if al ready Updated
If VM check if al ready updated
Run Script full from Template
Upgrade VMware VCF 9.0.1: Essential Setting Up an Offline Depot on Ubuntu Instructions
If you are planning to upgrade to latest release of VMware Cloud Foundation (VCF) 9.0.1 and you what to install/upgrade you need to have a offline depot.
I had some struggle with the VCF Fleet upgrades. I thought the VCF installer Offline Depot was sufficient. I seems not.
William Liam did a nice explaining about the options: VCF Software Depot Structure Deep Dive for Install & Upgrade. Which confirms my struggle.
Sow I build my own offline depot
First, download the required bundle files from the Broadcom VMware portal. This includes:
Sizing for the disk is minimal 100GB I used 200GB thin Provisiond
I did a Ubuntu install on a 200GB disk (Partition without lvm)
Login with the user account that you create
Sudo passwd root
Vim /etc/ssh/sshd_config
if the following line exists, possibly commented out (with a # in front):
PermitRootLogin
Then change it to the following, uncommenting if needed (remove the # in front):
PermitRootLogin yes
sudo service ssh restart
now you can login als root
Sudo update
sudo apt install apache2 openssl apache2-utils unzip
nano ~/vcf-openssl.cnf
Paste the following:
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
x509_extensions = v3_req
[ dn ]
C = US
ST = CA
L = LA
O = TS
OU = IT
CN = flt-depot.wardhomelab.nl
emailAddress = a@b.c
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = flt-depot.wardhomelab.nl
IP.1 = 192.168.150.246
Replace the values with your organization’s details.
Generate the certificate
cd /etc/apache2
sudo mkdir ssl
sudo openssl req -x509 -nodes -days 365 \
-newkey rsa:2048 \
-keyout /etc/apache2/ssl/vcf.key \
-out /etc/apache2/ssl/vcf.crt \
-config ~/vcf-openssl.cnf
Sudo htpasswd -c /etc/apache2/.htpasswd vcfadmin
sudo nano /etc/apache2/sites-available/default-ssl.conf
Paste the following:
<VirtualHost *:443>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/vcf.crt
SSLCertificateKeyFile /etc/apache2/ssl/vcf.key
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
RequestHeader unset Proxy early
<Directory /var/www/html>
Options Indexes FollowSymLinks
AllowOverride None
AuthType Basic
AuthName “VCF Depot”
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
</VirtualHost>
sudo a2enmod ssl headers
sudo a2ensite default-ssl
sudo systemctl restart apache2
Sudo chmod 777 /home
Upload vcf-9.0.1.0-offline-depot-metadata.zip /home/ with Winscp
Sudo unzip vcf-9.0.1.0-offline-depot-metadata.zip -d /var/www/html
Make sure this file exists:
ls /var/www/html/PROD/metadata/productVersionCatalog/v1/productVersionCatalog.json
sudo rm -f /var/www/html/index.html
Create your Download token in de Broadcom portal
Create a token file in /home folder
Sudo mkdir /home/vcf-download-tool
Sudo chmod 777 /home/vcf-download-tool
cd /tmp/vcf-download-tool
Upload the tool in /tmp/vcf-download-tool folder
tar -xf vcf-download-tool-9.0.1.0.24962179.tar.gz
sudo reboot
Cd /tmp/vcf-download-tool/bin
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –automated-install –type=INSTALL
sudo ./vcf-download-tool binaries list –depot-download-token-file=/home/token –vcf-version=9.0.1 –type=INSTALL –sku=VCF
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component SDDC_MANAGER_VCF
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VCENTER
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VRSLCM
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VROPS
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component NSX_T_MANAGER
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VCF_OPS_CLOUD_PROXY
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VRA
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VRNI
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VRLI
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component HCX
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VRO
sudo ./vcf-download-tool binaries download –depot-download-token-file=/home/token -d /var/www/html –vcf-version=9.0.1 –type UPGRADE –component VIDB
Upgrade Binaries will be visible
Open de VM console
Login with the root user
Vim /etc/ssh/sshd_config
if the following line exists, possibly commented out (with a # in front):
PermitRootLogin
Then change it to the following, uncommenting if needed (remove the # in front):
PermitRootLogin yes
systemctl restart sshd
scp root@ftt-depot.wardhomelab.nl:/etc/apache2/ssl/vcf.crt /tmp/vcf.crt
Import the certificate into the Java truststore
sudo keytool -import -trustcacerts -alias vcfDepotCert1 \
-file /tmp/vcf.crt \
-keystore /usr/lib/jvm/openjdk-java17-headless.x86_64/lib/security/cacerts \
-storepass changeit
Reboot
Now u should connect VCF to you offline depot
You want you upgrade to 9.0.1 ivm Edge Issue
Special thanks to vmtechnics for putting me in the right direction
Essential Insights on Windows Server 2025
When i begon with scripting using PowerShell ISE for Coding.
PowerShell ISE and Visual Studio Code are free coding tools from Microsoft.
But when Visual Studio Code was released back in 2015 i was switching to that. Powershell ISE i still use on a daily base for some basic tasks.
But with de Extenions list for Visual Studio Code getting better and better scripting is much faster and without errors and easyer to read.
The list with favo extensions is getting bigger en bigger.
Which makes my live a little easyer and helpfull.
So the list of my Favorites:
Prettier – Code Formatter
TODO Highlight
Code Spell Checker
Dutch – Code Spell Checker
Code Snap
Error Lens
Hashicorp HCL
HashiCorp Terraform
Because AI is hot I ám currently testing the following plugins
ChatGPT
GitHub CoPilot
GitHub CoPilot Chat
Using the ChatGPT/CoPilot plugins makes scripting even faster
As Windows Server 2025 Preview is officially released, I wanted to test a automated build of the Windows Server 2025 Preview release. So that I can deploy this in my home lab and going to test the new features if I can find the time….
Hashicorp Packer is a self-contained executable producing quick and easy operating system builds across multiple platforms. Using Packer and a couple of HCL2 files, you can quickly create fully automated template(s) with latest Windows Updates en VMware Tools. When you schedule a fresh builds after patch Tuesday you have always an up-to-date and fully secured template.
When using VMware customization tools. You can spin up vm’s in minutes.
Files you need?
The files and versions I am using at the time of this writing are as follows:
Outside of downloading both Packer and Windows Server 2022 Preview build, you will need the following files:
Other considerations and tasks you will need to complete:
Like other automated approaches to installing Windows Server, the automated Windows Server 2025 Packer build requires an answer file to provide answers to the GUI automatically and other installation prompts that you normally see in a manual installation of Windows Server.
You will find the scripts here: https://github.com/WardVissers/Packer-Win2025
The only problem that I had was: Switching from Nic from Public to Private
# Set network connections profile to Private mode.
Write-Output ‘Setting the network connection profiles to Private…’
do {
$connectionProfile = Get-NetConnectionProfile
Start-Sleep -Seconds 10
} while ($connectionProfile.Name -eq ‘Identifying…’)
Set-NetConnectionProfile -Name $connectionProfile.Name -NetworkCategory Private
The VMware Cloud Foundation (VCF) Holodeck Toolkit is designed to provide a scalable, repeatable way to deploy nested Cloud Foundation hands-on environments directly on VMware ESXi hosts. These environments are ideal for multi-team hands on exercises exploring the capabilities of utilitizing VCF to deliver a Customer Managed VMware Cloud.
Delivering labs in a nested environment solves several challenges with delivering hands-on for a product like VCF, including:
The “VLC Holodeck Standard Main 1.3” configuration is a nested VMware Cloud Foundation configuration used as the baseline for several Private Cloud operation and consumption lab exercises created by the Cloud Foundation Technical Marketing team. The Holodeck standard “VLC-Holo-Site-1” is the primary configuration deployed. The optional VLC-Holo-Site-2 can be deployed at any time later within a Pod. VLC-Holo-Site-1 configuration matches the lab configuration in the VCF Hands-On Lab HOL-2246 and the nested configuration in the VCF Experience program run on the VMware Lab Platform.
Each Pod on a Holodeck deployment runs an identical nested configuration. A pod can be deployed with a standalone VLC-Holo-Site-1 configuration, or with both VLC-Holo-Site-1 and VLC-Holo-Site-2 configurations active. Separation of the pods and between sites within a pod is handled at the VMware vSphere Standard Switch (VSS) level. Each Holodeck pod connects to a unique VSS and Port Group per site. A VMware vSphere Port Group is configured on each VSS and configured as a VLAN trunk.
The VLC Holodeck configuration customizes the VCF Cloud Builder Virtual Machine to provide several support services within the pod to remove the requirement for specific customer side services. A Cloud Builder VM is deployed per Site to provide the following within the pod:
The figure below shows a logical view of the VLC-Holo-Site-1 configuration within a Holodeck Pod. The Site-1 configuration uses DNS domain vcf.sddc.lab.
Figure 1: Holodeck Nested Diagram
The Holodeck package also provides a preconfigured Photon OS VM, called “Holo-Router”, that functions as a virtualized router for the base environment. This VM allows for connecting the nested environment to the external world. The Holo-Router is configured to forward any Microsoft Remote Desktop (RDP) traffic to the nested jump host, known as the Holo-Console, which is deployed within the pod.
The user interface to the nested VCF environment is via a Windows Server 2019 “Holo-Console” virtual machine. Holo-Console provides a place to manage the internal nested environment like a system administrators desktop in a datacenter. Holo-Console is used to run the VLC package to deploy the nested VCF instance inside the pod. Holo-Console VM’s are deployed from a custom-built ISO that configures the following
The figure below shows the virtual machines running on the physical ESXi host to deliver a Holodeck Pod called “Holo-A”. Notice an instance of Holo-Console, Holo-Router, Cloud Builder and four nested ESXi hosts. They all communicate over the VLC-A-PG Port Group
Figure 2: Holodeck Nested Hosts
Adding a second site adds an additional instance of Cloud Builder and additional nested ESXi hosts. VLC-Holo-Site-2 connects to the second internal leg of the Holo-Router on VLAN 20. Network access from the Holo-Console to VLC-Holo-Site-2 is via Holo-Router.
The figure below shows a logical view of the VLC-Holo-Site-2 configuration within a Holodeck Pod. The Site-2 configuration uses DNS domain vcf2.sddc.lab
Figure 3: Holodeck Site-2 Diagram
User access to the Holodeck pod is via the Holo-Console. Access to Holo-Console is available via two paths:
I had a frustrating issue with Packer, specifically with VMware Tools installation.
During the Packer install, I load up a script and have VMware Tools 12.1.5 installed. It seems to install successfully, But I noticed that the VMTools service is not running. I have to re-run setup64.exe via the GUI and do a repair, then I see the service exist and runs, and Packer can discover the IP address of the VM to finish it.
The Solution
I used a older autounattend.xml which i never checked the time zone.
Setting the correcting time zone the trick:
<TimeZone>W. Europe Standard Time</TimeZone>
You must be logged in to post a comment.