When migrating vCenter, it’s often better not to recreate existing roles and privileges manually. Instead, you can automate this with PowerCLI — provided you know the right commands.
The approach below is based on a script that connects to multiple vCenters at once, then exports all roles from the source vCenter, creates them anew in the target vCenter, and assigns the corresponding privileges.
Procedure with PowerCLI
First, connect to both vCenters. It’s important that the PowerCLI configuration allows “multiple” mode so that multiple servers can be active at once:
Set-PowerCLIConfiguration -DefaultVIServerMode multiple -Confirm:$false
Then use Connect-VIServer to access both systems. Next, retrieve the list of all roles from the source vCenter. For each role, the associated privileges are exported, a new role is created in the target vCenter, and the privileges are assigned there.
A typical loop script looks like this:
$VC1 = "ALTER_VC"
$VC2 = "NEUER_VC"
Set-PowerCLIConfiguration -DefaultVIServerMode multiple -Confirm:$false
connect-viserver -Server $VC1, $VC2
$roles = Get-VIRole -Server $VC1
foreach ($role in $roles) {
$privs = Get-VIPrivilege -Role (Get-VIRole -Name $role -Server $VC1) | % { $_.Id }
New-VIRole -Name $role -Server $VC2 -ErrorAction SilentlyContinue
Set-VIRole -Role (Get-VIRole -Name $role -Server $VC2) -AddPrivilege (Get-VIPrivilege -Id $privs -Server $VC2)
}
disconnect-viserver -Server $VC1, $VC2
Important Notes
Error messages may appear if a role already exists in the target vCenter. These can be suppressed with -ErrorAction SilentlyContinue. Nevertheless, you should check for conflicts beforehand. Standard roles are also migrated, which is why corresponding messages always appear.
Also keep in mind that not only roles but also permissions assigned to users or groups are involved. A pure role transfer is therefore not always sufficient. If you also want to migrate the assignments, you additionally need to export and re-import the Permissions. A post on that will follow.