Copying VM Folders and Permissions from One vCenter to Another

1/26/2016 Update: We've learned that this script doesn't elegantly handle the situation where multiple VM folders have the same name (but different parent folders).  I've put together a basic script that should help recover from that (in the comments), but I haven't had a chance to thoroughly test it.  That script is built to move all VMs from the "Discovered Virtual Machine" Folder back into their correct locations.  I'm working on an updated pair of scripts that will handle this whole situation better.

2/9/2016 Update: I've published an updated version of the vCenter Migration Scripts - check it out instead of these!

One of my customers wanted to export their VM Folder structure and the associated permissions from one vCenter to another, in preparation for a vCenter forklift.  Once the destination vCenter was fully prepared, the goal would be to migrate ESXi hosts with VMs into the new vCenter, then move the VMs into the appropriate folders.  This situation is pretty much the epitome of why I like scripting; it's a long, arduous process that has tons of opportunity for human error to make subtle problems.  So, I put together a pair of scripts.

The first script basically reads all of the data from the source vCenter server.  It outputs a series of XML files that contain the VM folder structure, all of the vCenter Roles, the vCenter Permissions structure and what VMs are in what folders.  As part of this migration process, templates will be converted back into VMs (so that they can easily traverse from one vCenter to the other), so I'm not worrying about using a separate command to capture Template locations as well.

The second script reads in all of those files and recreates all of the vCenter objects.  It begins by creating the VM Folder structure, then creates new versions of all of the Roles from the previous vCenter and finally assigns those Roles to the appropriate Principals on the appropriate vCenter objects.

In order to run these scripts, we first converted the Templates into VMs by using this command:
get-template | set-template -tovm

Then, while connected to the Source vCenter, we ran the capture script:
get-sourcesettings.ps1 -d C:\temp -dc Sacramento

Next, while connected to the Destination vCenter, we ran the configuration script:
set-SourceSettings.ps1 -d C:\temp - dc Sacramento

At that point, the new vCenter was configured and so we began shuffling the ESXi hosts into it.  Once all of the hosts (and their VMs) were in the environment, we placed the VMs back into their folders with this command:
foreach ($thisVM in (import-clixml C:\Temp\vm-locations.xml)) {get-vm $thisVM.name | move-vm -destination (get-folder $thisVM.folder)}

Then, we just converted all of the template VMs back into templates (they were easy to find, as they were in the "Templates" folder) and were good to go.

These scripts are formatted in a less-than-human-friendly manner in order to make it easy to pick them apart to manually run any one bit of it.  Are you just interested in grabbing the roles?  Well, grab the command line for the roles, as it's completely self contained.  Same thing for the Folders or Permissions lines.  This means that the line breaks due to the blog's width are particularly troublesome here, so be extra careful to remove any extraneous line breaks.

As always, these scripts worked for me in my situation, but that's no guarantee that they'll work for you, so test thoroughly and share any fixes that you make!

# Get-SourceSettings.ps1
# Exports source Folders/Roles/Permissions/VM Locations
param
(
   [alias("d")]
   $directory = $(read-host "Enter output directory"),
   [alias("dc")]
   $datacenter = $(read-host "Enter datacenter name")
)
$directory = $directory.trim("\")
new-item $directory -type directory -erroraction silentlycontinue
get-virole | where {$_.issystem -eq $false} | export-clixml $directory\roles.xml
Get-VIPermission | export-clixml $directory\permissions.xml
$dc = get-datacenter $datacenter
$dc | get-folder | where {$_.type -eq "VM"} | select name,parent | export-clixml -depth 5 $directory\folders.xml
$dc | get-vm | select name,folder | export-clixml -depth 6 $directory\vm-locations.xml



# Set-SourceSettings.ps1
# Run on destination vCenter to recreate VM folder structure and permissions
param
(
   [alias("d")]
   $directory = $(read-host "Enter input directory"),
   [alias("dc")]
   $datacenter = $(read-host "Enter datacenter name")
)
$directory = $directory.trim("\")
#Read in the folder structure from the Get-SourceSettings.ps1 script and create those VM Folders
foreach ($thisFolder in (import-clixml $directory\folders.xml | where {!($_.name -eq "vm")})) {(get-datacenter $datacenter) | get-folder $thisFolder.Parent | new-folder $thisFolder.Name -confirm:$false}
#Read in Roles from Get-sourceSettings.ps1 script and create those Roles
foreach ($thisRole in (import-clixml $directory\roles.xml)){if (!(get-virole $thisRole.name -erroraction silentlycontinue)){new-virole -name $thisRole.name -Privilege (get-viprivilege -id $thisRole.PrivilegeList)}}
#Read in Permissions from Get-sourceSettings.ps1 script and assign those permissions
foreach ($thisPerm in (import-clixml $directory\permissions.xml)) {get-folder $thisPerm.entity.name | new-vipermission -role $thisPerm.role -Principal $thisPerm.principal -propagate $thisPerm.Propagate}
#Read in the VM Folder locations and move the VMs to their Folders; only execute this line after all VMs have been moved into the new inventory
#$allVMs = import-clixml C:\Temp\vm-locations.xml
#foreach ($thisVM in $allVMs) {get-vm $thisVM.name | move-vm -destination (get-folder $thisVM.folder)}