Start a VMware VM to Safe Mode With Networking Automatically

Been having some internal conversation about the CrowdStrike outages. We needed a way to quickly boot VMs that were affected and allow them to get on the network for easy file deletion and reboots. So some of my colleagues and myself got to work on it. First we needed a way to set the boot delay on a VM

$vm = get-vm $vmname
$vmbo = New-Object VMware.Vim.VirtualMachineBootOptions
$vmbo.BootDelay = $bootDelay
$vmcs = New-Object VMware.Vim.VirtualMachineConfigSpec
$vmcs.BootOptions = $vmbo
$VM.ExtensionData.ReconfigVM($vmcs)

Then we used William Lam’s Send VM Keys https://williamlam.com/2017/09/automating-vm-keystrokes-using-the-vsphere-api-powercli.html to send the appropriate codes to get to safe mode:

start-vm $vm

1..25 | %{
    Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "F8"
    start-sleep -milliseconds 50
}

Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "KeyDown"
start-sleep -milliseconds 50
Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "KeyEnter"

1..25 | %{
    Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "F8"
    start-sleep -milliseconds 50
}

Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "KeyDown"
start-sleep -milliseconds 50
Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "KeyDown"
start-sleep -milliseconds 50
Set-VMKeystrokes -VMName $vm.name -SpecialKeyInput "KeyEnter"

Really quick and dirty but it boots to safe mode so you can do your work deleting the file and rebooting. Of course you can script that part to but it was beyond what we were required to accomplish.

If you want to just use the powershell we wrote grab it here: https://github.com/khensler/VMware_Scripts/blob/main/safemodewithnetworking.ps1

You can call the function after importing it via start-to-safemode -vmname "vmname" and loop it if you have an array of VM names.

After the boot into safe mode with networking you may be able to use group policy to remove the file as shown here: https://gist.github.com/whichbuffer/7830c73711589dcf9e7a5217797ca617. You won’t need the force safe mode part of the script since the machine will already be in safe mode.

Use this at your own risk