Unfortunately this new feature is not available in PowerCLI 4.1. That means you can’t set this up in your configuration scripts through a PowerCLI cmdlet. In most such cases you can fall back on one of the SDK APIs to bypass this lack of a cmdlet. But unfortunately the new “managers”, of which HostActiveDirectoryAuthentication is one, are not available in the VMware.Vim assembly either.

Rob raised this in a recent PowerCLI Community thread. Yasen, one of the PowerCLI Dev Team members, provided a bypass. To make this bypass a bit more accessible, I decided to roll it up in a PowerShell function.

A (little) bit of background information

The Active Directory Authentication feature has been discussed at length in several vSphere 4.1 blog posts.

A great video, that explains what it is and how you can use it, was made by David Davis. See his VIDEO: New vSphere 4.1 Windows Active Directory Authentication post.

The script

#requires -version 2

function Get-VMHostAuthentication{
<#
.SYNOPSIS
	The function retrieves the authentication services from an ESX(i) host
.DESCRIPTION
	This function retrieves the configured authentication services from one
	or more ESX(i) hosts.
.NOTES
	Author: Luc Dekens
.PARAMETER VMHost
	Specify the ESX(i) host
.EXAMPLE
	PS> Get-VMHost | Get-VMHostAuthentication
.EXAMPLE
	PS> Get-VMHostAuthentication -VMHost (Get-VMHost)
#>
	param(
	[parameter(ValueFromPipeline = $true,Position=1,Mandatory = $true)]
	[VMware.VimAutomation.ViCore.Impl.V1.Inventory.VMHostImpl[]]$VMHost)

	process{
		if(!$VMHost){$VMHost = $_}
		foreach($esx in $VMHost){
			$filter = New-Object VMware.Vim.PropertyFilterSpec -Property @{
				ObjectSet = New-Object VMware.Vim.ObjectSpec -Property @{
					Obj = $esx.ExtensionData.ConfigManager.AuthenticationManager
				}
				PropSet = New-Object VMware.Vim.PropertySpec -Property @{
					Type = "HostAuthenticationManager"
					All = $true
				}
			}
			$collector = Get-View $esx.ExtensionData.Client.ServiceContent.PropertyCollector
			$content = $collector.RetrieveProperties($filter)
			$stores = $content | Select -First 1 | %{$_.PropSet} | where {$_.Name -eq "info"}
			foreach($authConfig in $stores.Val.AuthConfig){
				$row = New-Object PSObject
				$row | Add-Member -MemberType NoteProperty -Name Name -Value $null
				$row | Add-Member -MemberType NoteProperty -Name Type -Value $null
				$row | Add-Member -MemberType NoteProperty -Name Enabled -Value $null
				$row | Add-Member -MemberType NoteProperty -Name Domain -Value $null
				$row | Add-Member -MemberType NoteProperty -Name Membership -Value $null
				$row | Add-Member -MemberType NoteProperty -Name Trust -Value $null
				$row.Name = $esx.Name
				$row.Enabled = $authConfig.Enabled
				switch($authConfig.GetType().Name){
					'HostLocalAuthenticationInfo'{
						$row.Type = 'Local authentication'
					}
					'HostActiveDirectoryInfo'{
						$row.Type = 'Active Directory'
						$row.Domain = $authConfig.JoinedDomain
						$row.Membership = $authConfig.DomainMembershipStatus
						$row.Trust = $authConfig.TrustedDomain
					}
				}
				$row
			}
		}
	}
}

function Set-VMHostADDomain{
<#
.SYNOPSIS
	The function adds or removes an ESX(i) 4.1 server to/from an Active Directory domain
.DESCRIPTION
	By adding an ESX(i) 4.1 host to an AD domain, you can use AD authentication for console
	access, SSH and permissions on the host's child objects
.NOTES
	Author: Luc Dekens
.PARAMETER VMHost
	Specify the ESX(i) host
.PARAMETER Domain
	The name of the Active Directory domain in FQDN notation
.PARAMETER User
	An Active Directory account that administrative authority to add hosts to AD
.PARAMETER Password
	The password for the AD account specified in -User
.PARAMETER Credential
	The credentials for an AD account with administrative authority to add hosts to AD
.PARAMETER ADJoin
	A switch indicating if the host shall be added ($true) or removed ($false) from AD
.PARAMETER RemovePermission
	Will remove ($true) all AD permissions that still exist on the ESX(i) host and
	it's children
.EXAMPLE
	PS> Get-VMHost | Set-VMHostADDomain -ADJoin:$true -Domain $domain -User $user -Password $pswd
.EXAMPLE
	PS> Set-VMHostADDomain -VMHost (Get-VMHost) -ADJoin:$true -Credential $cred
.EXAMPLE
	PS> Set-VMHostADDomain -VMHost (Get-VMHost) -ADJoin:$false -RemovePermission:$true
#>
	param(
	[parameter(ValueFromPipeline = $true,Position=1,Mandatory = $true)]
	[VMware.VimAutomation.ViCore.Impl.V1.Inventory.VMHostImpl[]]$VMHost,
	[string]$Domain,
	[string]$User,
	[string]$Password,
	[System.Management.Automation.PSCredential]$Credential,
	[switch]$ADJoin,
	[switch]$RemovePermission = $false
	)

	process{
		if(!$VMHost){$VMHost = $_}
		foreach($esx in $VMHost){
			$filter = New-Object VMware.Vim.PropertyFilterSpec -Property @{
				ObjectSet = New-Object VMware.Vim.ObjectSpec -Property @{
					Obj = $esx.ExtensionData.ConfigManager.AuthenticationManager
				}
				PropSet = New-Object VMware.Vim.PropertySpec -Property @{
					Type = "HostAuthenticationManager"
					All = $true
				}
			}
			$collector = Get-View $esx.ExtensionData.Client.ServiceContent.PropertyCollector
			$content = $collector.RetrieveProperties($filter)
			$stores = $content | Select -First 1 | %{$_.PropSet} | where {$_.Name -eq "supportedStore"}
			$result = $stores.Val | where {$_.Type -eq "HostActiveDirectoryAuthentication"}
			$hostADAuth = [VMware.Vim.VIConvert]::ToVim41($result)

			if($ADJoin){
				if($Credential){
					$User = $Credential.GetNetworkCredential().UserName
					$Password = $Credential.GetNetworkCredential().Password
				}
				$taskMoRef = $esx.ExtensionData.Client.VimService.JoinDomain_Task($hostADAuth,$Domain,$User,$Password)
			}
			else{
				$taskMoRef = $esx.ExtensionData.Client.VimService.LeaveCurrentDomain_Task($hostADAuth,$RemovePermission)
			}
			$esx.ExtensionData.WaitForTask([VMware.Vim.VIConvert]::ToVim($taskMoRef))
		}
	}
}

Annotations

Line 1: This function uses PowerShell v2 features and will not run with PowerShell v1

Line 3-63: The Get-VMHostAuthentication function

Line 38-60: Return information for each of the configured authentication methods.

Line 65-138: The Set-VMHostADDomain function

Line 24,108: Handles use of the function in a pipeline or with a -VMHost parameter

Line 26-34,110-118: Creates the PropertyFilterSpec object through the use of the hash table property list.

Line 119-123: The ‘bypass’ from Yasen. It uses the PropertyCollector to  ultimately get at the MoRef of the HostActiveDirectoryAuthentication manager.

Line 123: The MoRef is converted to a VIM 4.1 MoRef with the ToVim41 method of the builtin VIConvert class.

Line 125: Depending on the state of the ADJoin switch, the host is ‘joined’ or ‘removed’ from the AD domain.

Line 126-129: If the AD account is passed through a PSCredential object, the clear text account and password are extracted.

Line 135: The script waits for the completion of the called method.

Examples

To display the authentication services for an ESX(i) server that has no AD authentication configured.

Get-VMHost $esxName | Get-VMHostAuthetication

This returns the following information.

To add a specific ESX(i) server to an Active Directory domain you can do

Set-VMHostADDomain -VMhost (Get-VMHost $esxName) -ADJoin:$true -Domain 'test.local' -User 'Administrator' -Password 'MyPassword'

or

Get-VMHost $esxName | Set-VMHostADDomain -ADJoin:$true -Domain 'test.local' -User 'Administrator' -Password 'MyPassword'

The Get-VMHostAuthentication function now returns.

You can also enable AD authentication on a series of ESX(i) hosts.

Set-VMHostADDomain -VMhost (Get-VMHost) -ADJoin:$true -Domain 'test.local' -Credential (Get-Credential)

or like this

Get-VMHost | Set-VMHostADDomain -ADJoin:$true -Domain 'test.local' -Credential (Get-Credential)

To remove a host, you have to set the -ADJoin switch to $false.
Like this

Get-VMHost | Set-VMHostADDomain -ADJoin:$false

The previous call assumes that there were no permissions with AD principals left on the ESX(i) server or any of it’s children.
If there were, you would get an error message.

You can let the ‘unjoin’ remove any remaining permissions for you.
For that you use the -RemovePermission parameter.

Get-VMHost | Set-VMHostADDomain -ADJoin:$false -RemovePermission:$true