PowerCLI Script to Audit VM Tags and Generate Group Reports

Introduction

VM tags in vSphere are a powerful way to organize, classify, and apply policies to virtual machines. But without regular audits, environments become inconsistent, and tag drift leads to automation breakdowns. PowerCLI lets you query, sort, and export tag data at scale.

In this article, you’ll learn how to:

• Retrieve all tags and tag categories
• List VM-to-tag relationships
• Identify untagged or inconsistently tagged VMs
• Export tag reports by group
• Generate CSVs for compliance and team handoff

Step 1: List All Available Tags

Get-Tag

Include categories:

Get-Tag | Select Name, Category, Description

List categories directly:

Get-TagCategory

Step 2: Get Tags Assigned to All VMs

Get-VM | Get-TagAssignment

Group by tag name:

Get-VM | Get-TagAssignment | Group-Object Tag | Select Name, Count

Step 3: Export Full VM-to-Tag Mapping

Get-VM | ForEach-Object {
    $vm = $_
    Get-TagAssignment -Entity $vm | Select @{N="VM";E={$vm.Name}}, Tag, Category
} | Export-Csv "C:\Reports\VM_Tag_Assignments.csv" -NoTypeInformation

Step 4: List Untagged VMs

$allVMs = Get-VM
$taggedVMs = Get-TagAssignment | Select -ExpandProperty Entity | Sort-Object -Unique
$untagged = $allVMs | Where-Object { $taggedVMs -notcontains $_ }

$untagged | Select Name, PowerState, VMHost | Export-Csv "C:\Reports\Untagged_VMs.csv" -NoTypeInformation

Step 5: Generate Group Reports by Tag

Example: List all VMs tagged with “BackupEnabled”

Get-TagAssignment -Tag "BackupEnabled" | Select Entity | Export-Csv "C:\Reports\BackupEnabled_VMs.csv" -NoTypeInformation

Or build grouped CSV exports by category:

$tags = Get-Tag

foreach ($tag in $tags) {
    $vms = Get-TagAssignment -Tag $tag.Name | Select Entity
    $output = "C:\Reports\TagReports\$($tag.Name)_VMs.csv"
    $vms | Export-Csv $output -NoTypeInformation
}

Diagram: Tag Audit Workflow

Use Case: Monthly Policy Audit for Backup and App Classification

1. Identify all VMs missing the “Backup” or “Application” tag
2. Notify workload owners to classify untagged VMs
3. Export tagged VM groups to backup software or policy engine

Bonus: Visual Tag Usage Summary

Get-VM | Get-TagAssignment | Group-Object Tag | Sort-Object Count -Descending | Format-Table Name, Count

Troubleshooting