Administration

Administrator roles typically combine all of the individual privileges required to perform a
higher-level administration task. Horizon Administrator includes predefined roles that contain the
privileges required to perform common administration tasks. You can assign these predefined
roles to your administrator users and groups, or you can create your own roles by combining
selected privileges. You cannot modify the predefined roles.
To create administrators, you select users and groups from your Active Directory users and
groups and assign administrator roles. Administrators obtain privileges through their role
assignments. You cannot assign privileges directly to administrators. An administrator that has
multiple role assignments acquires the sum of all the privileges contained in those roles.
Using Access Groups to Delegate Administration of Pools
and Farms
By default, automated desktop pools, manual desktop pools, and farms are created in the root
access group, which appears as / or Root(/) in Horizon Administrator. Published desktop pools
and application pools inherit their farm's access group. You can create access groups under
the root access group to delegate the administration of specific pools or farms to different
administrators.
Note You cannot change the access group of a published desktop pool or an application pool
directly. You must change the access group of the farm that the published desktop pool or the
application pool belongs to.
A virtual or physical machine inherits the access group from its desktop pool. An attached
persistent disk inherits the access group from its machine. You can have a maximum of 100 access
groups, including the root access group.
You configure administrator access to the resources in an access group by assigning a role to an
administrator on that access group. Administrators can access the resources that reside only in
access groups for which they have assigned roles. The role that an administrator has on an access
group determines the level of access that the administrator has to the resources in that access
group.
Because roles are inherited from the root access group, an administrator that has a role on the
root access group has that role on all access groups. Administrators who have the Administrators
role on the root access group are super administrators because they have full access to all of the
objects in the system.
A role must contain at least one object-specific privilege to apply to an access group. Roles that
contain only global privileges cannot be applied to access groups.
Horizon 7 Administration
VMware, Inc. 126