Administration

To create administrators, you select users and groups from your Active Directory users and groups and
assign administrator roles. Administrators obtain privileges through their role assignments. You cannot
assign privileges directly to administrators. An administrator that has multiple role assignments acquires
the sum of all the privileges contained in those roles.
Using Access Groups to Delegate Administration of Pools and Farms
By default, automated desktop pools, manual desktop pools, and farms are created in the root access group,
which appears as / or Root(/) in View Administrator. RDS desktop pools and application pools inherit their
farm's access group. You can create access groups under the root access group to delegate the administration
of specic pools or farms to dierent administrators.
N You cannot change the access group of an RDS desktop pool or an application pool directly. You
must change the access group of the farm that the RDS desktop pool or the application pool belongs to.
A virtual or physical machine inherits the access group from its desktop pool. An aached persistent disk
inherits the access group from its machine. You can have a maximum of 100 access groups, including the
root access group.
You congure administrator access to the resources in an access group by assigning a role to an
administrator on that access group. Administrators can access the resources that reside only in access
groups for which they have assigned roles. The role that an administrator has on an access group
determines the level of access that the administrator has to the resources in that access group.
Because roles are inherited from the root access group, an administrator that has a role on the root access
group has that role on all access groups. Administrators who have the Administrators role on the root access
group are super administrators because they have full access to all of the objects in the system.
A role must contain at least one object-specic privilege to apply to an access group. Roles that contain only
global privileges cannot be applied to access groups.
You can use View Administrator to create access groups and to move existing desktop pools to access
groups. When you create an automated desktop pool, a manual pool, or a farm, you can accept the default
root access group or select a dierent access group.
N If you intend to provide access to your desktops and applications through
VMware Identity Manager, verify that you create the desktop and application pools as a user who has the
Administrators role on the root access group in Horizon Administrator. If you give the user the
Administrators role on an access group other than the root access group, VMware Identity Manager will not
recognize the SAML authenticator you congure in Horizon 7, and you cannot congure the pool in
VMware Identity Manager.
n
Dierent Administrators for Dierent Access Groups on page 100
You can create a dierent administrator to manage each access group in your conguration.
n
Dierent Administrators for the Same Access Group on page 101
You can create dierent administrators to manage the same access group.
Different Administrators for Different Access Groups
You can create a dierent administrator to manage each access group in your conguration.
For example, if your corporate desktop pools are in one access group and your desktop pools for software
developers are in another access group, you can create dierent administrators to manage the resources in
each access group.
Table 6-1 shows an example of this type of conguration.
View Administration
100 VMware, Inc.