Administration

Command Output
The vdmutil command returns 0 when an operation succeeds and a failure-specic non-zero code when an
operation fails. The vdmutil command writes error messages to standard error. When an operation produces
output, or when verbose logging is enabled by using the --verbose option, the vdmutil command writes
output to standard output, in US English.
Commands for Managing Enrollment Servers
You must add one enrollment server for each domain. You can also add a second enrollment server and later
designate that server to be used as a backup.
For readability, the options shown in the following table do not represent the complete command you would
enter. Only the options specic to the particular task are included. For example, one row shows the
--environment --list --enrollmentServers options, but the vdmUtil command you would actually
enter also contains options for authentication and for specifying that you are conguring True SSO:
vdmUtil --authAs admin-role-user --authDomain netbios-name --authPassword admin-user-password --
truesso --environment --list --enrollmentServers
For more information about the authentication options, see “Command-line Reference for Conguring True
SSO,” on page 88.
Table 5‑2. vdmutil truesso Command Options for Managing Enrollment Servers
Command and Options Description
--environment --add --enrollmentServer
enroll-server-fqdn
Adds the specied enrollment server to the environment, where
enroll-server-fqdn is the FQDN of the enrollment server. If the
enrollment server has already been added, when you run this
command, nothing happens.
--environment --remove --enrollmentServer
enroll-server-fqdn
Removes the specied enrollment server from the environment,
where enroll-server-fqdn is the FQDN of the enrollment server. If the
enrollment server has already been removed, when you run this
command, nothing happens.
--environment --list --enrollmentServers
Lists the FQDNs of all enrollment servers in the environment.
--environment --list --enrollmentServer
enroll-server-fqdn
List s the FQDNs of the domains and forests that are trusted by the
domains and forests to which the enrollment server belongs, and
the state of the enrollment certicate, which can be VALID or
INVALID. VALID means the enrollment server has an Enrollment
Agent certicate installed. The state might be INVALID for any of
several reasons:
n
The certicate has not been installed.
n
The certicate Is not yet valid, or has expired.
n
The certicate was not issued by a trusted Enterprise CA.
n
The private key is not available.
n
The certicate has been corrupted.
The log le on the enrollment server can provide the reason for the
INVALID state.
--environment --list --enrollmentServer
enroll-server-fqdn --domain domain-fqdn
For the enrollment server in the specied domain, lists the CNs
(common names) of the available certicate authorities, and
provides the following information about each certicate template
that can be used for True SSO: name, minimum key length, and
hash algorithm.
Chapter 5 Authenticating Users Without Requiring Credentials
VMware, Inc. 89