Administration

Providing Secondary Credentials for Administrators Using
the ‑T Option
You can use the vdmadmin command with the -T option to provide Active Directory secondary credentials
to administrator users.
Syntax
vdmadmin -T [-b authentication_arguments] -domainauth
{-add | -update | -remove | -removeall | -list} -owner domain\user -user domain\user [-password
password]
Usage Notes
If your users and groups are in a domain with a one-way trust relationship with the View Connection
Server domain, you must provide secondary credentials for the administrator users in View Administrator.
Administrators must have secondary credentials to give them access to the one-way trusted domains. A
one-way trusted domain can be an external domain or a domain in a transitive forest trust.
Secondary credentials are required only for View Administrator sessions, not for end users' desktop or
application sessions. Only administrator users require secondary credentials.
With the vdmadmin command, you configure secondary credentials on a per-user basis. You cannot
configure globally specified secondary credentials.
For a forest trust, you typically configure secondary credentials only for the forest root domain. View
Connection Server can then enumerate the child domains in the forest trust.
Active Directory account lock, disable, and logon hours checks can be performed only when a user in a
one-way trusted domain first logs on.
PowerShell administration and smart card authentication of users is not supported in one-way trusted
domains. SAML authentication of users in one-way trusted domains is not supported.
Secondary credential accounts require the following permissions. A standard user account should have
these permissions by default.
n
List Contents
n
Read All Properties
n
Read Permissions
n
Read tokenGroupsGlobalAndUniversal (implied by Read All Properties)
View Administration
VMware, Inc. 262