6.1

Creating Groups for Users
You should create groups for different types of users in Active Directory. For example, you can create a
group called View Users for your end users and another group called View Administrators for users that
will administer remote desktops and applications.
Creating a User Account for vCenter Server
You must create a user account in Active Directory to use with vCenter Server. You specify this user account
when you add a vCenter Server instance in View Administrator.
You must give the user account privileges to perform certain operations in vCenter Server. You can create a
vCenter Server role with the appropriate privileges and assign the role to the vCenter Server user. The list of
privileges you add to the vCenter Server role varies, depending on whether you use View with or without
View Composer. See “Configuring User Accounts for vCenter Server and View Composer,” on page 89 for
information on configuring these privileges.
If you install View Composer on the same machine as vCenter Server, you must add the vCenter Server user
to the local Administrators group on the vCenter Server machine. This requirement allows View to
authenticate to the View Composer service.
If you install View Composer on a different machine than vCenter Server, you do not have to make the
vCenter Server user a local administrator on the vCenter Server machine. However, you do have to create a
standalone View Composer Server user account that must be a local administrator on the View Composer
machine.
Creating a User Account for a Standalone View Composer Server
If you install View Composer on a different machine than vCenter Server, you must create a domain user
account in Active Directory that View can use to authenticate to the View Composer service on the
standalone machine.
The user account must be in the same domain as your View Connection Server host or in a trusted domain.
You must add the user account to the local Administrators group on the standalone View Composer
machine.
You specify this user account when you configure View Composer settings in View Administrator and
select Standalone View Composer Server. See “Configure View Composer Settings,” on page 96.
Create a User Account for View Composer AD Operations
If you use View Composer, you must create a user account in Active Directory that allows View Composer
to perform certain operations in Active Directory. View Composer requires this account to join linked-clone
virtual machines to your Active Directory domain.
To ensure security, you should create a separate user account to use with View Composer. By creating a
separate account, you can guarantee that it does not have additional privileges that are defined for another
purpose. You can give the account the minimum privileges that it needs to create and remove computer
objects in a specified Active Directory container. For example, the View Composer account does not require
domain administrator privileges.
Procedure
1 In Active Directory, create a user account in the same domain as your View Connection Server host or
in a trusted domain.
Chapter 4 Preparing Active Directory
VMware, Inc. 27