6.0

ESXi Authentication and User
Management 7
ESXi handles user authentication and supports user permissions.
When you connect directly to an ESXi host with the vSphere Client, you can create users and groups that are
local to that ESXi host. You can also assign permissions to these users and groups.
vCenter Server is not aware of users that are local to ESXi, and ESXi is not aware of vCenter Server users.
For more information on managing users for ESXi hosts managed by vCenter Server, see the vSphere Security
documentation.
This chapter includes the following topics:
n
“Managing Users with the vSphere Client,” on page 69
n
“Assigning Permissions for ESXi,” on page 72
n
“Managing ESXi Roles,” on page 73
n
“Using Active Directory to Manage ESXi Users,” on page 76
n
“Use vSphere Authentication Proxy to Add a Host to a Domain,” on page 77
n
“Adjust the Search List in Large Domains,” on page 78
Managing Users with the vSphere Client
Manage users to control who is authorized to log in to ESXi.
In vSphere 5.1 and later, ESXi user management has the following caveats.
n
The users created when you connect directly to an ESXi host are not the same as the vCenter Server
users. When the host is managed by vCenter Server, vCenter Server ignores users created directly on
the host.
n
You cannot create ESXi users with the vSphere Web Client. You must log directly into the host with the
vSphere Client to create ESXi users.
n
ESXi 5.1 and later does not support local groups. However, Active Directory groups are supported.
To prevent anonymous users such as root from accessing the host with the Direct Console User Interface
(DCUI) or ESXi Shell, remove the user's administrator privileges on the root folder of the host. This applies
to both local users and Active Directory users and groups.
VMware, Inc.
69