6.0

6 Select the file type and click OK.
Assigning Permissions for ESXi
For ESXi, permissions are defined as access roles that consist of a user and the user’s assigned role for an
object such as a virtual machine or ESXi host. Permissions grant users the right to perform the activities
specified by the role on the object to which the role is assigned.
For example, to configure memory for the host, a user must be granted a role that includes the
Host.Configuration.Memory Configuration privilege. By assigning different roles to users for different
objects, you can control the tasks that users can perform in your vSphere environment.
When connecting directly to a host with the vSphere Client, the root and vpxuser user accounts have the
same access rights as any user assigned the Administrator role on all objects.
All other users initially have no permissions on any objects, which means they cannot view these objects or
perform operations on them. A user with Administrator privileges must assign permissions to these users to
allow them to perform tasks.
Many tasks require permissions on more than one object. These rules can help you determine where you
must assign permissions to allow particular operations:
n
Any operation that consumes storage space, such as creating a virtual disk or taking a snapshot,
requires the Datastore.Allocate Space privilege on the target datastore, as well as the privilege to
perform the operation itself.
n
Moving an object in the inventory hierarchy requires appropriate privileges on the object itself, the
source parent object (such as a folder or cluster), and the destination parent object.
n
Each host and cluster has its own implicit resource pool that contains all the resources of that host or
cluster. Deploying a virtual machine directly to a host or cluster requires the Resource.Assign Virtual
Machine to Resource Pool privilege.
The list of privileges is the same for both ESXi and vCenter Server.
You can create roles and set permissions through a direct connection to the ESXi host.
Permission Validation
vCenter Server and ESXi hosts that use Active Directory regularly validate users and groups against the
Windows Active Directory domain. Validation occurs whenever the host system starts and at regular
intervals specified in the vCenter Server settings.
For example, if user Smith was assigned permissions and in the domain the user’s name was changed to
Smith2, the host concludes that Smith no longer exists and removes permissions for that user when the next
validation occurs.
Similarly, if user Smith is removed from the domain, all permissions are removed when the next validation
occurs. If a new user Smith is added to the domain before the next validation occurs, the new user Smith
receives all the permissions the old user Smith was assigned.
Change Permissions
After a user and role pair is set for an inventory object, you can change the role paired with the user or
change the setting of the Propagate check box. You can also remove the permission setting.
Procedure
1 From the vSphere Client, select an object in the inventory.
2 Click the Permissions tab.
3 Right-click the line item to select the user and role pair.
vSphere Administration with the vSphere Client
72 VMware, Inc.