6.0

Using Active Directory to Manage ESXi Users
You can configure ESXi to use a directory service such as Active Directory to manage users.
Creating local user accounts on each host presents challenges with having to synchronize account names
and passwords across multiple hosts. Join ESXi hosts to an Active Directory domain to eliminate the need to
create and maintain local user accounts. Using Active Directory for user authentication simplifies the ESXi
host configuration and reduces the risk for configuration issues that could lead to unauthorized access.
When you use Active Directory, users supply their Active Directory credentials and the domain name of the
Active Directory server when adding a host to a domain.
Configure a Host to Use Active Directory
You can configure the host to use a directory service such as Active Directory to manage users and groups.
Prerequisites
n
Verify that you have an Active Directory domain. See your directory server documentation.
n
Verify that the host name of ESXi is fully qualified with the domain name of the Active Directory forest.
fully qualified domain name = host_name.domain_name
Procedure
1 Synchronize the time between ESXi and the directory service system using NTP.
ESXi supports synchronizing time with an external NTPv3 or NTPv4 server that is compliant with RFC
5905 and RFC 1305. The Microsoft Windows W32Time service does not meet these requirements when
running with default settings. See the vSphere Security documentation or the VMware Knowledge Base
for information about how to synchronize ESXi time with a Microsoft Domain Controller.
2 Ensure that the DNS servers you configured for the host can resolve the host names for the Active
Directory controllers.
a In the vSphere Client, select the host in the inventory.
b Click the Configuration tab and click DNS and Routing.
c Click the Properties link at the top right of the panel.
d In the DNS and Routing Configuration dialog box, verify that the host name and DNS server
information for the host are correct.
What to do next
Use the vSphere Client to join a directory service domain.
Add a Host to a Directory Service Domain
To use a directory service, you must join the host to the directory service domain.
You can enter the domain name in one of two ways:
n
name.tld (for example, domain.com): The account is created under the default container.
n
name.tld/container/path (for example, domain.com/OU1/OU2): The account is created under a particular
organizational unit (OU).
To use the vSphere Authentication Proxy service (CAM service), see the vSphere Security documentation.
vSphere Administration with the vSphere Client
76 VMware, Inc.