6.0.3

Change Permission Validation Settings
vCenter Server periodically validates its user and group lists against the users and groups in the user
directory. It then removes users or groups that no longer exist in the domain. You can disable validation or
change the interval between validations. If you have domains with thousands of users or groups, or if
searches take a long time to complete, consider adjusting the search seings.
For vCenter Server versions before vCenter Server 5.0, these seings apply to an Active Directory associated
with vCenter Server. For vCenter Server 5.0 and later, these seings apply to vCenter Single Sign-On
identity sources.
N This procedure applies only to vCenter Server user lists. ESXi user lists cannot be searched in the
same way.
Procedure
1 Browse to the vCenter Server system in the vSphere Web Client object navigator.
2 Select the Manage tab and click .
3 Click General and click Edit.
4 Select User directory.
5 Change the values as needed.
Option Description
User directory timeout
Timeout interval in seconds for connecting to the Active Directory server.
This value species the maximum amount of time vCenter Server allows a
search to run on the selected domain. Searching large domains can take a
long time.
Query limit
Select the checkbox to set a maximum number of users and groups that
vCenter Server displays.
Query limit size
Species the maximum number of users and groups that vCenter Server
displays from the selected domain in the Select Users or Groups dialog
box. If you enter 0 (zero), all users and groups appear.
6 Click OK.
Global Permissions
Global permissions are applied to a global root object that spans solutions, for example, both vCenter Server
and vCenter Orchestrator. Use global permissions to give a user or group privileges for all objects in all
object hierarchies.
Each solution has a root object in its own object hierarchy. The global root object acts as a parent object to
each solution object. You can assign global permissions to users or groups, and decide on the role for each
user or group. The role determines the set of privileges. You can assign a predened role or create custom
roles. See “Using Roles to Assign Privileges,” on page 147. It is important to distinguish between
vCenter Server permissions and global permissions.
vCenter Server
permissions
In most cases, you apply a permission to a vCenter Server inventory object
such as an ESXi host or a virtual machine. When you do, you specify that a
user or group has a set of privileges, called a role, on the object.
Global permissions
Global permissions give a user or group privileges to view or manage all
objects in each of the inventory hierarchies in your deployment.
vSphere Security
144 VMware, Inc.