6.0.3

When you manage a host using vCenter Server, the permissions associated with that host are created
through vCenter Server and stored on vCenter Server. If you connect directly to a host, only the roles that
are created directly on the host are available.
N When you add a custom role and do not assign any privileges to it, the role is created as a Read Only
role with three system-dened privileges: System.Anonymous, System.View, and System.Read.
Creating Roles in the vSphere Web Client
(hp://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_creating_role_in_vsphere_webclient)
vCenter Server System Roles
A role is a predened set of privileges. When you add permissions to an object, you pair a user or group
with a role. vCenter Server includes several system roles, which you cannot change.
vCenter Server System Roles
vCenter Server provides a small number of default roles. You cannot change the privileges associated with
the default roles. The default roles are organized as a hierarchy; each role inherits the privileges of the
previous role. For example, the Administrator role inherits the privileges of the Read Only role. Roles that
you create do not inherit privileges from any of the system roles.
Administrator Role
Users assigned the Administrator role for an object are allowed to view and
perform all actions on the object. This role also includes all privileges
inherent in the Read Only role. If you are acting in the Administrator role on
an object, you can assign privileges to individual users and groups. If you are
acting in the Administrator role in vCenter Server, you can assign privileges
to users and groups in the default vCenter Single Sign-On identity source.
Supported identity services include Windows Active Directory and
OpenLDAP 2.4.
By default, the [e-mail] user has the Administrator role
on both vCenter Single Sign-On and vCenter Server after installation. That
user can then associate other users with the Administrator role on
vCenter Server.
No Access Role
Users assigned the No Access role for an object cannot view or change the
object in any way. New users and groups are assigned this role by default.
You can change the role on an object-by-object basis.
The [e-mail] user, the root user, and vpxuser are the only
users not assigned the No Access role by default. Instead, they are assigned
the Administrator role. You can remove the root user from any permissions
or change its role to No Access as long as you rst create a replacement
permission at the root level with the Administrator role and associate this
permission with a dierent user.
Read Only Role
Users assigned the Read Only role for an object are allowed to view the state
of the object and details about the object. With this role, a user can view
virtual machine, host, and resource pool aributes. The user cannot view the
remote console for a host. All actions through the menus and toolbars are
disallowed.
vSphere Security
148 VMware, Inc.