6.0.3

You can add local users and dene custom roles from the Management tab of the vSphere Client. See the
vSphere Administration with the vSphere Client documentation.
The following roles are predened:
Read Only
Allows a user to view objects associated with the ESXi host but not to make
any changes to objects.
Administrator
Administrator role.
No Access
No access. This is the default. You can override the default as appropriate.
You can manage local users and groups and add local custom roles to an ESXi host using a vSphere Client
connected directly to the ESXi host. See the vSphere Administration with the vSphere Client documentation.
Starting with vSphere 6.0, you can use ESXCLI account management commands for managing ESXi local
user accounts. You can use ESXCLI permission management commands for seing or removing permissions
on both Active Directory accounts (users and groups) and on ESXi local accounts (users only).
N If you dene a user for the ESXi host by connecting to the host directly, and a user with the same
name also exists in vCenter Server, those users are dierent. If you assign a role to one of the users, the other
user is not assigned the same role.
root User Privileges
By default each ESXi host has a single root user account with the Administrator role. That root user account
can be used for local administration and to connect the host to vCenter Server.
This common root account can make it easier to break into an ESXi host and make it harder to match actions
to a specic administrator.
Set a highly complex password for the root account and limit the use of the root account, for example, for
use when adding a host to vCenter Server. Do not remove the root account. In vSphere 5.1 and later, only
the root user and no other named user with the Administrator role is permied to add a host to
vCenter Server.
Best practice is to ensure that any account with the Administrator role on an ESXi host is assigned to a
specic user with a named account. Use ESXi Active Directory capabilities, which allow you to manage
Active Directory credentials if possible.
I If you remove the access privileges for the root user, you must rst create another permission
at the root level that has a dierent user assigned to the Administrator role.
vpxuser Privileges
vCenter Server uses vpxuser privileges when managing activities for the host.
vCenter Server has Administrator privileges on the host that it manages. For example, vCenter Server can
move virtual machines to and from hosts and perform conguration changes needed to support virtual
machines.
vSphere Security
188 VMware, Inc.