6.5.1

12 Select Active Directory (Integrated Windows Authentication), enter the identity source seings of the
joined Active Directory domain, and click OK.
Table 3‑1. Add Identity Source Settings
Text Box Description
Domain name FDQN of the domain. Do not provide an IP address in
this text box.
Use machine account Select this option to use the local machine account as the
SPN. When you select this option, you specify only the
domain name. Do not select this option if you expect to
rename this machine.
Use Service Principal Name (SPN) Select this option if you expect to rename the local
machine. You must specify an SPN, a user who can
authenticate with the identity source, and a password for
the user.
Service Principal Name (SPN) SPN that helps Kerberos to identify the Active Directory
service. Include the domain in the name, for example,
STS/example.com.
You might have to run setspn -S to add the user you
want to use. See the Microsoft documentation for
information on setspn.
The SPN must be unique across the domain. Running
setspn -S checks that no duplicate is created.
User Principal Name (UPN) Name of a user who can authenticate with this identity
source. Use the email address format, for example,
[e-mail]. You can verify the User Principal
Name with the Active Directory Service Interfaces Editor
(ADSI Edit).
Password Password for the user who is used to authenticate with
this identity source, which is the user who is specied in
User Principal Name. Include the domain name, for
example, [e-mail].
On the Identity Sources tab, you can see the joined Active Directory domain.
What to do next
You can congure permissions for users and groups from the joined Active Directory domain to access the
vCenter Server components. For information about managing permissions, see the vSphere Security
documentation.
Leave an Active Directory Domain
After you joined the vCenter Server Appliance, you can log in to the vSphere Web Client and set up the
vCenter Server Appliance to leave the Active Directory domain.
Prerequisites
Verify that the user who logs in to the vCenter Server instance in the vCenter Server Appliance is a member
of the SystemConguration.Administrators group in vCenter Single Sign-On.
Procedure
1 Use the vSphere Web Client to log in as administrator@your_domain_name to the vCenter Server instance
in the vCenter Server Appliance.
The address is of the type hp://appliance-IP-address-or-FQDN/vsphere-client.
Chapter 3 Using the vSphere Web Client to Configure the vCenter Server Appliance
VMware, Inc. 23