6.5.1

When you manage a host using vCenter Server, the permissions associated with that host are created
through vCenter Server and stored on vCenter Server. If you connect directly to a host, only the roles that
are created directly on the host are available.
Note When you add a custom role and do not assign any privileges to it, the role is created as a Read
Only role with three system-defined privileges: System.Anonymous, System.View, and System.Read.
Creating Roles in the vSphere Web Client
(http://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_creating_role_in_vsphere_webclient)
vCenter Server System Roles
A role is a predefined set of privileges. When you add permissions to an object, you pair a user or group
with a role. vCenter Server includes several system roles, which you cannot change.
vCenter Server System Roles
vCenter Server provides a few default roles. You cannot change the privileges associated with the default
roles. The default roles are organized as a hierarchy. Each role inherits the privileges of the previous role.
For example, the Administrator role inherits the privileges of the Read Only role. Roles that you create do
not inherit privileges from any of the system roles.
Administrator Role Users with the Administrator role for an object are allowed to view and
perform all actions on the object. This role also includes all privileges
inherent in the Read Only role. If you are acting in the Administrator role on
an object, you can assign privileges to individual users and groups. If you
are acting in the Administrator role in vCenter Server, you can assign
privileges to users and groups in the default vCenter Single Sign-On
identity source. Supported identity services include Windows Active
Directory and OpenLDAP 2.4.
By default, the [e-mail] user has the Administrator role
on both vCenter Single Sign-On and vCenter Server after installation. That
user can then associate other users with the Administrator role on
vCenter Server.
No Cryptography
Administrator Role
Users with the No cryptography administrator role for an object have the
same privileges as users with the Administrator role, except for
Cryptographic operations privileges. This role allows administrators to
designate other administrators that cannot encrypt or decrypt virtual
machines or access encrypted data, but that can perform all other
administrative tasks.
No Access Role Users with the No Access role for an object cannot view or change the
object in any way. New users and groups are assigned this role by default.
You can change the role on an object-by-object basis.
vSphere Security
VMware, Inc. 34