6.5.1

This common root account can make it easier to break into an ESXi host because the name is already
known. Having a common root account also makes it harder to match actions to users.
For better auditing, create individual accounts with Administrator privileges. Set a highly complex
password for the root account and limit the use of the root account, for example, for use when adding a
host to vCenter Server. Do not remove the root account.
Best practice is to ensure that any account with the Administrator role on an ESXi host is assigned to a
specific user with a named account. Use ESXi Active Directory capabilities, which allow you to manage
Active Directory credentials.
Important You can remove the access privileges for the root user. However, you must first create
another permission at the root level that has a different user assigned to the Administrator role.
vpxuser Privileges
vCenter Server uses vpxuser privileges when managing activities for the host.
vCenter Server has Administrator privileges on the host that it manages. For example, vCenter Server
can move virtual machines to and from hosts and change virtual machine configuration.
The vCenter Server administrator can perform most of the same tasks on the host as the root user and
also schedule tasks, work with templates, and so forth. However, the vCenter Server administrator cannot
directly create, delete, or edit local users and groups for hosts. Only a user with Administrator privileges
can perform these tasks directly on a host.
Note You cannot manage the vpxuser using Active Directory.
Caution Do not change vpxuser in any way. Do not change its password. Do not change its
permissions. If you do so, you might experience problems when working with hosts through
vCenter Server.
dcui User Privileges
The dcui user runs on hosts and acts with Administrator rights. This user’s primary purpose is to configure
hosts for lockdown mode from the Direct Console User Interface (DCUI).
This user acts as an agent for the direct console and cannot be modified or used by interactive users.
vSphere Security
VMware, Inc. 87