6.5.1

Using Active Directory to Manage ESXi Users
You can configure ESXi to use a directory service such as Active Directory to manage users.
Creating local user accounts on each host presents challenges with having to synchronize account
names and passwords across multiple hosts. Join ESXi hosts to an Active Directory domain to eliminate
the need to create and maintain local user accounts. Using Active Directory for user authentication
simplifies the ESXi host configuration and reduces the risk for configuration issues that could lead to
unauthorized access.
When you use Active Directory, users supply their Active Directory credentials and the domain name of
the Active Directory server when adding a host to a domain.
Configure a Host to Use Active Directory
You can configure a host to use a directory service such as Active Directory to manage users and groups.
When you add an ESXi host to Active Directory, the DOMAIN group ESX Admins is assigned full
administrative access to the host if it exists. If you do not want to make full administrative access
available, see VMware Knowledge Base article 1025569 for a workaround.
If a host is provisioned with Auto Deploy, Active Directory credentials cannot be stored on the hosts. You
can use the vSphere Authentication Proxy to join the host to an Active Directory domain. Because a trust
chain exists between the vSphere Authentication Proxy and the host, the Authentication Proxy can join
the host to the Active Directory domain. See Using vSphere Authentication Proxy.
Note When you define user account settings in Active Directory, you can limit the computers that a user
can log in to by the computer name. By default, no equivalent restrictions are set on a user account. If
you set this limitation, LDAP Bind requests for the user account fail with the message LDAP binding not
successful, even if the request is from a listed computer. You can avoid this issue by adding the
netBIOS name for the Active Directory server to the list of computers that the user account can log in to.
Prerequisites
n
Verify that you have an Active Directory domain. See your directory server documentation.
n
Verify that the host name of ESXi is fully qualified with the domain name of the Active Directory forest.
fully qualified domain name = host_name.domain_name
Procedure
1 Synchronize the time between ESXi and the directory service system using NTP.
See Synchronize ESXi Clocks with a Network Time Server or the VMware Knowledge Base for
information about how to synchronize ESXi time with a Microsoft Domain Controller.
vSphere Security
VMware, Inc. 88