6.7

If you create a rule, it does not inherit privileges from any of the system roles.
Administrator Role Users with the Administrator role for an object are allowed to view and
perform all actions on the object. This role also includes all privileges of the
Read Only role. If you have the Administrator role on an object, you can
assign privileges to individual users and groups.
If you are acting in the Administrator role in vCenter Server, you can assign
privileges to users and groups in the default vCenter Single Sign-On
identity source. Supported identity services include Windows Active
Directory and OpenLDAP 2.4.
By default, the [e-mail] user has the Administrator role
on both vCenter Single Sign-On and vCenter Server after installation. That
user can then associate other users with the Administrator role on
vCenter Server.
Read Only Role Users with the Read Only role for an object are allowed to view the state of
the object and details about the object. For example, users with this role
can view virtual machine, host, and resource pool attributes, but cannot
view the remote console for a host. All actions through the menus and
toolbars are disallowed.
No Access Role Users with the No Access role for an object cannot view or change the
object in any way. New users and groups are assigned this role by default.
You can change the role on an object-by-object basis.
The administrator of the vCenter Single Sign-On domain,
[e-mail] by default, the root user, and vpxuser are
assigned the Administrator role by default. Other users are assigned the No
Access role by default.
No Cryptography
Administrator Role
Users with the No cryptography administrator role for an object have the
same privileges as users with the Administrator role, except for
Cryptographic operations privileges. This role allows administrators to
designate other administrators that cannot encrypt or decrypt virtual
machines or access encrypted data, but that can perform all other
administrative tasks.
Best practice is to create a user at the root level and assign the Administrator role to that user. After
creating a named user with Administrator privileges, you can remove the root user from any permissions
or change its role to No Access.
Best Practices for Roles and Permissions
Follow best practices for roles and permissions to maximize the security and manageability of your
vCenter Server environment.
vSphere Security
VMware, Inc. 34