6.7

Assigning Permissions to ESXi Hosts That Are Managed by
vCenter Server
If your ESXi host is managed by a vCenter Server, perform management tasks through the
vSphere Web Client.
You can select the ESXi host object in the vCenter Server object hierarchy and assign the administrator
role to a limited number of users. Those users can then perform direct management on the ESXi host.
See Using Roles to Assign Privileges.
Best practice is to create at least one named user account, assign it full administrative privileges on the
host, and use this account instead of the root account. Set a highly complex password for the root
account and limit the use of the root account. Do not remove the root account.
Assigning Permissions to Standalone ESXi Hosts
You can add local users and define custom roles from the Management tab of the VMware Host Client.
See the vSphere Single Host Management - VMware Host Client documentation.
For all versions of ESXi, you can see the list of predefined users in the /etc/passwd file.
The following roles are predefined.
Read Only Allows a user to view objects associated with the ESXi host but not to make
any changes to objects.
Administrator Administrator role.
No Access No access. This role is the default role. You can override the default role.
You can manage local users and groups and add local custom roles to an ESXi host using a
VMware Host Client connected directly to the ESXi host. See the vSphere Single Host Management -
VMware Host Client documentation.
Starting with vSphere 6.0, you can use ESXCLI account management commands for managing ESXi
local user accounts. You can use ESXCLI permission management commands for setting or removing
permissions on both Active Directory accounts (users and groups) and on ESXi local accounts (users
only).
Note If you define a user for the ESXi host by connecting to the host directly, and a user with the same
name also exists in vCenter Server, those users are different. If you assign a role to the ESXi user, the
vCenter Server user is not assigned the same role.
vSphere Security
VMware, Inc. 84