6.7

Predefined Privileges
If your environment does not include a vCenter Server system, the following users are predefined.
root User
By default each ESXi host has a single root user account with the
Administrator role. That root user account can be used for local
administration and to connect the host to vCenter Server.
Assigning root user privileges can make it easier to break into an ESXi host
because the name is already known. Having a common root account also
makes it harder to match actions to users.
For better auditing, create individual accounts with Administrator privileges.
Set a highly complex password for the root account and limit the use of the
root account, for example, for use when adding a host to vCenter Server.
Do not remove the root account.
Best practice is to ensure that any account with the Administrator role on an
ESXi host is assigned to a specific user with a named account. Use ESXi
Active Directory capabilities, which allow you to manage Active Directory
credentials.
Important You can remove the access privileges for the root user.
However, you must first create another permission at the root level that has
a different user assigned to the Administrator role.
vpxuser User vCenter Server uses vpxuser privileges when managing activities for the
host.
The vCenter Server administrator can perform most of the same tasks on
the host as the root user and also schedule tasks, work with templates, and
so forth. However, the vCenter Server administrator cannot directly create,
delete, or edit local users and groups for hosts. Only a user with
Administrator privileges can perform these tasks directly on a host.
Note You cannot manage vpxuser using Active Directory.
Caution Do not change vpxuser in any way. Do not change its password.
Do not change its permissions. If you do so, you might experience
problems when working with hosts through vCenter Server.
dcui User The dcui user runs on hosts and acts with Administrator rights. This user’s
primary purpose is to configure hosts for lockdown mode from the Direct
Console User Interface (DCUI).
This user acts as an agent for the direct console and cannot be modified or
used by interactive users.
vSphere Security
VMware, Inc. 85