Removing Local Administrators from vCenter Fails with Privilege Error.

Products

• VMware vCenter Server

Issue/Introduction

While attempting to remove the local administrator account from vCenter Server, the following issues were reported:

• Unable to remove the Administrators group from the default Administrator role at the vCenter Server top-level permissions tab.

• The removal operation fails, generating the following error message:

The requested change cannot be completed because it could leave the system without full administrative privileges for a user or group.

Environment

VMware vCenter Server 

Cause

This behavior is by design. It acts as a built-in safeguard to prevent accidental system lockouts and ensure you do not lose management access to the vCenter Server.

Resolution

To resolve this issue, assign the Administrator role to an alternate user or group before removing the local Administrators group from the vCenter Server Administrator role.

Steps to Assign the Administrator Role:

1. Navigate to the Permissions tab in vCenter Server UI.

2. Right-click within the pane and select Add Permission.

3. Click Add, then select the desired user or group.

4. From the Assigned Role drop-down menu, select Administrator.

5. Verify that the Propagate to Child Objects checkbox is selected, and then click OK.

Now proceed with removing the local Administrators group from the vCenter Server Administrator role.

Additional Information

• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.
• For defects and enhancements, it is recommended to subscribe to this article to be updated on fix status: How to subscribe to Knowledge Management articles.