Use of virtual accounts for services on a Windows vCenter Server 6.0
search cancel

Use of virtual accounts for services on a Windows vCenter Server 6.0

book

Article ID: 313894

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

Starting from vCenter Server 6.0 for Windows, virtual accounts replace the Local Service Account used in vCenter Server 5.x to run the vCenter Server services. This article contains information on the impact it will have on your environment.

Environment

VMware vCenter Server 6.0.x

Resolution

Virtual accounts in vSphere 6.0 for Windows increase the security of vCenter Server by disallowing privilege escalation within the host operating system in the event that a single service becomes compromised. Because all services are placed into their own silo using virtual accounts. Even when a user gains access to a single virtual account, they are limited only to the functionality of that account and also limited to only that single service. This ensures that the vSphere 6.0 environment is running on a minimum set of privileges that is dependent on the specific service.
 
The following virtual accounts are now used as the service accounts to run their respective service.
 
ServiceService Account
VMware Component ManagerNT SERVICE\VMwareComponentManager
VMware Content Library ServiceNT SERVICE\vdcs
VMware ESX Agent ManagerNT SERVICE\EsxAgentManager
VMware Message Bus Config ServiceNT SERVICE\mbcs
VMware Performance ChartsNT SERVICE\vmware-perfcharts
VMware PostgresNT SERVICE\vPostgres
VMware vAPI EndpointNT SERVICE\vapiEndpoint
VMware vCenter workflow managerNT SERVICE\vmware-vpx-workflow
VMware vService ManagerNT SERVICE\VServiceManager
VMware vSphere Audo Deploy WaiterNT SERVICE\vmware-autodeploy-waiter
VMware vSphere Web ClientNT SERVICE\vspherewebclientsvc
 
Notes:
  • Future releases of vSphere uses unique virtual accounts for all services. However, vSphere 6.0 is limited to the preceding list.
  • Do not change these accounts after they are established.


Additional Information

For more information about Virtual Accounts, see these Microsoft TechNet articles:
When attempting to install or upgrade your vCenter Server 6.0, you may receive the error:
 
The user group "NT SERVICE\ALL SERVICES" does not have the "Log on as a service" user right. This precludes the ability to use the virtual accounts feature in Windows permit greater security through increased idolation of services. We recommend that you add this group back to the list of services that have this right. If this right is not added then any installed services that would normally use a virtual account will instead use "Local Service" account.
 
This is due to the NT SERVICE\All Services group on the local machine not having the Log on as a service right, which is a requirement. For more information, see vSphere Install and Upgrade guide.
 
To resolve this issue, see the Microsoft TechNet article Add a Log on as a service right to an account.
 
Note: The preceding links were correct as of October 27, 2015. If you find a link is broken provide a feedback and a VMware employee will update the link.
 
Windows vCenter Server 6.0 でのサービス用仮想アカウントの使用
在 Windows vCenter Server 6.0 上使用针对服务的虚拟帐户