Configuring Active Directory Authentication and Permissions for ESXi

Products

• VMware vSphere ESXi

Issue/Introduction

Enable Active Directory authentication and assign user permissions on ESXi hosts to streamline identity management and security compliance. This guide outlines the requirements and configuration steps for joining hosts to a domain and managing access control for domain users and groups.

Environment

VMware vSphere ESXi 7.x
VMware vSphere ESXi 8.x

Resolution

1. Join ESXi Host to Active Directory

1. Verify the ESXi host is synchronizing time with the Active Directory Domain Controller. For more information, see Synchronizing ESXi/ESX time with a Microsoft Domain Controller.
2. In the vSphere Client, select the host.
3. Navigate to Configure > System > Authentication Services.
4. Click Join Domain.
5. Enter the domain name (e.g., example.com), followed by a directory service user account with administrative privileges (e.g., [email protected]), and the password.
6. Click OK.

2. Configure Administrative Group (Advanced Setting)

1. Navigate to Configure > System > Advanced System Settings.
2. Search for Config.HostAgent.plugins.hostsvc.esxAdminsGroup.
3. Ensure the value matches the Active Directory Administrator group.
   
   For ESXi 8.0 Update 3 and later: Verify Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd is set according to your organizational security requirements. If it is false (default in 8.0U3+), permissions will not automatically propagate to the "ESX Admins" group and must be assigned manually.

3. Assign Permissions to Domain Users or Groups

1. Right-click the host and select Permissions.
2. Click Add.
3. Search for the domain user or group (format: DOMAIN\User or DOMAIN\Group).
4. Select the desired role (e.g., Administrator, Read-only, or a Custom Role).
5. Ensure Propagate to children is checked if the permissions apply to child objects.
6. Click OK to apply the permission

 

Additional Information

Note: For information regarding required ports that need to be open between the ESXi hosts and the Active Directory domain controller, see the VMware Ports and Protocols guide (Filter for "Microsoft Active Directory Domain Controllers")

Note: Joining an ESXi hosts to an Active Directory domain with a read-only domain controller (RODC) is unsupported. ESXi hosts only can join an Active Directory domain with a writable domain controller.

When an ESXi host is joined to Active Directory, a corresponding computer account is created in the domain.

By default, the Likewise authentication service automatically rotates the computer account password every 30 days. This process requires successful communication with a Read-Write Domain Controller (RWDC).

If communication between the ESXi host and an RWDC is unavailable, the password rotation will fail. This is because a Read-Only Domain Controller (RODC) maintains a strictly read-only copy of the Active Directory database and cannot process write operations such as password updates.

If the ESXi host communicates only with an RODC, the password rotation request will be rejected. As a result, the domain trust relationship will break, causing the ESXi host to lose its domain membership. Consequently, Active Directory users will no longer be able to authenticate to the host.

Reference:

Error: "LW_ERROR_PASSWORD_MISMATCH" during ESXi AD authentication

Note: If logins are failing but everything looks correct  validate that the customers domain security group that is used for authentication is actually present in the permissions list:

To check permissions: esxcli system permission list

To add a missing domain security group with admin rights: esxcli system permission set -g -i 'DOMAIN\security_group' -r Admin