Configuring the ESXi host with Active Directory authentication

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides steps to add an ESXi host to an Active Directory domain. 

Environment

VMware vSphere ESXi 5.0
VMware vSphere ESXi 5.5
VMware vSphere ESXi 6.5
VMware vSphere ESXi 8.0.x
VMware vSphere ESXi 5.1
VMware vSphere ESXi 6.7
VMware vSphere ESXi 7.0.x
VMware vSphere ESXi 6.0

Resolution

The supported method of joining an ESXi host to the domain is from the UI.

To add an ESXi host to the Active Directory using vSphere Client (HTML5):

1. Confirm the ESXi host is synchronizing time with the Active Directory Domain controller. For more information, see Synchronizing ESXi/ESX time with a Microsoft Domain Controller (1035833).
2. From the vCenter Server vSphere Client, select the host that you want to add to the Active Directory.
3. Click the Configure tab.
4. Click the Authentication Services.
5. Click the Join Domain... link at the top right pane.
6. In the Join Domain dialog, enter a domain. Use the form domain.com or domain.com/OU1/OU2.
7. Enter the user name (in [email protected] format) and password of a directory service user account that has permission to join the host to the domain and click OK.
8. Click OK.
9. Click the Configure tab and click Advanced System Settings.
10. Under the Key column, click the filter icon and search for Config.HostAgent.plugins.hostsvc.esxAdminsGroup
11. Confirm the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting matches the Administrator group that you want to use in the Active Directory. These settings take effect within a minute and no reboot is required. To edit, click the top right EDIT... link.

Notes:

• If the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting is changed, ensure to remove any invalid users from the Permissions tab of the ESXi host.

Additional Information

Impact/Risks:
Joining an ESXi hosts to an Active Directory domain with a read-only domain controller (RODC) is unsupported. You can join an ESXi hosts only to an Active Directory domain with a writable domain controller.