Configuring the ESXi host with Active Directory authentication

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides steps to add an ESXi host to an Active Directory domain.

Resolution

The supported method of joining an ESXi host to the domain is from the UI.

To add an ESXi host to the Active Directory using vSphere Client (HTML5):

1. Confirm the ESXi host is synchronizing time with the Active Directory Domain controller. For more information, see Synchronizing ESXi/ESX time with a Microsoft Domain Controller.
2. From the vCenter Server vSphere Client, select the host that will be added to the Active Directory.
3. Click the Configure tab.
4. Click the Authentication Services.
5. Click the Join Domain... link at the top right pane.
6. In the Join Domain dialog, enter a domain. Use the form example.com or example.com/OU1/OU2.
7. Enter the username (in [email protected] format) and password of a directory service user account that has permission to join the host to the domain and click OK.
8. Click OK.
9. Click the Configure tab and click Advanced System Settings.
10. Under the Key column, click the filter icon and search for Config.HostAgent.plugins.hostsvc.esxAdminsGroup
11. Confirm the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting matches the Administrator group that will be used in the Active Directory. These settings take effect within a minute and no reboot is required. To edit, click the top right EDIT... link.

Note:

• If the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting is changed, ensure to remove any invalid users from the Permissions tab of the ESXi host.

 

Additional Information

Note: For information regarding required ports that need to be open between the ESXi hosts and the Active Directory domain controller, see the VMware Ports and Protocols guide (Filter for "Microsoft Active Directory Domain Controllers")

Note: Joining an ESXi hosts to an Active Directory domain with a read-only domain controller (RODC) is unsupported. ESXi hosts only can join an Active Directory domain with a writable domain controller.