Administrator account permissions grayed out in vCenter Server

Products

• VMware vSphere ESXi

Issue/Introduction

Buttons to Add, Edit, or Delete Global Permissions are grayed out or unresponsive in the Administration menu

On trying to perform operations on the inventory using the Administrator account, all or some of the options are grayed out.

The SSO Administrator account still being member of the Administrators group and have permission to perform operations in the other parts of vSphere Web Client including the Menu > Administration > Single Sign On > Users and Groups.

User Administrator cannot change the permissions of the object nor of the parent (options are grayed out).

Specific restrictive roles, such as VM Encryption or Read-Only, appear assigned to the administrator account at the vCenter or Global level.

 

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

vCenter Server permission logic dictates that an explicit permission assigned directly to a user account takes precedence over permissions inherited from group memberships. If the [email protected] user is manually associated with a restrictive role (e.g., Read-Only) at the vCenter Root or Global level, it loses the full administrative rights provided by the Administrators group. For instance:

User Administrator is member of the Administrators group which still associated to the Administrator role.

But the user Administrator has been associated to the role "Read-Only" in the vCenter level.

Sample:

 

 

Resolution

1. Login with an account that is member of the group of Administrators (Since administrator still have the permissions on the Single Sign-On, you can create a new account and add it to the group Administrators).
2. Select the Parent that has the wrong permission  then choose Permissions.
3. Select the line for the VSPHERE.LOCAL\Administrator and click on EDIT.
4. Change the Role to be as "Administrator".
5. Make sure you keep the "Propagate to children" checked then click "OK".
6. Log out from that account and login with Administrator to validate the fix.
7. Consider to delete the new account created if it is no longer necessary.