User [email protected] looks lost permissions to activities on objects of the inventory.

Products

• VMware vSphere ESXi

Issue/Introduction

User [email protected] looks like doesn't have permissions.

On trying to perform operations on the inventory using the administrator account, all or some of the options are grayed out.

The SSO Administrator account still being member of the Administrators group and have permission to perform operations in the other parts of vSphere Web Client including the Menu > Administration > Single Sign On > Users and Groups.

User Administrator cannot change the permissions of the object nor of the parent (options are grayed out).

Overall usage of vCenter is normal, all services starting, no errors reported.

 

Environment

vSphere Web Client

vCenter Server all versions.

Cause

The role of the administrator account got manually changed on the object or in the parent objects including on the vCenter level.

The roles of the users follow the more restrictive, for instance:

User Administrator is member of the Administrators group which still associated to the Administrator role.

But the user Administrator has been associated to the role "Read-Only" in the vCenter level.

Sample:

 

 

Resolution

1. Login with an account that is member of the group of Administrators (Since administrator still have the permissions on the Single Sign-On, you can create a new account and add it to the group Administrators).
2. Select the Parent that has the wrong permission  then choose Permissions.
3. Select the line for the VSPHERE.LOCAL\Administrator and click on EDIT.
4. Change the Role to be as "Administrator".
5. Make sure you keep the "Propagate to children" checked then click "OK".
6. Log out from that account and login with Administrator to validate the fix.
7. Consider to delete the new account created if it is no longer necessary.