Figure 18-1.
The Conceptual Structure of a Permission
object
role
permission =
user or group
By default, all users who are members of the Windows Administrators group on the vCenter Server system
have the same access rights as any user assigned to the Administrator role on all objects. When connecting
directly to an ESX/ESXi host, the root and vpxuser user accounts have the same access rights as any user
assigned the Administrator role on all objects.
All other users initially have no permissions on any objects, which means they cannot view these objects or
perform operations on them. A user with Administrator privileges must assign permissions to these users to
allow them to perform necessary tasks.
Many tasks require permissions on more than one object. Some general rules can help you determine where
you must assign permissions to allow particular operations:
n
Any operation that consumes storage space, such as creating a virtual disk or taking a snapshot, requires
the Datastore.Allocate Space privilege on the target datastore, as well as the privilege to perform the
operation itself.
n
Moving an object in the inventory hierarchy requires appropriate privileges on the object itself, the source
parent object (such as a folder or cluster), and the destination parent object.
n
Each host and cluster has its own implicit resource pool that contains all the resources of that host or
cluster. Deploying a virtual machine directly to a host or cluster requires the Resource.Assign Virtual
Machine to Resource Pool privilege.
Hierarchical Inheritance of Permissions
When you assign a permission to an object, you can choose whether the permission propagates down the object
hierarchy. Propagation is set per permission, not universally applied. Permissions defined for a child object
always override those propagated from parent objects.
Figure 18-2
illustrates the vSphere inventory hierarchy, and the paths by which permissions can propagate.
vSphere Basic System Administration
216
VMware, Inc.
Summary of Contents for 4817V62 - vSphere - PC
Page 13: ...Getting Started VMware Inc 13...
Page 14: ...vSphere Basic System Administration 14 VMware Inc...
Page 24: ...vSphere Basic System Administration 24 VMware Inc...
Page 38: ...vSphere Basic System Administration 38 VMware Inc...
Page 76: ...vSphere Basic System Administration 76 VMware Inc...
Page 85: ...Virtual Machine Management VMware Inc 85...
Page 86: ...vSphere Basic System Administration 86 VMware Inc...
Page 98: ...vSphere Basic System Administration 98 VMware Inc...
Page 131: ...3 Click OK Chapter 11 Creating Virtual Machines VMware Inc 131...
Page 132: ...vSphere Basic System Administration 132 VMware Inc...
Page 140: ...vSphere Basic System Administration 140 VMware Inc...
Page 172: ...vSphere Basic System Administration 172 VMware Inc...
Page 182: ...vSphere Basic System Administration 182 VMware Inc...
Page 200: ...vSphere Basic System Administration 200 VMware Inc...
Page 207: ...System Administration VMware Inc 207...
Page 208: ...vSphere Basic System Administration 208 VMware Inc...
Page 278: ...vSphere Basic System Administration 278 VMware Inc...
Page 289: ...Appendixes VMware Inc 289...
Page 290: ...vSphere Basic System Administration 290 VMware Inc...
Page 324: ...vSphere Basic System Administration 324 VMware Inc...
Page 364: ...vSphere Basic System Administration 364 VMware Inc...