Minimum permissions to join vCenter appliance to AD.

By | February 8, 2015

Recently I got a question: what are the minimum required permissions to join vCenter appliance to AD?  Do I need to use a domain admin account?

The answer is: No, you don't have to use admin account.

By default domain users (Authenticated Users) can add 10 machines to the domain. So it means that you can use normal user account to join vCenter Appliance to domain.

I checked on Windows 2012 R2 by creating a domain user and used it for joining vCenter Appliance to domain.

vc_app1 vc_app2

A virtual machine vCenter-Test has been joined to AD:

vc_ap3

If you have prevented Authenticated Users from joining Workstations to domain, you can use Delegate Control to allow it. The minimum required permissions on Computer Object are:

  • Reset Password
  • Read and write Account Restrictions
  • Validated write to DNS host name
  • Validated write to service principal name

delegation

delegation2

For more information, please follow links:

http://technet.microsoft.com/en-us/library/cc780195%28v=ws.10%29.aspx.

http://support.microsoft.com/kb/932455

Author: Mariusz

Architect (~ 15 years experience based on passion...) with strong background as a System Administrator and Engineer. Focused on Data Center Solutions: Virtualization/Cloud Computing and Storage/Backup Systems. Currently living in Poland.

One thought on “Minimum permissions to join vCenter appliance to AD.

  1. Preetam

    Thanks for writing this. It helped me today. This article can also help someone to create a AD Account for view compiser

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

20 + 14 =