Installation of vCenter 4.1 as a domain user

I installed vCenter one several times but already when I installed vCenter I ran the installation as an administrator and checked "use the SYSTEM account" option during installalation. I recently read a document of security on vCenter and he mentioned vCenter installation as a domain user that has local administrative access on the computer where is installed vCenter. To test this feature, I created a user in Active Directory that is running on Windows Server 2008 Standard and attempted to add this user to the local "Administrators" group of the server vCenter will install on (not in the ad). When I tried to add the user I got an error message stating that "user X is already a member of the"Administrators"group.

I did a google search on that error message and found out that basically unless you use what is called a small group it is not possible to add a user domain user to a local group. If this is true then everyone is how to install vCenter without using the SYSTEM account. My goal in this configuration is to install vCenter and allow users to connect to vCenter using it AD user name and password. I would like to Manager user rights using a combination of groups of ads and roles of vCenter. This environment is small and uses SQL Express as the backend vCenter.

As you can probably I'm not an expert AD so if there is something that I was completely misunderstanding do not hesitate to say.

Thank you!

The steps are correct.

Sounds like you have a GPO that block users in local administrator:

http://TechNet.Microsoft.com/en-us/library/cc756802.aspx

Or if you have some duplicate SID...

How did you create the Windows Server? Perhaps with a clone?

André

Tags: VMware

Similar Questions

  • Having problems setting up a 5.5 vCenter Server VM in a domain configuration...

    I'm trying to implement a vCenter Server VM (new installation, no upgrade) without an Active Directory domain that is available.  I was able to do this successfully in the past with 5.0 and 5.1, but now with 5.5 I have problems.

    Installing SSO works fine and displays warnings expected that the server is not on a domain and the certificate will be bound to the INVESTIGATION period.

    When I then try to run Setup from the inventory Service, it fails when you try to connect to the SSO:

    "Could not connect to vCenter Single Sign On.  Make sure that the Search Service URL points correctly to the vCenter Single Sign On the instance that you installed.  If vCenter Single Sign-On is installed with an IP address, make sure that the IP address is specified in the URL.

    5.0 and 5.1, in order to get this installation runs correctly, I would like to enter the IP address in the URL (as it says in the error), and he'd be fine.  So the address provided for the Research Service URL is https://< ip_address >: 7444/lookupservice/sdk

    I tried several variants for the fields of FULL domain name and URL of the Service search without success.

    Can someone confirm a successful for 5.5 off-field installation?  And if so, try to direct me in the right direction?

    I end up doing work, it turned out to be an order of operations issue.

    I tried to install SSO, then service inventory, then Web Service, then vcenter Server.  And on a domain, this order actually worked well.  For some reason any, when not on a domain, they must go SSO-> Web Service-> Service-> vCenter Server inventory (this command works in both scenarios, just to be clear).

  • vCenter tip only on a domain controller?

    I have 3 domain controllers (Windows 2003R2) no virtualized and then 3 x 4.1 ESXi hosts that also have a VM virtualized vCenter.  Access to vCenter is controlled via Active Directory.

    I would like to take his retirement one of my old domain controllers, so I moved all the roles of it etc. as usual, then close to see if everything has failed.   I'm still 2 other DCs/GCs.  All computers in Desktop/server/user services are still working fine, but vSphere stopped accepting logons and gave me this in the event log.

    The directory server doesn't have to update the ADAM serviceConnectionPoint object in Active Directory. This operation will be retried.

    Additional data

    Object SCP DN:
    CN = {40130314-98b1-4511-977f-3c890bf33946}, CN = VCENTRE, UO member servers, DC = fal =, DC = local
    Error value:
    58 the specified server cannot perform the requested operation.
    Server error:
    (n/a)
    Internal ID:
    3390067
    ADAM service account:
    AUTHORITY NT\SERVICE NETWORK

    User action

    If ADAM is running under a local account, it cannot update the data in Active Directory. Remember to change the ADAM to NetworkService service account or a domain account.

    If ADAM is running under a domain user account, make sure that this account has sufficient rights to update the serviceConnectionPoint object.


    Object publishing ServiceConnectionPoint can be disabled for this instance of the attribute msDS-DisableForInstances parameter on the publication of SCP configuration object.

    It seems to me that it is only by looking at the DC I had off ready to retire (called DC1 while my other are DC2 and DC3).  How can I make sure vSphere is not bound to a specific domain controller, as I guess that's what's happened here?

    Thank you
    Andy

    Hello.

    Is DNS on the server vCenter Server and in the field? It might be a problem here.

    Good luck!

  • vCenter provide a novell / netware domain

    I am currently planning the installation of vCenter/vSphere in a field by which the do didn't ActiveDirectory - they're still running novell / netware.

    I'm not too familiar with netware - I know it is LDAP, but vCenter will integrate with it for authentication services? Or do I just run my user accounts locally for vCenter?

    Thank you.

    Today, its only ActiveDirectory.

  • Displacement of the ESX 4.0 host a VCenter server in different Windows domain

    Hi people,

    Current situation: two ESX 4.0 host controlled by a VCenter 4.0 Server (Cluster) within a Windows Server 2003 - field. All the user access control is done with the users in the domain of the old domain. The cluster and all the VMS are running fine without any problem.

    There is a Windows 2008 domain. We want to set up a new server VCenter 4.0 inside the new domain and move both ESX 4.0 hosts to the new cluster / VCenter Server 4.0.

    What is the right way to do it without block me out Vcenter / ESX?

    1) implemented the new vcenter one create a cluster

    (2) removing both the old cluster ESX servers

    (3) joining the two ESX servers to the new cluster

    (4) granting the domain users from access to the new domain to virtual machines...

    Is it really that easy?

    Should which accounts I include both ESX hosts to the new vcenter/cluster? The root-password? We have forgotten, but there is a way to reset it (single user mode), this shouldn't be a big problem.

    Thank you for your kind support,

    Wolfgang

    You must add the hosts to the new cluster through their DNS names and supply the root password when prompted.

    Make sure that select "piggyback pools of resources of the host" If you want to keep your pools on the new vCenter. To do this you must enable DRS in the new cluster too.

  • Virtual Center 5.1 domain user addition problem

    Hi guys, after update from vCenter 5.0 to 5.1 I have no more to add the domain users. In fact, in the drop-down list does not appear the domain name. That's happened? any ideas?

    Join my screenshot

    you have your configuration of alias domain like VMWARELAB?  It took us a while to understand this a lot by trial and error.  Also, have you moved your ad in the areas 'default' to the top?

  • Why not works automatic update of the Adobe Reader software for domain users

    Hello

    I tried to update automatically to version 11.0.2 version 11.0.3 on my domain so that it is logged on as a user account. Auto Update settings work if I am logged on as administrator, but not as a domain user.

    I was under the impression that the installation of the automatic update as a service could undermine permission issues that has tied the program update. It seems that way.

    I can confirm that I have auto update together in Adobe Reader and the registry entry

    HKLM\SOFTWARE\Wow6432Node\Adobe\Adobe ARM\1.0\ARM

    where the iCheckReader DWORD value is equal to 3.

    Finally, I'd like for Adobe Reader to perform a silent installation without any prompts from the domain user. Currently I find the automatic update does not work for users.

    For the record, I'm not behind a proxy.

    Kind regards

    Haydn

    It could be that there is a set of policies administrave for the domain that is forbidden.

  • Should I have a domain user id?

    I am installing Hyperion Planning products and related products on 2 windows servers, my question is: should I create a username / password for the installation and the configuration domain user? Or it is not necessary if I for two machines local administrator permissions? Please notify and why? Thank you

    You can have either, as long as it is an administrator of the machine.

    Documentation

    "For each Windows Server, prepare a user account with Local administrator rights. Install and configure as an administrator and under the same user for all EPM system products. »

    See you soon

    John
    http://John-Goodwin.blogspot.com/

  • Logged in as admin. Cannot change the domain users group to the domain administrator

    My domain administrator is defined as a domain user and I want to change it to domain administrator. The groups gathered outside the account > users > Admin > groups section.

    Hello Tripline,

    Please provide number and firmware version of your ReadyNAS model.

    What's your ReadyNAS built-in AD? The ReadyNAS will simply copy the accounts of the ADS in your ad. Existing domain user, 'Administrator' should be adjusted to have administrator rights. I guess you should change everything first, and then integrate the NAS again to the AD.

    Kind regards

  • How to lock COMPLETELY ordinary domain users?

    Put the NG Nas Duo 2 for the security of the domain.

    I am able to configure existing actions by applying file permissions as a domain administrator.

    However, any time that a "regular domain user" navigates to the NAS, they automatically get a "home" folder created for them and they can do what he wants with it!

    How can I configure things to block this behavior?

    I assume you mean the ReadyNAS Duo v2 (running firmware 5.x) rather than the original Duo (running 4.x).

    Unfortunately the home folders of the user cannot be turned off through the user interface on the NV + / Duo v2.

    Home folders can be disabled in the back-end via SSH (starting from a previous thread by mdgm):

    1. Edit the file "/ etc/default/services", change "USER_HOME_DIRECTORY = 1" to "USER_HOME_DIRECTORY = 0".

    2. Update the configuration in the readynasd database:
      SQLite3 /var/readynasd/db.sq3 "UPDATE service_misc SET val = '0' WHERE key ="USER_HOME_DIRECTORY"

  • Domain user Windows 2008r2 with the admin group membership

    Hello

    I have a windows 2008R2 domain controller and a user there are members of the admin. When I log in with that account to a pc windows 7 (member of the same domain), I'm not able to change any setting as properties of lan, uninstall or reinstall all programs.

    I also want to give the domain users only the rights to change the properties of local network (for users of laptops).

    Thanks in advance

    Your question is out of reach of these forums as server issues are best addressed on Technet:

    https://social.technet.Microsoft.com/forums/

    So please post your request there.

  • window of 2008: ' I can't open Group Policy Management "group policy to manage, you must log on to the computer with a domain user account.

    Hi, please advise, I can't open Group on win Server 2008 policy management, it is said
    "To manage Group Policy, you must log on to the computer with a domain user account.

    Hi Cucu KurniaPutra,

    Thanks for asking this question to Microsoft Community!

    The problem occurs in Windows Server 2008 Network, please post your request on the Microsoft TechNet forums to get help.

    Here is the link:

    http://social.technet.Microsoft.com/forums/en-us/category/WindowsServer

    It will be useful. For any other corresponding Windows help, do not hesitate to contact us and we will be happy to help you.

    Kind regards!

  • I have given rights of domain users to log on locally, but still cannot connect (Server 2008)

    Hello. I ' using server2008r2 on virtualbox. I'm going through the 70-640 exam.

    I went through the steps described in this article http://technet.microsoft.com/en-us/library/ee957044 (WS.10) .aspx to add domain users rights to login locally. I ran gpupdate/force and me rebooted the machine, but I can not yet connect locally. I get "you cannot connect because the logon method, you use is not allowed on this computer.

    Any ideas?

    I changed the default domain policy Instead of the default domain controllers policy. ::) Works now.

    Hello

    The question you posted would be better suited in the TechNet Forums. I would recommend posting your query in the TechNet Forums. You can follow the link to your question:

    Windows Server 2008 IT Pro Networking Forum: http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/threads

    Kind regards.

  • Give permission to the domain users to replace the file in the folder created by domain admin

    We have a domain controller in our network. also we have the domain users and domain administrator. We create a batch file that copies a file to the folder by using a script to the server policy when users open a session input/output. However if the admin area access system cant use overwrite file in the folder. We want to give permission to the domain users to replace the file in the folder created by the domain administrator.

    Hello

    The question you posted would be better suited in the TechNet Forums. I would recommend posting your query in the TechNet Forums.

    http://social.technet.Microsoft.com/forums/en/category/w7itpro, w8itpro, windowsvistaitpro, windowsxpitpro, windowsintune

    Hope the information is useful.

  • Migrated domain users are needed to access shared folders on the network with AD username old or need to share with the new AD ID

    Dear Sir

    Migrated domain users are needed to access shared folders on the network with AD username old or need to share with the new AD ID

    I am in a field & I'll migrate with a domain name.
    EX: now I'm in the field of the AAA tomorrow my domain name will change to BBB. User accounts are created in two AAA & BBB and the two domain user IDs are different.
    data servers are also migrating with the new domain.
    is it possible to access share with the old user id folder in new field or both to share the files again with the new user ID Active directory.
    Kind regards
    Chauvet J.

    Hello

    The question you have posted is related to professional level support. Please visit the below mentioned link to find a community that will support what ask you:

    http://social.technet.Microsoft.com/forums/en/category/WindowsServer/

Maybe you are looking for

  • Satellite m40x-249 "product Recovery DVD" in the other language

    Hello so, here's my problem I bought my laptop in Germany over 2 years ago that I live in Polandwith her, I have produced recovery DVDs, German edition of coursebut my disk got zero terrible and I can't use it anymore is it possible to get a new one,

  • I have Ideas different to iCloud on my iPhone and iMac.Can I have the same on both?

    I have a different apple for iCloud ID on my iPhone and my iMac. I used my iPhone to increase my storage on iCloud, but I find that this extra storage space is not available on my iMac. I tried to change my ID on my iMac, but am unable to do it to li

  • Thermotron TCP/IP interface

    Anyone converted Thermotron drivers for control of the House of VI which will run in LabView worm 9 or 10? Specificaly I have an attempt to interface with a controller Thermotron 3800 via TCP/IP.

  • I'm unable to play videos in Windows Movie Maker in Windows Media Player, I did.

    I have Windows Vista Home Premium. I transferred my video clips on my hard drive. I begin to edit with Windows Movie Maker prog. I met difficulties to play my movie in media player.i edited my sony handy cam video clips using windows movie maker prog

  • Upgrade of Windows software

    I have a HP Pavillion G6-2006ax with Windows 7 64 bit. As you may know, Windows 8 will be released soon and I want to upgrade to Windows 7. My question is, how can I keep the software pre-installed on my PC (for example you cam, PowerDVD etc) when I