Rookie ESXi and networking/server admin here.

I have an ESXi host (6.5) which contains several VM's, including a Win'19 AD. I want the ESXi host to join this AD.

I can access the AD by exposing the VM to the external/WAN network. Is there any other way for the host to AD join without exposing the AD VM (or any intermediate VM's) to the same network that the ESXi host resides on?


To clarify (Thanks, @Trix): I'm asking about network segregation and connectivity required between the DCs and ESX, rather than the 'join' procedure.


You need these ports for connectivity to AD - bidirectional, UDP and TCP. They don't need to be on the same network:

Port 88 – Kerberos authentication
Port 123 – NTP
Port 135 – RPC
Port 137 – NetBIOS Name Service
Port 139 – NetBIOS Session Service (SMB)
Port 389/636 – LDAP/LDAPS
Port 445 – SMB
Port 464 – Kerberos – change/password changes
Port 3268/3269 - Global Catalog search/secure GC

Obviously DNS so you can resolve the domain controllers.

Firewalls can be configured for stateful inspection of this traffic, but avoid terminating any encrypted traffic between DCs and clients (well, you can, but it's very painful).

And to join the domain, the account you're using must have the right to join computers to the domain.


You can add an ESXi host to the Active Directory using vSphere client:

  • Confirm the ESXi host is synchronizing time with the Active Directory Domain controller.

  • From the vSphere Client, select the host that you want to add to the Active Directory.

  • Click the Configuration tab.

  • Click the Authentication Services.

  • Click the Properties link at the top right pane.

  • In the Directory Services Configuration dialog, select the directory service from the drop-down.

  • Enter a domain and click Join Domain.

  • Enter the user name (in user@domain.com format) and password of a directory service user account that has permissions to join the host to the domain and click OK.

  • Click OK to close the Directory Services Configuration dialog box.

  • Click the Configuration tab and click Advanced Settings.

  • Navigate to Config > HostAgent.

  • Change the Config.HostAgent.plugins.hostsvc.esxAdminsGroup setting to match the Administrator group that you want to use in the Active Directory. These settings takes affect within a minute and no reboot is required.

From a security perspective I do not recommend this practice. An AD is way more vulnerable generally speaking than an ESXi host.

The host does not have to be on the same network segment as the AD and guests. It can still be added just the same, you just have to have proper IP routing between the 2 used classes.

  • 1
    I believe the OP was asking about network segregation and connectivity required between the DCs and ESX, rather than the 'join' procedure per se
    – LeeM
    Jul 13 '20 at 12:02
  • You can use completely different IP classes if you want LAN segment protection/separation.
    – Overmind
    Jul 13 '20 at 12:10
  • @Trix - yes, exactly! Jul 16 '20 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.