0

I've been in the process of joining our ESXi hosts to the AD domain and have noticed that the group "ESX_Admin" is automatically being added to Permissions on the ESXi hosts.

I have found the ESX_Admin in the Active Directory Users and Computers but am not seeing a policy to automatically add it to ESXi hosts upon joining.

Can anyone point me in the right direction? Thanks.

0

While its an older post, it has been updated with current release information. Details related to the group and the manner of its use can be found here https://kb.vmware.com/s/article/1025569

Selected information (emphasis mine):

By default, an ESX/ESXi 4.1 and ESXi 5.x/6.x host joined to an AD domain queries the domain for the ESX Admins group and this behavior is not configurable.

The KB does contain some suggestions as to how to cope with this behavior if it is undesireable (my own suggestion follows), though the KB is mainly geared to the syslog entries generated if the group is not present in AD, the information included should prove sufficient to your needs.


If you're looking to change the default group that is queried, that process can be found here: https://www.stigviewer.com/stig/vmware_vsphere_esxi_6.0/2016-06-07/finding/V-63247, some selected highlights:

PowerCLI:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value "<anything but ESX_Admins>"

GUI:

Configuration >> Advanced Settings. Select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and verify it is not set to "ESX Admins".

In any event, this is a "feature" of ESX (vSphere Hypervisor), not Active Directory, and it goes back to at least 4.0. Now, because it is a well known group (at least I believe it to be considered such), I prefer to keep it empty, its membership audited and tripwired, and permission on its members attribute locked down. Instead, I use a custom group to confer administrative access to the hosts.

Frankly, one of the first things I do is to join it to the domain, and altering the default behavior every time I re-image or remediate the host seems a little sisyphean to me and a waste of time. This is why I prefer to accept the default behavior and secure the group in Active Directory. In theory, this only takes a single change (and as pointed out in the KB, does consume the least administrative effort). Though, be warned that this practice may be an no-no for any security-minded auditors (as pointed out in the second article I linked), but in the end I feel its a better process and easily justifiable to any auditors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.