VirtualCenter permissions needed for export with VMware Converter

[StephanS]

I would like to give Virtual Machine Users the possibility to export their VMs from the ESX3 hosts to their local Workstation installations using the permissions schema of the VirtualCenter server. I tried assigning the default "Virtual Machine Power User" rights within VC, but the export failed with "unable to determine guest OS". The export works if I log in with my VC administrator account.

Does anyone know, which permissions have to be set in VC for VMware Converter to access a VM and export it?

[admin]

Is these privileges enabled for your user?

VirtualMachine/Provisioning/AllowVirtualMachineDownload

VIrtualMachine/Configuration/DiskLease

[StephanS]

Thanks for your input. I added the options "VirtualMachine/Provisioning/AllowVirtualMachineDownload" and "VIrtualMachine/Configuration/DiskLease" to the default Virtual Machine User. The permissions were set at the virtual machine level. This still didn't work and ended with an "unkown error".

I then figured out that you need to give the user read permissions on the datacenter level. This is something I would rather not give to virtual machine users, but it seems to be the only solution.

Perhaps this will be dealt with in a feature version...

[admin]

Yes, you need to provide read permissions on the objects you intend your user to see. If not at the datacenter level, create a VM group for your users and assign the read permissions on that object.

[StephanS]

I just tried giving read permissions only at a VM group level (ie a folder in the Virtual Machine & Template view) but I'm still getting an unknown error message. The VMware Converter logfile in c:\windows\temp\vmware-temp shows:

============BEGIN FAILED METHOD CALL DUMP============

Invoking \[GetName] on \[vim.Network:network-18]

Fault Msg: "Permission to perform this operation was denied."

============END FAILED METHOD CALL DUMP============

So I'm guessing that the Converter can't read the network information if it doesn't get read access to the ESX host configuration.