Problem: AD accounts now have read only permission after logging into vSphere (using AD accounts).
Cause: Attempted to create a non-AD account, that could log into vSphere with only read permissions.
- Created a user account on the server where vSphere was installed.
- Logged into vSphere with my AD account, went to the permissions tab (datacenter level).
- Right clicked and added a new user, selected the locally created account and assigned read only permissions.
- Logged into vSphere with the local account, verified read only permissions.
- Logged back into vSphere with my AD account..... now it to has read only permissions!? Even though I never applied read only to my account.
- Looking at the permission tab, it appears the read-only permission is being applied to ALL accounts (not sure how I messed that up).
Good News:
- If I bypass vSphere and log into each hypervisor directly with the root account. I have admin privileges.
VMware Environment:
- Hypervisors are ESXi 4.1 (no ESX hypervisors)
- vSphere 4.1 Update 1 is installed on a Windows 2k8 server
- vSphere 4.1 Update 1 is using a MS SQL 2008 standard DB (which I have full access to)
We've never configured any permissions before for vSphere logins. Once vSphere was installed way back when, we've always just accessed it with our AD accounts (never set any permissions/groups). I don't suppose there is a way to remove this vSphere read only permission that's applying to everything?
Accepted Solutions
This is a strange one. You seem to have done everything correctly. It may be a strange bug. Could you attach a screenshot if you don't mind.
Don't panic about the problem. It is an easy fix.
You will need to make changes to your database. I wouldn't touch a database without a backup, so you have been warned.
Just to be safe shutdown vCenter while you are modifying the DB.
There should be a table called "VPX_ACCESS". You need to change the ROLE_ID of your administrator account from -2 to -1. And I believe ENTITY_ID should be 1.
Easy.
This is a strange one. You seem to have done everything correctly. It may be a strange bug. Could you attach a screenshot if you don't mind.
Don't panic about the problem. It is an easy fix.
You will need to make changes to your database. I wouldn't touch a database without a backup, so you have been warned.
Just to be safe shutdown vCenter while you are modifying the DB.
There should be a table called "VPX_ACCESS". You need to change the ROLE_ID of your administrator account from -2 to -1. And I believe ENTITY_ID should be 1.
Easy.
