UI vs PowerCLI permissions (Cluster vs folder level permissions requirements)

[victim95]

Why does a user require Cluster level permissions to run a get-vm command?  The user currently has folder level permissions which allow them to do the needed tasks through the UI.  When the user runs the get-vm command it returns empty until you add cluster level permissions.

Thanks.

Tim

[LucD]

Does the user have System.Read on the root folder (Datacenters folder)?

It seems that this is required by PowerCLI vs the Web Client.

[victim95]

Under what tab is the System.Read entry?  Sorry, been going through the line items but can't find it.

Thanks,

[LucD]

You can assign that directly, you have to go via a Role.

Something like this for example.

It creates a new Role, named TestRole, and assign this permission to the user on the rootfolder.

You have to update 'domain\user'

$priv = Get-VIPrivilege -Id System.Read

$role = New-VIRole -Name TestRole -Privilege $priv

New-VIPermission -Entity (Get-Folder -Name Datacenters) -Role $role -Principal 'domain\user'