error with adding permissions: The requested change cannot be completed because it could leave the..

[ahmedelrofaie89]

hi everyone I hope you are doing good 🙂 

I have this issue, I created an environment with 5 nested ESXi hosts, and one vcenter deployed on my first nested ESXi host

these are the hostnames of esxi:

1- esxil1

2-esxil2

3-esxil3

4-esxil4

5-esxil5

the ESXi are version 7 update 2, and the vcenter also is 7 update 2, the vcenter server installed at nested esxi  esxil1, 

the issue that I have is with the adding permissions inside the vcenter server inventory objects,

it shows me this error when I am adding a user and give him permission for any vcenter objects:

I don't know the cause of this issue, I think it might be a bug because of the nested environment. I just want to point out that

these nested ESXi hosts are deployed inside ESXI 6.7U3 (the physical host)

[a_p_]

Looks like vCenter Server protects itself against an attempt to change the permissions in a way that would result in a loss of permissions for the administrator.

What exactly are you trying to do? Maybe some screenshots will help.

André

[ahmedelrofaie89]

i am just want to add an active directory user to have administrator permission on the global permission object,

I already added it as shown below (administrator@neo.net)

but it didn't  propagate down to the vcenter==>datacenter==>cluster==>hosts==>vm. objects

when I try to add the user directly to any other objects (vcenter, datacenter, etc).

it refuse and then show me the error I shared in the previous post,