vCenter 5"Administrators" group

[WCUsteve]

I'd like to determine of the "Administrators" group in vCenter 5 is necessary or is it a security risk? Is it linked into the Local Administrators group on the vCenter 5 Windows 2008 R2 server.

Also, who are the members of the "Administrators" group in vCenter 5?

I would like to elliminate anyone from accessing vCenter 5 without express permission and it looks like the "Administrators" group is my only unknown.

[kjb007]

The group is very much tied to the 'Local administrators' group from the windows machine vCenter runs on.  With default permissions, that also includes domain admins.  The authentication flows through windows, and are assigned roles at the vCenter level, and by default the local windows administrator groups is assigned the Administrator role.

-KjB

[WCUsteve]

What would be recommended best practise? If I set "Administrators" group to "no access" then will any user and domain group present in the Local Administrators group be denied access to vCenter?

[kjb007]

Groups and inheritance can get very tricky when you're setting roles.  I would use the no access sparingly.  First, make sure you have entries for who you do want to allow.  Then, remove the administrators permission, but keep this article handy just in case :  http://kb.vmware.com/kb/1005680

I would instead remove the users you don't want from the 'Local administrators' group.

-KjB

[WCUsteve]

Thanks for the info it was very helpful. I think I'll start by changing the permission on "Administrators" group to read-only. The groups that are part of the local admins group are added via Group Policy in AD and I have little controll over it.

[kjb007]

If the ID that you are using to login is a part of the Local Administraotrs group, then setting that permission will give you read-only permission, and then no way to fix it, other than the article I posted earlier.

Removing the administrators group once you've added proper permissions will remove the direct permission without locking yourself out.

-KjB