An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins is planned for administrative access to the host. Which two conditions should be considered when planning this configuration? (Choose two.)

Question

Accepted Answer

A. If administrative access for ESX Admins is not required, this setting can be altered. By default, ESXi automatically grants full administrative privileges to any AD group named 'ESX Admins', but this default group name and behavior can be changed by the administrator if that level of automatic privilege assignment is not desired for the environment. C. An ESXi host provisioned with Auto Deploy cannot store AD credentials. ESXi hosts provisioned via Auto Deploy boot statelessly from a network image and have no persistent local storage, so they cannot retain Kerberos tickets or other AD credentials between reboots, which requires additional planning for AD-based authentication in Auto Deploy environments.

Answer

B. The users in ESX Admins are not restricted by Lockdown Mode. Members of the ESX Admins AD group are subject to Lockdown Mode restrictions just like other users - they are not automatically exempted unless they are also added to the Exception Users list on the host.

Answer

D. The users in ESX Admins are granted administrative privileges in vCenter Server. The ESX Admins group grants administrative privileges only on the ESXi host itself, not in vCenter Server, as vCenter Server manages its own separate permissions system independent of ESXi host-level AD group assignments.

An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins is planned for administrative access to the host. Which…

Question

Options

How the community answered

Why each option

Topics

Community Discussion