2V0-622 · Question #19
An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins is planned for administrative access to the host. Which two
The correct answer is A. If administrative access for ESX Admins is not required, this setting can be altered. C. An ESXi host provisioned with Auto Deploy cannot store AD credentials.. When integrating ESXi with Active Directory, administrators must know that the default admin group name can be changed and that Auto Deploy hosts cannot persist AD credentials across reboots.
Question
An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins is planned for administrative access to the host. Which two conditions should be considered when planning this configuration? (Choose two.)
Options
- AIf administrative access for ESX Admins is not required, this setting can be altered.
- BThe users in ESX Admins are not restricted by Lockdown Mode.
- CAn ESXi host provisioned with Auto Deploy cannot store AD credentials.
- DThe users in ESX Admins are granted administrative privileges in vCenter Server.
How the community answered
(53 responses)- A74% (39)
- B19% (10)
- D8% (4)
Why each option
When integrating ESXi with Active Directory, administrators must know that the default admin group name can be changed and that Auto Deploy hosts cannot persist AD credentials across reboots.
ESXi uses 'ESX Admins' as the default AD group granted full administrative access, but this name is configurable via an advanced host setting, so if that group is not intended to have admin rights the setting must be explicitly changed.
Users in the ESX Admins AD group are subject to Lockdown Mode just like any other account; AD group membership does not exempt users from host lockdown restrictions.
Hosts provisioned through Auto Deploy boot entirely from a network image and have no persistent local storage, meaning AD credentials and trust relationships cannot be stored and must be re-established through an answer file or other mechanism at each boot.
ESX Admins membership grants administrative privileges only on the ESXi host itself, not on vCenter Server; vCenter permissions are managed separately through its own permission model.
Concept tested: ESXi Active Directory integration and Auto Deploy credential limitations
Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-4654C577-C1B7-4A13-B8D3-1C0C0C0C0C0C.html
Topics
Community Discussion
No community discussion yet for this question.