To create a new role in the vCenter Web Client, you need to go to Administration –> Roles from the main page.
The specific permissions that are required can be found in the Configuring User Accounts for vCenter Access section of the Horizon documentation.Ī new role will need to be created within vCenter in order to assign the appropriate permissions. There are a couple of different ways to configure your Horizon environment, so the actual rights required in vCenter will vary. When installing Horizon in an on-premises environment, I prefer to use a standard Active Directory domain user account without any additional administrator-level rights on the domain or on the vCenter server. The service account can either be an Active Directory user or a local vCenter user. Horizon uses this account for virtual machine management tasks, including provisioning new virtual desktops and RDSH servers and performing power operations. The first account that needs to be created is a service account that Horizon will use for accessing vCenter. So while the easy way out would be to give these accounts vCenter Administrator, Domain Administrator, and SQL Server or Oracle SysAdmin rights, it would not be a good idea as these accounts could potentially be compromised. These accounts should not have more rights than they would need.
It’s important to build the Active Directory service accounts and database access accounts with the principle of least privileged access in mind. This post will cover setting up the event database on Microsoft SQL Server. Horizon supports running the event database on Microsoft SQL Server and Oracle, and you can find the specific supported versions in the VMware Product Interoperability Matrix. This database is optional, but it is highly recommended. Horizon 8 utilizes a single database for storing event and auditing data generated by the platform. The other service account will manage computer accounts within Active Directory, and this account is only required if you are using Instant Clones. One of these accounts is for accessing vCenter to provision and manage the virtual machines that users will connect to. Back in Part 4, I mentioned that Horizon required up to a few service accounts to function properly.
0 kommentar(er)
