Knowledge Base

To add permissions to the ESX host from the command line:

1. Connect to the ESX host via direct console access, a remote KVM, or with a SSH client. For more information, see Connecting to an ESX host using a SSH client (1019852).
2. Run this command on the ESX host console:
   
   vmware-vim-cmd vimsvc/auth/entity_permission_add managed_entity user isGroup roleName propagate
   
   managed_entity: Entity (Managed Object) on which the permission to be granted
   user: User name (user should be present on the host)
   isGroup: true if the value for 'user' parameter is a group object else false
   roleName: Role name for which the permission is granted (Preferably one of NoAccess, ReadOnly, Admin)
   propagate: true if the permissions need to be propagated else false
   
   Possible options for managed_entity
   vim.Folder:ha-folder-vm – All virtual machines
   vim.Folder:ha-folder-root – Host/virtual machine
   vim.Folder:ha-folder-host – Host
   
   Additionally, particular virtual machines can be used and the managed_entity parameter is this syntax:
   
   vim.VirtualMachine:XXX Where XXX is the object ID for the virtual machine.
   
   This is an example for adding ReadOnly permission for test user test1234 at the highest level on the ESX host and set to propagate:
   
   vmware-vim-cmd vimsvc/auth/entity_permission_add vim.Folder:ha-folder-root 'test1234' false ReadOnly true
   
   
3. To remove the permissions, run:
   
   vmware-vim-cmd vimsvc/auth/entity_permission_remove managed_entity user isGroup
   
   For example:
   
   vmware-vim-cmd vimsvc/auth/entity_permission_remove vim.Folder:ha-folder-root 'test1234' false