Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

Skip to main content

My Subscriptions

Loading

Knowledge Base

Administrator access is downgraded to read-only in vCenter after read-only users are added (1005680)

Last Updated: 7/2/2014Categories: TroubleshootingTotal Views: 32422Language:
Chinese (Simplified)JapaneseEnglish

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

After adding read-only users to vCenter Server:

Members of vCenter Server Administrators are restricted to read-only permissions.

You cannot perform administrative tasks.

When attempting to log in to vCenter Server using the thick client, you see the error:

You do not have permission to login to the server

Resolution

If a user is a member of more than one Active Directory group and one of these groups are configured with a read-only role on an object (for example, an ESX host), the read-only permission is applied to that object despite the presence of an administrators permission that has been propagated from a higher level.

If the read only permission is applied at the highest level, administrators may not have the access rights to remove this permission.

Note: This Resolution deals with SQL database operations so it is recommended for users familiar with database concepts and have adequate backups before proceeding. If you are unsure about performing these steps, file a support request with VMware Support and note this KB Article ID in the problem description. For more information on filing a support request, see How to Submit a Support Request.

To restore your vCenter Server database or modify the VPX_Access table in the database to remove the read only permission:

Click Start > Run on the vCenter Server.

Type services.msc and click OK.

Right-click the VMware VirtualCenter Server service and select Stop.

Open SQL Server Management Studio.

In the Server name field, enter the name of the SQL server where the vCenter Server database is hosted.

Authenticate with a account that has database owner (dbo) permissions to the the vCenter Server database.

Click Databases.

Click the vCenter Server database.

Note: Refer to your ODBC System DSN configuration if you do not know what database you are using.

Click Tables.

Right-click the dbo.VPX_Access table and select Open table.

Note: In SQL 2008 Open table has been replaced with Edit Top 200 Rows
Note: dbo.VPX_Access may have been renamed if you are using a custom schema.

Change the permissions for all instances of Users from -2 (read-only) to -1 (Administrator). This gives members of Users the rights of an Administrator in vCenter Server.

From the Service Control Manager, restart the VirtualCenter Server service.

Log in to vCenter Server with VMware vSphere Client and remove permissions involving Users.

Note: To assign read-only permissions, create a new security group and add the relevant users to it. This new group can then be used to assign permissions in vCenter Server.

Note: In the vpx_access table, the FLAG column value defines propagation as follows:

0 - when you have assigned a role to a USER on an entity, without choosing Propagate to Child Objects
1 - when you have assigned a role to a USER on an entity, choosing Propagate to Child Objects

2 - when you have assigned a role to a GROUP on an entity, without choosing Propagate to Child Objects

3 - when you have assigned a role to a GROUP on an entity, choosing Propagate to Child Objects

For Oracle, you can perform the following steps:

Log in to oracle database using SQL plus with the vCenter database user:

Note: As best practice its recommended to have the vCenter service shutdown before making changes and ensure there is an up to date and full backup of the vCenter Server database.

Run following command in SQL Plus

select * from vpx_access

Check to see what number the Role_ID is ( -1 is administrator role, -2 is read-only).

To modify the privilege, run following command:

update vpx_access (ID, PRINCIPAL, ROLE_ID, ENTITY_ID, FLAG) values ('32', 'Administrator', '-1', '1', '1') where Principal = Administrator;

To add a user run this command.

insert into vpx_access (ID, PRINCIPAL, ROLE_ID, ENTITY_ID, FLAG) values ('100', 'ACME\JSMITH', '-1', '1', '1');

To commit the changes run the following command.

commit;

Restart VirtualCenter server service

Log in to vCenter Server again.

Related Information

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box
Diagnosing the vSphere/Virtual Infrastructure Client when it fails to connect to vCenter Server/VirtualCenter
読み取り専用ユーザーが追加されると管理者アクセス権限が vCenter で読み取り専用にダウングレードされる
添加只读用户后，vCenter 中的管理员访问权限降级为只读

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

Take Our Survey

Was this article helpful?

YES

NO

Copyright © 2005-2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.

Terms of Use

Your California Privacy Rights

Privacy

Accessibility

Cookie Settings

Support Assistant