Minimum root Permissions for VM Automatic Start up

A question that comes up on VMware’s forums occasionally is about the ESXi root account and the possibility of deleting the account. The account should not be deleted, but it is possible to remove the account from the Administrator role that it is granted at the host level. That prevents the root account from being used to make a connection with the vSphere client or other vSphere API methods. With the administrator role revoked, the root account can still login at the DCUI.

If the Administrator role is removed from the root account, this prevents virtual machines from starting that have been configured to start with automatically in Configuration > Virtual Machine Startup/Shutdown. To enable automatic start, create a new role with the following two permissions:

 Host > Configuration > Virtual machine autostart configuration
 Virtual Machine > Interaction > Power On

The root account should be assigned this new role at the host level.

When I was trying to determine the required permissions for this, I started with a role that just had the Power On permission. I used vim-cmd in Tech Support Mode to test the role as shown in the following output. With just the Power On permission the command failed with the error shown.

~ # vim-cmd hostsvc/autostartmanager/autostart
 (vim.fault.NoPermission) {
 dynamicType = ,
 faultCause = (vmodl.MethodFault) null,
 object = 'vim.host.AutoStartManager:ha-autostart-mgr',
 privilegeId = "Host.Config.AutoStart",
 msg = "Permission to perform this operation was denied.",
 }
 ~ # Host.Config.AutoStart

To determine which permission corresponded with the privilegeId of Host.Config.AutoStart I ran the following PowerCLI cmd-let on the Administrator role (which I assume is granted all privileges on a stand alone host. The output of that command is shown below.

Get-VIPrivilege -Role “Admin”