How to Join VMware ESXi to an Active Directory Domain

Applies to: VMware ESXi 9.x / 8.x / 7.x / 6.7 / 6.5 / 6.0 / 5.5 / 5.1

VMware ESXi can use Microsoft Active Directory for direct host authentication. This lets administrators assign ESXi permissions to domain users and groups instead of maintaining separate local accounts on every host.

Security note: Current VMware security guidance no longer recommends joining ESXi hosts directly to Active Directory as the default design. In centrally managed environments, prefer managing authentication and permissions through vCenter unless direct host-level AD authentication is specifically required.

The original version of this article was written for ESXi 5.1. The capability still exists in current ESXi releases, but the interface and security defaults have changed.

In This Article

• 1. Before You Join the Domain
• 2. Join ESXi to Active Directory
• 3. Assign Active Directory Permissions
• 4. Verify Domain Membership
• 5. ESX Admins Security Change
• 6. Legacy ESXi 5.1 Interface
• 7. Key Takeaways

1. Before You Join the Domain

Active Directory authentication depends on working DNS, time synchronization, and network connectivity between the ESXi host and domain controllers.

• Configure the ESXi host to use DNS servers that can resolve the Active Directory domain.
• Verify forward and reverse name resolution for the ESXi host and domain controllers.
• Synchronize ESXi time with a reliable NTP source that is consistent with the Active Directory environment.
• Use an account that has permission to create or join the ESXi computer account in Active Directory.
• Use a least-privilege delegated account where possible instead of a Domain Admin account.

2. Join ESXi to Active Directory

From the vSphere Client:

1. Select the ESXi host.
2. Open Configure > System > Authentication Services.
3. Select Join Domain.
4. Enter the Active Directory DNS domain name, for example example.com.
5. To place the computer account in a specific OU, use a path such as example.com/Servers/VMware.
6. Enter the credentials of an account that has permission to join computers to that location.
7. Complete the join operation and verify that the host reports Active Directory as its directory service.

You can also join the domain from the standalone ESXi Host Client under Manage > Security & Users > Authentication.

3. Assign Active Directory Permissions

Joining the host to the domain does not by itself define who should administer the host. Assign permissions explicitly to the required Active Directory users or groups and use the minimum role required for the task.

For centrally managed hosts, assigning permissions through vCenter is normally preferable because it avoids maintaining separate host-level permission assignments.

4. Verify Domain Membership

In the vSphere Client, open Configure > Authentication Services and confirm that the directory service type is Active Directory and that the expected domain is displayed.

From ESXi Shell or SSH, you can also check the join state with:

/usr/lib/vmware/likewise/bin/domainjoin-cli query

5. ESX Admins Security Change

Older ESXi releases could automatically grant the built-in ESX Admins Active Directory group administrative access after a domain join.

Starting with ESXi 8.0 Update 3, the Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd setting is disabled by default because of security concerns. Do not assume that an ESX Admins group will automatically receive Administrator permissions. Assign required permissions explicitly and follow least-privilege principles.

6. Legacy ESXi 5.1 Interface

In the legacy vSphere Client used with ESXi 5.1, the equivalent workflow was Configuration > Authentication Services > Properties, then selecting Active Directory as the directory service type and joining the domain.

The older interface also accepted the domain and OU in a format such as example.com/vsphere. The underlying purpose is the same: create the ESXi computer account in Active Directory and enable domain-based authentication.

7. Key Takeaways

• Direct ESXi Active Directory authentication is still supported in current ESXi releases.
• Verify DNS and time synchronization before attempting the domain join.
• Use delegated join permissions instead of Domain Admin credentials where possible.
• Do not rely on automatic ESX Admins administrator access in current ESXi releases.
• Prefer vCenter-based identity and permission management unless direct host AD authentication is required.

References

• Broadcom – Configuring Active Directory Authentication and Permissions for ESXi
• Broadcom – ESX Admins Active Directory Group and Secure Defaults