In some cases, the above steps used to configure the VMware Enterprise Systems Connector may not be sufficient to establish the proper permissions required to log in to the server. To ensure adequate permissions are set, the following steps need to be taken on the VMware Enterprise Systems Connector.
Step 1: Create Service Account with Full Permissions
A service account will be required to run the VMware Enterprise Systems Connector service. Current service account permissions are as follows but are subject to change if the permission levels can be successfully lowered.
- Member of the following groups in AD
- Domain Users
- Enterprise Admins
Remote Desktop Users
For example, the screen to the right displays the permissions for the Service Account 'caadmin'. This can be the same Service Account mentioned in Other System Requirements.
- On the CA Server
Member of Local Administrator Group
For example, the screen to the right displays Local Administrator Group permissions on the CA Server.
- Full permissions on the Certification Authority
For example, the screen below displays the full compliment of available permissions for 'caadmin'.
Step 2: Use Alternate VMware Enterprise Systems Connector Configuration
- On the VMware Enterprise Systems Connector server, run services.msc
- Locate and stop the VMware Enterprise Systems Connector service.
- Right-click the VMware Enterprise Systems Connector service.
- Select Properties.
- Select the Log On tab.
Under Log on as:, choose This account and Browse for the Service Account you created in Step 1.
Enter and confirm the password.
Launch the Microsoft Management Console (mmc.exe) and open the personal certificate store of the local computer.
Ensure you are logged in with an account that has admin permissions for both the VMware Enterprise Systems Connector server and the domain, otherwise you may not be able to access MMC and also add a domain user to manager the private key.
- Select the Restricted Enrollment Agent created and installed earlier in Step 4 of this guide.
- In MMC, right-click the Restricted Enrollment Certificate you added and select All Tasks and then Manage Private Keys.
Add the Service Account created in Step 1 and set read permissions.
- Click OK to save settings and close the Properties page.
- Repeat steps 10-12 for both the VMware Enterprise Systems Connector and the Secure Channel Certificates.
- Both these certificates will be issued by the Device Services Child Certificate.
- Issued to AW Cloud Connector - VMware Enterprise Systems Connector and AW Cloud Connector - [OG Name].