You can optionally register additional Active Directory domains to assign management roles or provide assignments to users in those domains.

Note: When you have completed the domain registration, do not move any groups from one organizational unit (OU) to another. Doing so will cause login failures for users.

If you click Cancel before you complete the registration, you can click Edit at any time from the Getting Started page to continue with registration.


  • The Active Directory infrastructure must be synchronized to an accurate time source.
  • If you have external or forest trusts, root domains must be registered. For more information, see External and Forest Trusts.
  • The LDAP bind account is treated by the system as a Super Admin user, so this account should not be shared with any user that does not have Super Admin privileges. For example, if there is another product that also needs an LDAP bind account, a new LDAP account should be created for this purpose so whoever has the new account cannot log in as Super Admin.


  1. In the Administration Console, select Settings > Active Directory.
  2. Click Register.
  3. In the Register Active Directory dialog box, provide the requested registration information.
    Option Description
    NETBIOS Name Active Directory domain name
    DNS Domain Name Fully qualified Active Directory domain name
    Protocol Not editable; LDAP is the only choice
    Bind Username Domain administrator
    Bind Password Domain administrator password
  4. Enter information for Auxiliary Account #1.
    Option Description
    Bind Username Domain administrator
    Bind Password Domain administrator password
    Note: Username and password must exist in the Active Directory or the account will not be added successfully.
  5. Click Advanced Properties.
  6. Enter information the Advanced Properties fields.
    Option Description
    Port The default for this field is 389. You should not need to modify this field unless you are using a non-standard port.
    Domain Controller IP (Optional) Specify a single preferred domain controller IP address if you want AD traffic to use a specific domain controller.
    Context This option is auto-populated based on the DNS Domain Name information provided earlier.
  7. Click Domain Bind.
    Note: If you see an error stating that the auxiliary account information you entered is invalid, then after completing the Domain Join process below you will need to add a valid auxiliary account by editing the Domain Bind information. See Edit an Active Directory Domain.
  8. Provide the domain join information.
    Option Description
    Join Username Domain administrator
    Join Password Domain administrator password
    Primary DNS Server IP IP address of primary DNS Server
    Secondary DNS Server IP (Optional) IP of secondary DNS Server
    Default OU Default organizational unit
  9. Click Save.
  10. In the Add Super Administrator dialog box, use the Active Directory search function to select the AD administrator group to administer the application.
  11. Click Save.
  12. If the domain bind or domain join process fail, you must restart the registration process.
    1. Restart the browser.
    2. Log in first using your My VMware account.
    3. Log in to the Active Directory account using the domain service (bind) account login and password.
    4. Continue with the domain join process.

What to do next

If desired, you can set up True SSO (single sign-on). See Configure True SSO for an Active Directory Domain.