To have multiple domains authentication, you have to be able, like in windows, to enter domain\username or username@domain. And this is not possible for the moment.

Thus authentication against a single domain so far in ESX.

Thx,

http://blog.scottlowe.org/2007/07/10/esx-server-ad-integration/

Even with “full” AD integration using both esxcfg-auth and LDAP, I will still echo Andrew’s thoughts–you need to configure sudo to track what the admins are doing once they reach the Service Console.

The ideal setup is to have the administrators who are authorized to use the command line login with their own account, then use sudo to execute the CLI commands that are needed to administer the box. Sudo leaves messages in the log to show who executed what command, when, and from where (remote host and file system locations) to provide information should something destructive occur (purposely or accidentially).

http://get-admin.com/blog/?p=16

There are a very select few who have the keys and those who have the keys sometimes need to log on to the ESX Service Console. There are plenty of *nix admins who will go to their grave saying “rarely ever log on using root!”. That’s what AD integration is for – anyone who would need to log onto the service console, even the most trusted of administrators.

Logging on as root doesn’t identify who actually used the root account. Logging on with AD integration leaves an audit trail.

I guess I did not ask that question very clearly. So, in the distributed administrative model you assign local ESX server management responsibilities to the local or department engineers? I’ve mostly seen the “forest administrators” type approach where a select few have “the keys”.

With –adddomain=pironet.com ESX searches within that domain only.

Cheers,

Thx,

@rbrambley: In my experience, I have logged on at the Service Console of the ESX host for various reasons. Running ESXTOP, changing of the root password, viewing logs, etc.