[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Elevate VMware Engine privileges\n================================\n\nGoogle Cloud VMware Engine privileges give vCenter users the privileges they need to\nperform normal operations. Some administrative functions require additional\nprivileges in the private cloud vCenter.\n\nGoogle Cloud VMware Engine is now integrated with the Google Cloud console but the\nintegration does not provide the **Elevate privilege** feature. To perform\nthese tasks, you can use a solution user account to:\n\n- Configure identity sources\n- Perform user management\n- Delete a distributed port group\n- Create service accounts\n\nSolution user accounts\n----------------------\n\nSome tools and products used with your private cloud might require a user to\nhave administrative privileges in vSphere. When you create a private cloud,\nVMware Engine also creates user accounts with administrative\nprivileges that you can use for the third-party tools and products. Multiple\nsolution user accounts are created for managing different applications. Using a\nspecific solution user account, you can audit the actions performed by each\napplication. This document provides you with guidance on managing these\nsolution user accounts in vSphere.\n\nHere are some examples of tools and products that require administrative\nprivileges during setup:\n\n- VMware Site Recovery Manager (SRM)\n- VMware Cloud Director\n- Zerto\n\n| **Note:** If you want to disable or re-enable all solution user accounts, contact [Cloud Customer Care](/vmware-engine/docs/support).\n\nBefore you begin\n----------------\n\nBefore signing in to a third-party tool or product with a solution user account,\nconfirm that the tool or product requires administrative privileges. If the tool\nor product requires [privileges](/vmware-engine/docs/concepts-permission-model) that are already\nprovided by `Cloud-Owner-Role`, then [create a new user](/vmware-engine/docs/vmware-platform/howto-permissions-model)\nand add the user to `Cloud-Owner-Group` instead.\n| **Caution:** Solution user accounts have administrator privileges in vSphere. Only use solution user accounts for their intended purpose. VMware Engine reverts [forbidden actions](/vmware-engine/docs/private-clouds/howto-elevate-privilege#forbidden-actions) taken by these accounts automatically because of their potential for adverse impact on your private cloud.\n\nYou can use any of the following built-in solution user IDs:\n\n- `solution-user-01@gve.local`\n- `solution-user-02@gve.local`\n- `solution-user-03@gve.local`\n- `solution-user-04@gve.local`\n- `solution-user-05@gve.local`\n\nGet a solution user password\n----------------------------\n\nTo get a solution user password, take the following steps. \n\n### gcloud\n\n```\ngcloud vmware private-clouds vcenter credentials describe \\\n --private-cloud=PRIVATE_CLOUD_NAME \\\n --project=PROJECT_ID \\\n --username=USERNAME_ID \\\n --location=ZONE\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRIVATE_CLOUD_NAME\u003c/var\u003e: the private cloud for this request\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eUSERNAME_ID\u003c/var\u003e: one of the solution user IDs\n- \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e: the zone of the private cloud\n\n### API\n\nIn the REST API, make a `GET` request to the `showVcenterCredentials` method\nand provide the provide the solution user ID: \n\n```\nhttps://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/ZONE/privateClouds/PRIVATE_CLOUD_NAME:showVcenterCredentials?username=USERNAME_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e: the zone of the private cloud\n- \u003cvar translate=\"no\"\u003ePRIVATE_CLOUD_NAME\u003c/var\u003e: the private cloud for this request\n- \u003cvar translate=\"no\"\u003eUSERNAME_ID\u003c/var\u003e: one of the solution user IDs\n\nReset solution user password\n----------------------------\n\nTo reset a solution user password, take the following steps. \n\n### gcloud\n\n```\ngcloud vmware private-clouds vcenter credentials reset \\\n --private-cloud=PRIVATE_CLOUD_NAME \\\n --project=PROJECT_ID \\\n --username=USERNAME_ID \\\n --location=ZONE\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRIVATE_CLOUD_NAME\u003c/var\u003e: the private cloud for this request\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eUSERNAME_ID\u003c/var\u003e: one of the solution user IDs\n- \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e: the zone of the private cloud\n\n### API\n\nIn the REST API, make a `POST` request to the `resetVcenterCredentials`\nmethod and provide the solution user ID in the request body: \n\n```\nhttps://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/ZONE/privateClouds/PRIVATE_CLOUD_NAME:resetVcenterCredentials\n\n{\n \"username\": :\"USERNAME_ID\"\n}\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e: the zone of the private cloud\n- \u003cvar translate=\"no\"\u003eUSERNAME_ID\u003c/var\u003e: one of the solution user IDs\n\nForbidden actions\n-----------------\n\nWhen VMware Engine detects any of the following forbidden actions,\nVMware Engine reverts the changes to ensure that service remains\nuninterrupted.\n\n### Cluster actions\n\nThe following cluster actions are forbidden:\n\n- Removing a cluster from vCenter\n- Changing vSphere high availability (HA) on a cluster\n- Adding a host to the cluster from vCenter\n- Removing a host from the cluster from vCenter\n- Changing vSphere Distributed Resource Scheduler (DRS) on a cluster\n- Creating new Data Centers in VMware Engine\n\n### Host actions\n\nThe following host actions are forbidden:\n\n- Adding or removing datastores on an ESXi host; you can mount a temporary disaster recovery datastore, but SLAs won't apply\n- Uninstalling vCenter agent from host\n- Modifying the host configuration\n- Making any changes to the host profiles\n- Placing a host in maintenance mode\n\n### Network actions\n\nThe following network actions are forbidden in vCenter Server:\n\n- Deleting the default distributed virtual switch (DVS) in a private cloud\n- Removing a host from the default DVS\n- Importing any DVS setting\n- Reconfiguring any DVS setting\n- Upgrading any DVS\n- Deleting the management portgroup\n- Editing the management portgroup\n\nThe following network actions are forbidden in NSX Manager:\n\n- Adding a new NSX Edge node\n- Changing an existing NSX Edge node\n\n### Roles and permissions actions\n\nThe following roles and permissions actions are forbidden:\n\n- Modifying or deleting permission to any management objects\n- Modifying or removing any default roles\n- Increase the privileges of a role to higher than of Cloud-Owner-Role\n- Adding users and groups to the Administrator group on vCenter\n- Adding any Active Directory users and groups to the Administrator group on vCenter\n\n### Other actions\n\nThe following actions are additionally forbidden:\n\n- Removing any default licenses:\n - vCenter Server\n - ESXi nodes\n - NSX\n - HCX\n- Modifying or deleting the management resource pool.\n- Cloning management VMs.\n- Assigning a management network to a workload VM.\n- Using an IP address in the management internal IP address range for a workload VM.\n- Renaming the data center.\n- Renaming the cluster.\n- Configuring syslog forwarding using the vCenter Server Appliance Management Interface (VAMI).\n- Configuring syslog forwarding on ESXi Hosts directly using the vCenter user interface. Instead, use the VMware Engine portal or the [Google Cloud CLI](/sdk/gcloud/reference/vmware/private-clouds/logging-servers/create) to configure syslog forwarding for vCenter Server or ESXi Hosts.\n- Joining your private cloud vCenter to an Active Directory domain.\n- Resetting vCenter or NSX sign-in credentials using VMware tools, API calls, or management appliances (vCenter/NSX manager). As a reminder, you can [retrieve or reset generated credentials](/vmware-engine/docs/vmware-platform/classic-console/howto-access-vsphere-client#sign-in), including password updates, from the private cloud details page in the VMware Engine portal.\n- Changing statistics collection intervals or statistics levels in the vSphere Client.\n\nWhat's next\n-----------\n\n- Learn how to [set up vCenter identity sources](/vmware-engine/docs/vmware-platform/classic-console/howto-identity-sources)."]]
