ESXi Ad Integration: Something to watch out for

Yeah... Saw that yesterday. Thanks for sharing this Dipen.

Out of all my years of using vSphere, I never understood having the Hosts bound to AD 🤷🏼‍♂️

Same, never saw the need for it especially when they were managed by vCenter. 

Mitigations are easy to apply anyway without downtime which is one saving grace I suppose.

Our VMware team patched this yesterday and never saw it like I usually do before them. 😂

They beat you to it @Chris.Childerhose ;) 

Yes they did.  😜

Hey, thanks for the headsup! I just double-checked and our ESX hosts are not connected to AD. So I’m not affected, right? Our vCenter is connected to AD, but this is specifically only for the ESX hosts, correct?

Thank you!

Yes, that is correct. However, it is worth applying the mitigations if you are on all versions prior to ESXi 8.0 U3.

Yeah, actually you’re absolutely right. I just applied the fix to all our ESX hosts. Thanks and have a nice day everybody!

Welcome, glad we could help :) and welcome to the Community Forums!

Thanks for this information @dips. We also would never join an ESXi to the AD. But this behaviour is difficult to understand how such a thing could be intentional. Also i sending your post to my colleagues, to be aware of that. 

Welcome, glad it was of help.

I have been thinking about why an ESXi host would end up in AD and I think it may be at smaller places where they run just one host or prefer to login to the host via AD authentication. Just a thought

Quick PowerCLI to change the settings on all hosts in a cluster:

Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd' | Set-AdvancedSetting -Value 'false' -Confirm:$false
Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.vimsvc.authValidateInterval' | Set-AdvancedSetting -Value 90 -Confirm:$false
Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.hostsvc.esxAdminsGroup' | Set-AdvancedSetting -Value "" -Confirm:$false

Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd' | Set-AdvancedSetting -Value 'false' -Confirm:$false
Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.vimsvc.authValidateInterval' | Set-AdvancedSetting -Value 90 -Confirm:$false
Get-Cluster 'ClusterName' | Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.plugins.hostsvc.esxAdminsGroup' | Set-AdvancedSetting -Value "" -Confirm:$false

Thanks for sharing that one.  Love using PowerShell for automating things.  😎