Administration

To create administrators, you select users and groups from your Active Directory users and groups and
assign administrator roles. Administrators obtain privileges through their role assignments. You cannot
assign privileges directly to administrators. An administrator that has multiple role assignments acquires
the sum of all the privileges contained in those roles.
Using Access Groups to Delegate Administration of Pools and Farms
By default, automated desktop pools, manual desktop pools, and farms are created in the root access group,
which appears as / or Root(/) in View Administrator. RDS desktop pools and application pools inherit their
farm's access group. You can create access groups under the root access group to delegate the
administration of specific pools or farms to different administrators.
NOTE You cannot change the access group of an RDS desktop pool or an application pool directly. You
must change the access group of the farm that the RDS desktop pool or the application pool belongs to.
A virtual or physical machine inherits the access group from its desktop pool. An attached persistent disk
inherits the access group from its machine. You can have a maximum of 100 access groups, including the
root access group.
You configure administrator access to the resources in an access group by assigning a role to an
administrator on that access group. Administrators can access the resources that reside only in access
groups for which they have assigned roles. The role that an administrator has on an access group
determines the level of access that the administrator has to the resources in that access group.
Because roles are inherited from the root access group, an administrator that has a role on the root access
group has that role on all access groups. Administrators who have the Administrators role on the root access
group are super administrators because they have full access to all of the objects in the system.
A role must contain at least one object-specific privilege to apply to an access group. Roles that contain only
global privileges cannot be applied to access groups.
You can use View Administrator to create access groups and to move existing desktop pools to access
groups. When you create an automated desktop pool, a manual pool, or a farm, you can accept the default
root access group or select a different access group.
NOTE If you intend to provide access to your desktops and applications through Workspace Portal, verify
that you create the desktop and application pools as a user who has the Administrators role on the root
access group in View Administrator. If you give the user the Administrators role on an access group other
than the root access group, Workspace Portal will not recognize the SAML authenticator you configure in
View, and you cannot configure the pool in Workspace Portal.
n
Different Administrators for Different Access Groups on page 64
You can create a different administrator to manage each access group in your configuration.
n
Different Administrators for the Same Access Group on page 65
You can create different administrators to manage the same access group.
Different Administrators for Different Access Groups
You can create a different administrator to manage each access group in your configuration.
For example, if your corporate desktop pools are in one access group and your desktop pools for software
developers are in another access group, you can create different administrators to manage the resources in
each access group.
Table 4-1 shows an example of this type of configuration.
View Administration
64 VMware, Inc.