2.8 Ensure vSphere Authentication Proxy is used when adding hosts to Active Directory


vSphere Authentication Proxy enables ESXi hosts to join a domain without using Active Directory credentials. vSphere Authentication Proxy enhances security for PXE-booted hosts and hosts that are provisioned using Auto Deploy and Host profiles, by removing the need to store Active Directory credentials in the host configuration.

The vSphere Authentication Proxy service binds to an IPv4 address for communication with vCenter Server, and does not support IPv6. The vCenter Server can be on a host machine in an IPv4-only, IPv4/IPv6 mixed-mode, or IPv6-only network environment, but the machine that connects to the vCenter Server through the vSphere Client must have an IPv4 address for the vSphere Authentication Proxy service to work.


If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


To properly set the vSphere Authentication Proxy from Web Client directly:

Select the host

Click on Configure then expand System, select Authentication Services.

Click on Join Domain

Select Using Proxy Server radio button.

Provide proxy server IP address.

To properly set the vSphere Authentication Proxy via Host Profiles:

In the vSphere Web Client go to Home in the menu.

Click on Policies and Profiles followed by Host Profiles.

Choose the appropriate host profile

Select Configure followed by Edit Host Profile... then expand Security and Services followed by Security Settings, then Authentication configuration.

Select Active Directory configuration.

Set the JoinDomain Method is configured to Use vSphere Authentication Proxy to add the host to the domain.

Click on Save.

See Also