VMware ESXi and vSphere Cluster Management
Install vCenter Inventory Service with a Custom vCenter Server Installation
Learn how to install legacy vCenter Inventory Service separately on Windows Server, connect it to SSO Lookup Service, verify certificates, and validate the deployment.
Overview
vCenter Inventory Service is a legacy vCenter component used by applicable Windows-based vSphere releases. It processes inventory-object retrieval and property-query requests used by the vSphere Web Client.
Conceptually, the service sits between the Web Client management experience and vCenter inventory data. The Web Client requests inventory information, and Inventory Service helps retrieve and expose the required objects and properties.
Deployment Models and Scope
Older Windows-based vCenter installations commonly offered two installation approaches:
| Method | Component placement | Best fit | Inventory Service installation approach |
|---|---|---|---|
| Simple Install | Installs several vCenter components together on one Windows system. | Small or straightforward deployments where component separation is not required. | Inventory Service is installed as part of the combined workflow rather than as a separately planned server component. |
| Custom Install | Allows individual components to be installed on the same host or on separate Windows servers. | Distributed, staged, or topology-specific deployments. | Launch the custom installer and select Inventory Service as an individual component. |
| vCenter Server Appliance | Provides vCenter services within the appliance deployment model. | Appliance-based vCenter deployments. | Do not use this separate Windows Inventory Service installer procedure. |
This lesson covers the Custom Install workflow. It assumes that vCenter Single Sign-On has already been installed and configured.
Architecture and Installation Order
vCenter Single Sign-On (SSO) is the authentication component required before Inventory Service can be installed in this architecture. The SSO administrator is an administrative identity in the internal vSphere SSO domain, commonly represented by an account such as administrator@vsphere.local. Use the actual SSO domain configured in the environment.
Inventory Service registers with SSO through the Lookup Service. The Lookup Service is a service-discovery endpoint that allows vCenter components to locate and register with platform services.
- Plan the Windows hosts, DNS names, certificates, ports, and deployment topology.
- Install and configure vCenter Single Sign-On.
- Confirm that SSO and its Lookup Service are reachable and functioning.
- Install Inventory Service and register it with the SSO Lookup Service.
- Install the remaining vCenter components required by the selected topology, such as vCenter Server and the vSphere Web Client.
- Validate service registration, connectivity, and inventory behavior through the Web Client.
Pre-Installation Planning
Check the matching VMware release documentation before beginning. Supported Windows Server versions, vCenter compatibility, CPU and memory requirements, disk requirements, service accounts, and port assignments vary by release.
| Requirement | Why it matters | How to verify | Status |
|---|---|---|---|
| Supported Windows Server and vCenter release | Prevents unsupported combinations and installer failures. | Compare the exact product versions with the matching compatibility and installation documentation. | Record result |
| Hardware and disk capacity | Inventory data, logs, and installation files require adequate resources. | Check CPU, memory, free disk space, and the selected installation volume. | Record result |
| Administrative permissions | The installer must create files, services, registry entries, and network configuration. | Use an authorized Windows administrative account and least privilege where supported. | Record result |
| Deployment location | The component may share a host with other vCenter services or run on a dedicated server. | Document the chosen topology and host ownership. | Record result |
| Forward and reverse DNS | Host names are used for communication, registration, and certificates. | Resolve participating vCenter and SSO host names in both directions. | Record result |
| FQDN | The fully qualified domain name identifies the host in DNS and service or certificate configuration. | Confirm the Windows host displays the intended FQDN and that DNS returns the expected address. | Record result |
| Network reachability | Inventory Service must reach the SSO Lookup Service and other required components. | Test name resolution and connectivity from the Inventory Service server. | Record result |
| Ports and firewalls | Blocked ports prevent registration and service communication. | Compare the release-specific port matrix with firewall rules. | Record result |
| SSO credentials | Registration requires an SSO administrator identity. | Confirm the account and password privately; never place credentials in screenshots or shared notes. | Record result |
| Certificate identity | The installer may ask you to trust the Lookup Service certificate. | Obtain the expected certificate identity or fingerprint from a trusted administrative source. | Record result |
DNS and Connectivity Checks
From the Windows server that will host Inventory Service, verify that the SSO host resolves to the expected management-network address:
nslookup <sso-host-fqdn>
ping <sso-host-fqdn>Ping is only a basic reachability indication; firewalls may block ICMP even when the required application port is available. Confirm the actual release-specific TCP ports separately.
Start the Custom Installer
- Log in to the Windows server intended to host Inventory Service.
- Mount or insert the matching vCenter Server installation media.
- Start the media launcher, commonly by running
autorun.exe. - Select the Custom Install path, not the all-in-one or Simple Install path.
- Choose vCenter Inventory Service from the list of installable components.
- Select the installer language, continue past the welcome page, and accept the license terms.
Configure Inventory Service
| Installer field | Expected value | Example | Notes |
|---|---|---|---|
| Installation directory | A local directory with adequate free space and suitable permissions. | C:\Program Files\VMware\Infrastructure\Inventory Service | Use the release default unless the topology or storage plan requires another location. Document nondefault paths. |
| Host identity | The correct fully qualified domain name of the Inventory Service server. | inventory01.lab.example | Correct Windows or DNS configuration before proceeding if the detected name is wrong. |
| Port assignments | Ports required by the selected vSphere release and environment. | Release-specific values | Check for collisions and permit the required traffic through host and network firewalls. |
| Deployment or sizing option | The option that matches the planned environment scale and topology. | Small, medium, or other release-specific choice | Use the choice appropriate for the expected inventory size and deployment design. |
| SSO administrator | An administrator in the internal SSO domain. | administrator@vsphere.local | Use the actual domain. Protect the password and do not record it in documentation. |
| Lookup Service URL | An HTTPS URL for the SSO Lookup Service. | https://sso01.lab.example:7444/lookupservice/sdk | Port 7444 and this path are associated with the applicable legacy workflow. Confirm the exact endpoint for the product release. |
Review the automatically detected FQDN carefully. A wrong hostname can cause registration, certificate, and later service communication problems. If the server has multiple network interfaces, ensure that the selected name resolves through the intended management network.
Document every nondefault directory, hostname, port, sizing selection, endpoint, and certificate decision. This record is useful for firewall changes, upgrades, migrations, and incident response.
Register with the SSO Lookup Service
- Enter the SSO administrator account and password when prompted.
- Enter the Lookup Service endpoint using the HTTPS format required by the release.
- For a compatible legacy deployment, an endpoint may resemble:
https://<sso-host-fqdn-or-ip>:7444/lookupservice/sdkThe Lookup Service allows Inventory Service to discover and register with SSO services. Do not assume that the example port or path applies to every vSphere version; verify the target release and actual SSO configuration.
Verify the Certificate Fingerprint
The installer may display the SSL certificate fingerprint presented by the remote Lookup Service. A fingerprint is a certificate-derived identifier used to verify that the remote service is the expected service.
- Pause at the certificate confirmation screen.
- Compare the displayed fingerprint with the expected fingerprint obtained from the known SSO server certificate or a trusted administrative record.
- Confirm that the hostname, certificate identity, and endpoint refer to the intended SSO server.
- Accept the certificate only when the identity matches.
Complete the Installation
- Review the installation summary, including the directory, FQDN, ports, sizing choice, SSO account, and Lookup Service URL.
- Start the installation.
- Wait for the installer to report successful completion.
- Record the completion result and any warnings.
If the installer reports failure, preserve the error details and review the installation logs before retrying. Repeated retries without correcting DNS, ports, permissions, credentials, or certificate trust can make diagnosis harder.
Post-Installation Validation
| Validation item | Expected result | Failure indicator | Next action |
|---|---|---|---|
| Windows service | The relevant Inventory Service Windows service is installed and running. | The service is missing, stopped, or repeatedly stops. | Check service properties, account permissions, disk space, port collisions, and service logs. |
| SSO registration | Inventory Service communicates with SSO and remains registered. | Registration, authentication, or Lookup Service errors appear. | Recheck credentials, endpoint, DNS, firewall rules, certificate trust, and SSO health. |
| Logs | Logs contain normal startup and registration messages without certificate or connectivity errors. | Repeated connection failures, trust errors, or startup exceptions. | Correlate timestamps with installer and SSO logs, then correct the underlying configuration. |
| Remaining components | Other vCenter services required by the selected topology are installed and registered. | Web Client or vCenter Server cannot locate the service. | Continue the planned installation sequence and validate every component registration. |
| Web Client inventory | After the broader vCenter environment is configured, expected inventory objects and properties appear. | Missing or incomplete inventory information. | Check Inventory Service, vCenter Server, Web Client, SSO connectivity, and the deployment order. |
Use the Windows Services console to confirm the service state. Also inspect the applicable Inventory Service, SSO, vCenter Server, and Web Client logs. Exact service names and log locations depend on the vSphere release.
Connectivity and Endpoint Reference
| Source component | Destination component | Protocol | Port | Purpose |
|---|---|---|---|---|
| Inventory Service server | SSO Lookup Service | HTTPS | Release-specific; commonly 7444 in the applicable legacy workflow | Discover and register with SSO platform services. |
| vSphere Web Client | Inventory Service and related vCenter services | Release-specific secure service protocols | Release-specific | Submit inventory and property-query requests. |
| Inventory Service | Other vCenter platform components | Release-specific | Release-specific | Complete service registration and inventory communication. |
This table is an architectural guide, not a substitute for the port matrix for the exact vSphere release. Confirm every port before configuring firewalls.
Troubleshooting
Lookup Service Connection Fails
- Check the SSO hostname, protocol, port, and path in the URL.
- Run
nslookupfrom the Inventory Service server and verify the returned address. - Test network reachability and the required TCP port from the Inventory Service host.
- Verify that SSO and the Lookup Service are running and healthy.
- Review version-appropriate firewall rules.
Certificate Fingerprint Is Unexpected
- Do not accept the certificate.
- Compare the displayed fingerprint with the known SSO certificate.
- Check whether the SSO certificate was replaced or regenerated.
- Verify DNS, the endpoint, and any proxy or TLS inspection device.
Detected FQDN Is Incorrect
- Correct the Windows hostname and DNS suffix configuration.
- Fix forward and reverse DNS records.
- Review multiple network interfaces and ensure the intended management address is used.
- Proceed only when the selected FQDN is resolvable and suitable for certificates and intercomponent communication.
Service Does Not Start or Register
- Review installation and service logs.
- Confirm the Windows service account and local permissions.
- Recheck SSO credentials, Lookup Service reachability, ports, disk space, and certificate trust.
- Look for port collisions with another application.
Web Client Shows Incomplete Inventory
- Confirm that the broader vCenter deployment is complete.
- Check Inventory Service, vCenter Server, Web Client, and SSO service states.
- Review registration and connectivity logs.
- Determine whether the problem is in Inventory Service or in another vCenter component.
Security and Operational Guidance
- Use least-privilege administrative access during installation where the product version supports it.
- Protect SSO administrator credentials. Do not expose them in screenshots, scripts, command histories, or shared documentation.
- Use trusted certificates and verify certificate fingerprints before accepting remote service identities.
- Keep DNS names, certificate names, and service endpoints consistent when servers are renamed, migrated, or readdressed.
- Retain a configuration record containing nonsecret values such as host FQDNs, ports, installation directories, topology, and release-specific endpoints.
Exam-Relevant Notes
- Custom Install separates individual vCenter components; Simple Install places multiple components together on one Windows system.
- SSO must be installed, configured, reachable, and functioning before Inventory Service registration.
- The Lookup Service provides service discovery and registration with SSO services.
- An FQDN is important for DNS resolution, intercomponent communication, and certificate identity.
- Always validate an SSL certificate fingerprint before accepting the remote Lookup Service certificate.
- The vCenter Server Appliance does not use this separate Windows Inventory Service installer workflow.
Summary
To deploy legacy Windows-based vCenter Inventory Service separately, choose Custom Install, install it only after SSO is operational, configure the correct host identity and ports, register it with the SSO Lookup Service, verify the presented certificate fingerprint, and confirm the Windows service and registration status. Complete the remaining vCenter components before judging inventory behavior through the vSphere Web Client.