VMware ESXi and vSphere Cluster Management

Install vCenter Inventory Service with Custom Install

Learn how to install the legacy Windows-based VMware vCenter Inventory Service with Custom Install, configure SSO Lookup Service registration, and validate the deployment.

vCenter Inventory Service is a legacy Windows component used by older vSphere deployments. It handles inventory-object and property-query requests made by the legacy vSphere Web Client. This guide covers installing it separately with the vCenter Server Custom Install workflow.

What vCenter Inventory Service Does

Inventory Service manages data about objects such as datacenters, clusters, hosts, virtual machines, networks, and datastores. The legacy vSphere Web Client uses it to browse inventory and retrieve object properties.

Inventory Service is not the same as vCenter Server. vCenter Server provides central management of ESXi hosts and virtual machines, while Inventory Service supplies inventory-related query support for the older Web Client. Adding ESXi hosts to vCenter inventory is performed through vCenter Server, not directly through Inventory Service.

It is also different from vCenter Single Sign-On (SSO). SSO authenticates users and services. The Lookup Service is a service-discovery endpoint used by vSphere components to find and register services. The vSphere Web Client is the browser-based management interface that consumes inventory data. The vCenter Server Appliance is an appliance deployment model rather than a Windows component installation.

Component roles and dependencies

Component: vCenter Single Sign-On
Primary role: Authentication for vSphere users and services
Before Inventory Service: Yes
Relationship: Inventory Service uses SSO credentials and registers through its Lookup Service.

Component: Lookup Service
Primary role: Service discovery and registration
Before Inventory Service: Yes, as part of the SSO installation
Relationship: Inventory Service uses its HTTPS endpoint during setup.

Component: vCenter Inventory Service
Primary role: Inventory and property-query support
Before Inventory Service: Not applicable
Relationship: Supplies inventory query services to the legacy vSphere Web Client.

Component: vSphere Web Client
Primary role: Browser-based vSphere management
Before Inventory Service: Normally installed after or alongside the required services
Relationship: Sends inventory-related requests to Inventory Service.

Component: vCenter Server
Primary role: Central management of vSphere resources
Before Inventory Service: Deployment order depends on the vSphere release and design
Relationship: Works with Inventory Service and the Web Client in the complete legacy stack.

Component: vCenter Server Appliance
Primary role: Integrated vCenter deployment
Before Inventory Service: Not applicable
Relationship: This standalone Windows Inventory Service procedure does not apply.

Simple Install and Custom Install

Simple Install is a legacy installer mode that places several major vCenter components on one Windows system. It reduces the number of installation decisions and is suitable when services do not need to be separated.

Custom Install installs individual components separately and can place them on different Windows hosts. For example, SSO can run on sso01.example.com while Inventory Service runs on inv01.example.com.

A distributed Custom Install can be appropriate when an organization needs service separation, independent capacity planning, different administrative boundaries, or a prescribed component layout. It also adds operational responsibilities: DNS, firewall rules, certificates, compatibility, monitoring, and documented port assignments must all be managed across hosts.

The vCenter Server Appliance includes the applicable services as part of its appliance deployment. Do not install this separate Windows component when deploying the appliance.

For a related overview of the one-host legacy workflow, see Install vCenter Server Simple Install. For broader vSphere learning, see the VMware ESXi online course.

Prerequisites and Planning

Platform and media

Use a supported Windows Server host for the exact vSphere release.
Use the matching vCenter Server installation media. Do not mix installers from different vSphere versions.
Install the required vCenter Single Sign-On services first and confirm that the Lookup Service is reachable.
Provide the SSO administrator credentials in the vsphere.local domain, or the equivalent SSO domain used by that release.
Use a stable fully qualified domain name for the Inventory Service host.
Confirm sufficient local disk space and select an installation directory that follows organizational storage, backup, and recovery practices.

DNS, network, and certificates

Configure forward and reverse DNS for SSO, Inventory Service, vCenter Server, and Web Client hosts.
Ensure that hostnames resolve consistently from every participating component.
Plan firewall and routing rules between Inventory Service, the SSO Lookup Service, vCenter Server, and the vSphere Web Client.
Record the Lookup Service hostname or IP address, HTTPS port, and SDK path.
Prefer an SSO FQDN instead of an IP address when DNS and certificates are correctly configured. The name should match the certificate identity.
Obtain the expected Lookup Service certificate fingerprint from a trusted, independent source before installation.

Deployment design

Decide whether this host will run as a standalone Inventory Service instance or join an existing Inventory Service group, if the target vSphere release supports grouping. Record the selected option, hostnames, service ports, service accounts, installation paths, and Lookup Service URL before starting.

Preinstallation connectivity checklist

Source: Inventory Service host
Destination: SSO Lookup Service host
Protocol or service: HTTPS to the configured Lookup Service port
Why: Registration and service discovery
Verification: DNS lookup and an approved TCP connectivity test.

Source: vSphere Web Client
Destination: Inventory Service host
Protocol or service: Configured Inventory Service port
Why: Inventory and property queries
Verification: Test the port from the Web Client host and review firewall rules.

Source: vCenter Server components
Destination: Inventory Service host
Protocol or service: Applicable configured service ports
Why: Component communication in the legacy deployment
Verification: Confirm release-specific port requirements and test connectivity.

Source: Administrative workstation
Destination: Installer host
Protocol or service: Remote administration or console access
Why: Run and monitor setup
Verification: Confirm administrative access and local installer privileges.

Custom Install Workflow

Log on to the designated Windows Server with an account that has the access required to install services and write to the selected directory.
Mount or insert the compatible vCenter Server installation media.
Run the installer launcher, typically autorun.exe, from the media.
Choose Custom Install, then select vCenter Inventory Service.
Select the installer language and continue past the welcome information.
Read and accept the license agreement.
Choose the Inventory Service installation folder. Use a local path with adequate space and suitable backup handling.
Review the host name or FQDN presented by the installer. Correct it if it is not the stable FQDN intended for this server. Avoid proceeding with a short name or an incorrectly resolved address.
Review the Inventory Service ports. Retain default ports unless a documented conflict, security standard, or release-specific design requires a change. Every nondefault value must be recorded and allowed through the appropriate firewalls.
Choose the deployment or Inventory Service grouping option. Select a standalone instance unless the design requires joining an existing supported group.
Enter the SSO administrator username and password. Use the SSO identity, not merely a local Windows administrator account.
Enter the SSO Lookup Service URL in the format required by the target release. A common legacy format is:

https://<sso-host-fqdn-or-ip>:7444/lookupservice/sdk

For example, an SSO host named sso01.lab.example might use:

https://sso01.lab.example:7444/lookupservice/sdk

The port and path are release-dependent. Confirm them against the installation documentation and the actual SSO configuration for the target version.

Inspect the SSL certificate information and fingerprint displayed by the installer.
Compare the fingerprint with a value obtained through a trusted out-of-band method, such as approved certificate documentation or direct verification on the SSO system. Do not accept an unexpected fingerprint.
Review the complete installation summary, including host FQDN, ports, installation path, grouping choice, SSO identity, and Lookup Service endpoint.
Start the installation and monitor its progress.
Confirm that setup finishes successfully without registration, authentication, or certificate errors.

SSO Lookup Service Registration

Inventory Service discovers and registers with vSphere services through the SSO Lookup Service. Registration allows related components to locate the service rather than relying only on manually entered addresses.

The Lookup Service URL contains four important parts:

Protocol: https, because the registration connection is protected by TLS.
SSO host: The SSO server FQDN or IP address.
Port: The Lookup Service HTTPS port, commonly 7444 in applicable legacy releases, but always verify the target version.
Path: The Lookup Service SDK path, commonly /lookupservice/sdk.

The endpoint must be reachable from the Inventory Service host. The certificate must also identify the intended SSO host, and its fingerprint must match a trusted reference. An FQDN is operationally preferable when DNS and certificate naming are correct because it avoids certificate-name mismatches and makes future service administration clearer.

Installation Inputs Reference

Installer input: Inventory Service host FQDN
Example format: inv01.example.com
Purpose: Stable identity for the service
Validation: Confirm forward and reverse DNS and certificate-name compatibility.

Installer input: Installation directory
Example format: D:\VMware\Inventory Service
Purpose: Stores program files and service data
Validation: Check disk space, permissions, backup policy, and local storage suitability.

Installer input: Inventory Service port values
Example format: Release-specific default or approved unused TCP port
Purpose: Allows dependent components to connect
Validation: Check for conflicts and update firewalls if changed.

Installer input: SSO administrator username
Example format: An administrator identity in vsphere.local
Purpose: Authenticates service registration
Validation: Confirm the account belongs to SSO, not only to Windows.

Installer input: SSO administrator password
Example format: Secret credential
Purpose: Completes SSO authentication
Validation: Retrieve it from an approved secure credential store.

Installer input: Lookup Service URL
Example format: https://sso01.lab.example:7444/lookupservice/sdk
Purpose: Locates and registers vSphere services
Validation: Verify protocol, host, port, path, DNS, routing, and firewall access.

Installer input: SSL certificate fingerprint
Example format: Fingerprint shown by the installer
Purpose: Confirms the remote Lookup Service identity
Validation: Compare with a trusted out-of-band value.

Installer input: Deployment or grouping option
Example format: Standalone or supported existing group
Purpose: Defines how the Inventory Service instance participates in the deployment
Validation: Match the documented architecture and release capabilities.

Post-Installation Validation

Open the Windows Services console and locate the VMware Inventory Service service, or use an approved service-status command.
Confirm that the service is installed and running. Configure startup behavior according to the operational standard.
Verify that each configured service port is listening on the expected interface.
Test reachability from dependent vCenter components and the legacy vSphere Web Client host.
Confirm that Inventory Service is registered with the SSO Lookup Service.
Continue the component deployment sequence, including the legacy vSphere Web Client and vCenter Server as required by the chosen vSphere release.
After the complete environment is configured, sign in to the vSphere Web Client and browse inventory objects.
Open several objects and confirm that their properties load and refresh correctly.

Windows Services console: verify the VMware Inventory Service status
Approved TCP test: Inventory Service host -> SSO host and Lookup Service port
DNS checks: forward lookup and reverse lookup for every component FQDN

Security and Operational Practices

Use least-privilege administrative access for the installation while granting only the permissions required to install and register the component.
Protect the SSO administrator credential. Do not place it in scripts, tickets, or unsecured installation notes.
Verify certificate fingerprints through a trusted out-of-band source before accepting them.
Document component hostnames, installation directories, port assignments, service accounts, grouping choices, and Lookup Service URLs.
Avoid changing ports after deployment. If a change is unavoidable, assess registered services, firewall rules, monitoring, integrations, and dependent component configuration first.
Keep SSO, Inventory Service, vCenter Server, and the legacy vSphere Web Client on compatible versions from the same supported release family.
Back up configuration information and include the component in service monitoring and recovery procedures.

Troubleshooting

Lookup Service connection fails

Check the complete hostname, port, and path. Confirm that SSO and the Lookup Service are running, DNS resolves correctly in both directions, and firewalls permit the connection. Also verify that the endpoint format matches the installed vSphere release.

Certificate fingerprint is unexpected

Do not accept the prompt. The connection may be reaching the wrong host, DNS may be incorrect, the SSO certificate may have been replaced, or a proxy may be presenting another certificate. Compare the fingerprint with a trusted value and investigate any recent certificate or network changes.

SSO credentials are rejected

Confirm the SSO administrator identity and domain, such as the expected account in vsphere.local. Do not substitute a local Windows account. Re-enter the password carefully and check SSO service health if authentication continues to fail.

A port is unavailable

Identify the process using the port and determine whether a previous failed installation left a service running. Stop or reconfigure the conflicting application when appropriate, or select an approved unused port. Update firewall rules and all deployment records for any changed value.

Web Client inventory is missing or does not refresh

Verify that the VMware Inventory Service is running and registered. Check connectivity and configured ports, confirm compatibility among all legacy vCenter components, and complete any remaining Web Client or vCenter Server configuration. Review Inventory Service, Web Client, and vCenter logs for registration or query errors.

Exam-Relevant Notes

Simple Install places major legacy vCenter components together; Custom Install permits separate placement.
SSO must be available before Inventory Service can authenticate and register.
The Lookup Service URL uses HTTPS and includes the SSO host, release-specific port, and SDK path.
Certificate fingerprint verification is an identity check, not an optional cosmetic step.
Inventory Service supports the legacy vSphere Web Client; it is not a replacement for vCenter Server.
The vCenter Server Appliance does not require this separate Windows installation.