Although there are many access control models having been developed and applied in various environments,few of them have addressed the issue of managing information access control in the combined context of virtualization and multiple domains.Aiming at applying RBAC in the virtualized and multi-domain scenarios,this paper enhanced authorization ability of RBAC through two concepts: domain and virtual machine.We define an innovative model named VRBAC in which authorized users can migrate or copy virtual machines from one domain to another without causing a conflict.Domain users or groups are allowed to share permissions of not only resources like shared files but also virtual machines with others either from the same or a different domain.Three types of conflicts between VRBAC policies are defined and formulated in the form of ontologies,which provides extra access to description logic reasoning and facilitates the conflict detection procedure.Moreover,in order to address the practical needs in enterprise management processes,we have successfully applied VRBAC to a widely used virtualization infrastructure: Microsoft Active Directory and VMware vSphere platform.Experimental results indicate that all policy conflicts can be detected precisely and efficiently.The generated reports can offer network administrators the conflict details including conflict types,positions and causes,which will serve as guidance for further conflict resolution.