I had a vCenter 5.5 joined to the domain had its computer object deleted from Active Directory and therefore authentication/single sign-on would no longer work.
Initially I tried to remove it from the domain by un-ticking the “Active Directory Enabled” checkbox in VMware vCenter Server Appliance Web Console but I would always get the “Enabling Active Directory failed” error:
After some time searching, I tried the following commands to join the domain but without any luck:
# /opt/likewise/bin/domainjoin-cli join labdomain.local
# /usr/sbin/vpxd_servicecfg ad write PASSWORD labdomain.local
A quick look at vpxd_cfg.log (cat /var/log/vmware/vpx/vpxd_cfg.log) revealed the issue and this time a not so vague error message:
2015-01-12 10:31:46 3565: START locking... /usr/sbin/vpxd_servicecfg ad write 2015-01-12 10:31:46 3568: [3565]BEGIN execution of: /usr/sbin/vpxd_servicecfg 'ad' 'write' '' CENSORED 'labdomain.local' 2015-01-12 10:31:46 3568: Testing domain (labdomain.local) 2015-01-12 10:31:46 3568: Enabling active directory: 'labdomain.local' '
I did not want to rebuild vCenter as I configured on it vCOps and Update Manager so I thought I would try one last time to force join:
- Create the missing vCenter computer object in AD
- Logon to vSphere Web Client
- Go to Home > Configuration >Identity Sources tab
- Remove any current domain identity sources that exist
- Click the green cross
- Select as Identity source type Active Directory as a LDAP Server
- Complete the relevant fields with the required information
- Go to Home > Configuration >Identity Sources tab
Thank you for your post, this lead me to a major issue and resolution for adding VCSA 5.5 to a Windows 2012R2 domain. When adding VCSA 5.5 to the domain it fails if the AD server doesn’t reply with SMBv1 (SRV.sys). By default that is disabled in 2012R2 and SRV2.sys is the only SMB service. My fix was to add the “SMB 1.0/CIFS File Sharing Support” feature. Once added the joindomain-cli command worked perfectly.
The group is not created in active directory by default. An administrator must manually create the group, but once created by default all users that are members of this group get full admin access to all vSphere hosts added to the domain.
What group needs to be created?
What group, please? It’s not mentioned in this thread, nor is it intuitive with the logs.
Thank you so much.
Your post helps me to solve this problem.
The reason was SMB1 disabled on my domain controller.
This also fixed my issue