"Errors in Active Directory operations" error adding the ESXi host to an Active Directory domain

Products

• VMware vSphere ESXi
• VMware vSphere ESXi 8.0

Issue/Introduction

• When attempting to join an ESXi host to an Active Directory domain, the operation fails. 

  The following error string is displayed in the user interface:

  Errors in Active Directory operations
 
• If netlogond is enabled on the host, entries similar to the following may appear in the /var/run/log/netlogond.log:
  
  20100820075107:0xf7c74b90:DEBUG:[LWNetSrvGetCurrentDomain() /build/mts/release/bora-234910/likewise/esxi-esxi/src/linux/netlogon/server/api/lwnet-pstore.c:83] Error at /build/mts/release/bora-234910/likewise/esxi-esxi/src/linux/netlogon/server/api/lwnet-pstore.c:83 [code: 136]
  
  Note: For more information on enabling netlogond, see Enabling logging for Likewise agents on ESXi.
  
  
• In the /var/run/log/likewise logging, the following error may be observed:
  
  240903101818:ERROR:Isass: Failed to run provide: specific request (request code = 8, provide: = 'lsa-activedirectory-provider') —> error = 40056, symbol = LW ERROR ACCOUNT DISABLED, client pid = 2100765

Environment

VMware vSphere ESXi 7.x

VMware vSphere ESXi 8.x

Cause

This issue occurs if the required network firewall ports are blocked between the ESXi host and the Active Directory domain controllers, or if the computer object in Active Directory has been disabled.

Resolution

• Ensure the following network ports (both UDP and TCP) are open for bidirectional communication between the ESXi host and Active Directory:
  • Port 88 - Kerberos authentication
  • Port 123 – NTP
  • Port 135 - RPC
  • Port 137 - NetBIOS Name Service
  • Port 139 - NetBIOS Session Service (SMB)
  • Port 389 - LDAP
  • Port 445 - Microsoft-DS Active Directory, Windows shares (SMB over TCP)
  • Port 464 - Kerberos - change/password changes
  • Port 3268- Global Catalog search
    
    
• Log in to the ESXi host via SSH as root and restart the lwsmd service by running the following commands:

/etc/init.d/lwsmd stop

/etc/init.d/lwsmd start

• Verify the Active Directory computer object status:

  • Check with the internal AD administration team to confirm if the ESXi computer object is disabled.

  • If it is disabled, enable it and retry the domain join.

  • If it is enabled but still failing, delete the ESXi computer object in Active Directory and retry the domain join operation.

• When entering credentials, utilize the <username> or <username@fqdn_of_the_domain> format rather than the legacy <domain\username> syntax.