Joining the VMWare vCenter Server Appliance or VMware vRealize Automation Identity Appliance to a domain fails with the error: Error trying to join AD, error code [31]

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VMware vCenter Server

Issue/Introduction

• Joining the vCenter Server Appliance to a Domain fails with the following error:
  

  Idm client exception: Error trying to join AD, error code [31], user...

• Joining the vRealize Automation Identity Appliance to a Domain fails with the following error:
  

  Error invoking Active Directory tools

• In the vCenter-/var/log/vmware/sso/ssoAdminServer.log file, you see entries similar to:
  

  [YYYY-MM-DDTHH:MM:SS.xxxx pool-12-thread-4 opId=cebe1692-a4e4-4dd8-9922-e57217646849 ERROR com.vmware.identity.admin.server.ims.impl.SystemManagementImpl] Exception occurred: 'com.vmware.identity.idm.IDMException: Error trying to join AD, error code [31], user [administrator], domain [domain.local], orgUnit []'; stack='com.vmware.identity.idm.IDMException: Error trying to join AD, error code [31], user [administrator], domain [domain.local], orgUnit []
  at com.vmware.identity.idm.server.IdentityManager.joinActiveDirectory(IdentityManager.java:9925)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)

• In the vRealize Automation server - /var/log/messages file, you see entries similar to:
  

  2015-11-10T15:22:30-08:00 localhost lsassd[5933]: 0x7fe831aec700:Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider') -> error = 31, symbol = ERROR_GEN_FAILURE, client pid = 15446

  Note: These log excerpts are examples. Date, time, and environmental variables may vary depending on your environment.

Environment

• VMware vCenter Server Appliance 6.x
• VMware vCenter Server Appliance 7.x
• VMware vCenter Server Appliance 8.x
• VMware vRealize Automation 6.2.x

Cause

• This issue occurs when Windows 2012 uses Server Message Block version 2 (SMB2) because SMB1 is disabled by default.
• This issue can also occur if the AD Domain Functional Level is not supported by the version of vCenter used.
  Example: AD is Windows Server 2003 and vCenter is 6.7  - this is unsupported.
• Reference - Versions of Active Directory supported in vCenter Server (Domain Functional Level)
• This error is also seen if any firewall blocks are observed from vCenter to AD servers on port 445 (used for the SMB protocol).
  (Run command on vCenter --->: curl -v telnet://<IP-of-AD-server>:445)

Resolution

This issue is resolved in vCenter Server Appliance 6.0 Update 3c, available at Broadcom support portal

 

To work around this issue if you are unable to upgrade at this time, enable SMBv1.0 by running this command from an elevated command prompt on all Windows 2012 Domain Controllers:
 sc config srv start=auto

 

For more information about enabling and disabling SMBv1.0, see Microsoft Knowledge Base article 2696547.

 

Additionally, please ensure that port 445 is open when vCenter is trying to communicate with the AD server. (i.e. vCenter to AD server)