ERROR_GEN_FAILURE [code 0x0000001f] error while adding VCSA to Active Directory (AD) Domain

Products

• VMware vCenter Server

Issue/Introduction

• Joining vCenter Server Appliance (VCSA) to an Active Directory (AD) domain using the command-line interface (CLI) fails.
• The error reported is

  Error: ERROR_GEN_FAILURE [code 0x0000001f]

  or
• Users are unable to login to an AD-joined VCSA using their AD accounts
• Server Message Block protocol version 2 (SMB2) is enabled on both the vCenter as well as in the Domain Controllers (DCs).

Environment

• VMware vCenter Server 8.0.x
• VMware vCenter Server 7.0.x
• VMware vCenter Server Appliance 6.x

Cause

This issue occurs if the VCSA is unable to properly communicate with the Domain Controller(s) via TCP port 445, usually because the port is blocked by a device in-between like a firewall appliance.

Resolution

To fix this issue, ensure that TCP port 445 is open between the VCSA and the domain controller(s)

To test if TCP 445 is accessible, run the following command in the Shell of the VCSA (Replace <mydomain.com> against the correct name of the domain:

# openssl s_client -connect <mydomain.com<>:445

• If the command results in a "CONNECTED", TCP port 45 is indeed open.
• However, if the command outputs an "errno" or "error" message, TCP port 445 is blocked between the VCSA and the DC. In this case work with your network team to open the port

Should the goal of the domain join be to use Integrated Windows Authentication to allow AD users to access vCenter Server as per Add or Edit a vCenter Single Sign-On Identity Source, consider alternatively using an "Active Directory over LDAP(S)" Identity Source instead or as a temporary workaround, if TCP port 445 cannot be opened immediately.

NOTE: Be aware that Integrated Windows Authentication has been deprecated. Refer to Removal of Integrated Windows Authentication (IWA) for further details.

Additional Information

Enabling vCenter Server Appliance to use SMB2

Domain join operation for vCenter Server appliance fails with the Error: ERROR_ACCESS_DENIED when SMBv3 is enabled on Domain Controller

"/opt/likewise/bin/domainjoin-cli", CLI to handle Active Directory Domain Operations Join/Leave/Query

Third-party links:

How to configure a firewall for Active Directory domains and trusts

How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows

Disclaimer: VMware is not responsible for the reilability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.