"[Error 1314] CreateProcessAsUser: 'A required privilege is not held by the client.'" vCenter Server migration to Appliance fails with WindowsError during pre-checks

Products

• VMware vCenter Server

Issue/Introduction

Identify missing service account permissions as cause of vCenter Server migration failure.

Symptoms:

• Windows vCenter migration fails during pre-checks with error : WindowsError: [Error 1314] CreateProcessAsUser: 'A required privilege is not held by the client.'

• You will see entries similar to below in log file %temp/vcsMigration/CollectRequirements_com.vmware.vcdb_<date_and_time>.log

2020-01-07T23:27:39.298Z INFO vcdb.const MSSQL with Windows Authentication.

2020-01-07T23:27:39.298Z INFO vcdb.const Validating source embedded schema...

2020-01-07T23:27:39.301Z INFO vcdb.const MSSQL with Windows Authentication.

2020-01-07T23:27:39.308Z INFO win_executor Running command ['C:\\mig7EB5.tmp\\PFiles\\VMware\\CIS\\cis_upgrade_runner\\payload\\component-scripts\\vcdb\\dbupgrade\\dbcupgrade', '-u', 'ckk87asdlkfe98ujhl=', '-p',CENSORED, '-b', '600', '-v', u'C:\\Users\\<username>\\AppData\\Local\\Temp\\vcsMigration\\vcdb_warning.log', '-t', 'mssql', '-d', 'ckk87sdfhawfe98ujhl=', '-y', '-e', '-m'] as user <username>@<domainname>

2020-01-07T23:27:40.246Z ERROR __main__ Upgrade Phase 'vcdb:CollectRequirements' failed. Exception: [Error 1314] CreateProcessAsUser: 'A required privilege is not held by the client.'

Traceback (most recent call last):

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\payload\componentPhaseLauncher.py", line 461, in main

    executionResult = systemExtension(exeContext)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\libs\sdk\extensions.py", line 94, in __call__

    result = self.extension(*args)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\libs\sdk\extensions.py", line 110, in _func

    return func(*args)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\payload\component-scripts\vcdb\__init__.py", line 25, in do_collect_upgrade_requirements

    req = do_windows_collect_req(context)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\payload\component-scripts\vcdb\vcdb_collect_requirements_functions.py", line 739, in do_windows_collect_req

    DBC_UPGRADE_FOLDER)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\libs\sdk\win_executor.py", line 307, in run_as_user

    stderr=stderrFile)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\libs\sdk\win_executor.py", line 140, in __init__

    stderr=stderr, close_fds=close_fds)

  File "C:\Program Files\VMware\vCenter Server\python\lib\subprocess.py", line 710, in __init__

    errread, errwrite)

  File "C:\mig7EB5.tmp\PFiles\VMware\CIS\cis_upgrade_runner\libs\sdk\win_executor.py", line 226, in _execute_child

    raise WindowsError(*e.args)

WindowsError: [Error 1314] CreateProcessAsUser: 'A required privilege is not held by the client.'

Environment

VMware vCenter Server 6.x
VMware vCenter Server 5.5.x

Cause

This issue can happen if the Service Account used by VC Service is missing proper privileges on Windows vCenter Server.

Resolution

• To resolve the issue, grant following permissions through Group Policy or Local Policy to the service account used by vCenter Services:
  • Log on as a service
  • Replace process level token
  • Log on as batch job
• Re-run the migration after granting above permissions.