vCenter Server Fails to Leave Active Directory Domain with Error : There is already a native AD IDS or LDAP AD IDS registered

Products

• VMware vCenter Server

Issue/Introduction

When attempting to disjoin or leave an Active Directory domain from a vCenter Server Appliance, the operation fails with the following error in the vSphere Client: "There is already a native AD IDS or LDAP AD IDS registered", Unable to disjoin/leave vCenter Server Appliance from Active Directory Domain"

Environment

• vCenter 8.x
• vCenter 7.x

Cause

The presence of an active Integrated Windows Authentication (IWA) or LDAP identity source prevents the domain disjoin utility from executing.

Resolution

1. Take a snapshot of all vCenter Server nodes in the SSO domain.
2. Log in to the vSphere Client and navigate to Administration > Configuration > Identity Sources.
3. Select the Active Directory (Integrated Windows Authentication) identity source and click Delete.
4. Log in to the vCenter Server Appliance as root via SSH and enable the bash shell.
5. Run the command to leave the domain
   
   /opt/likewise/bin/domainjoin-cli leave

6. Reboot the appliance.
7. Delete the stale computer account object from the Active Directory Domain Controller.
8. Log back into the vCenter Server via SSH and execute the join command
   
   /opt/likewise/bin/domainjoin-cli join <domain-name> <domain_admin_user>

9. Reboot the appliance.
10. Re-add the Identity Source in the vSphere Client under Administration > Configuration > Identity Sources.