Changing PNID from short name to FQDN fails with an error "Failed to reset machine account"

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Changing the Primary Network Identifier (PNID) from a short name (e.g., 'vcenter') to an FQDN (e.g., 'vcenter.domain.com') fails.
• The workflow may halt at approximately 75% with the error: "Failed to reset machine account."
• In some instances, the process fails early with "Failed to add CN entries."
• In the /var/log/vmware/applmgmt/pnid_change.log, you may find entries similar to:

yyyy-mm-dd hh:mm:ss - pnid_utils-run_command():81 - INFO - Running command: /usr/lib/vmware-vmdir/bin/vdcresetMachineActCred -u administrator 
yyyy-mm-dd hh:mm:ss - pnid_utils-run_command():99 - INFO - Command exited with exitcode : 32 
yyyy-mm-dd hh:mm:ss - pnid_utils-run_command():101 - WARNING - Command failed with following error: 
yyyy-mm-dd hh:mm:ss - pnid_utils-run_command():102 - WARNING - b'password: \n' 
yyyy-mm-dd hh:mm:ss - pnid_utils-run_command():109 - INFO - Done running command 
yyyy-mm-dd hh:mm:ss - pnid_utils-restart_services():1598 - ERROR - password: 
yyyy-mm-dd hh:mm:ss - pnid_utils-update_task_status():1444 - INFO - Task : Failed to reset machine account.

• In the /var/log/vmware/vmdird/vmdird-syslog.log, errors such as LDAP_INVALID_CREDENTIALS(49) or LDAP_NO_SUCH_OBJECT(32) appear, often showing a doubled domain (e.g., vcenter.domain.com.domain.com)

yyyy-mm-dd hh:mm:ss err vmdird  t@140291113727744: VmDirSendLdapResult: Request (Bind), Error (LDAP_INVALID_CREDENTIALS(49)), Message ((49)(SASL start failed.)), (0) socket (127.0.0.1) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140291113727744: Bind Request Failed (127.0.0.1) error 49: Protocol version: 3, Bind DN: "", Method: SASL 
yyyy-mm-dd hh:mm:ss err vmdird  t@140291113727744: VmDirSRPGetIdentityData (vcenter.domain.com.domain.com) failed, (9106) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140291113727744: VmDirSRPGetIdentityData (vcenter.domain.com.domain.com) failed, (9106) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140291113727744: SASLSessionStart: sasl error (-20)(SASL(-13): user not found: no secret in database)

OR

yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: InternalModifyEntry: VdirExecutePostModifyCommitPlugins - code(9703) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: VmDirSendLdapResult: Request (Modify), Error (LDAP_NO_SUCH_OBJECT(32)), Message (read entry (cn=vcenter.domain.com.domain.com,ou=domain controllers,dc=example,dc=com) failed), (0) socket (127.0.0.1) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: VmDirSRPGetIdentityData (vcenter.domain.com.domain.com) failed, (9106) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: VmDirSRPGetIdentityData (vcenter.domain.com.domain.com) failed, (9106) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: SASLSessionStart: sasl error (-20)(SASL(-13): user not found: no secret in database) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: VmDirSendLdapResult: Request (Bind), Error (LDAP_INVALID_CREDENTIALS(49)), Message ((49)(SASL start failed.)), (0) socket (127.0.0.1) 
yyyy-mm-dd hh:mm:ss err vmdird  t@140424601650944: Bind Request Failed (127.0.0.1) error 49: Protocol version: 3, Bind DN: "", Method: SASL

Environment

• VMware vCenter Server Appliance 6.7.x
• VMware vCenter Server Appliance 7.0.x

Cause

• This issue is caused by a string substitution defect in the PNID change workflow. When transitioning from a short name to an FQDN, the workflow incorrectly populates the registry by doubling the domain string, leading to a failed machine account reset in the directory service.
  
  • From the /var/log/vmware/vmdird/vmdird-syslog.log we can see the new PNID as "vcenter.domain.com.domain.com" which is incorrect.

Resolution

This is a known issue with PNID change workflow and resolved in vCenter server version 8.0 U3 and above. 

Workaround:
To resolve this issue, perform the PNID change in two distinct steps using a temporary, unique FQDN. Ensure a valid backup or snapshot of the vCenter Server is taken before proceeding.

1. Create a temporary DNS A/PTR record for a unique FQDN (e.g., vcenter-temp.domain.com) pointing to the current vCenter IP address.
2. Log in to the vCenter Server Management Interface (VAMI) at https://<vcenter-ip>:5480.
3. Navigate to Networking > Edit and change the Hostname to the temporary FQDN
4. Reboot the vCenter Server. (This is required to update the identity registry cleanly).
5. Update the DNS records to point to the final desired FQDN
6. Log in to the VAMI and change the PNID/Hostname from the temporary FQDN to the final FQDN.
7. Verify that all services start correctly and the PNID is reflected accurately in the inventory.