Error "Failed to add user: cm to group: cis" while installing Platform Services Controller (PSC) Appliance 6.5

Products

• VMware vCenter Server

Issue/Introduction

Installing, migrating or upgrading PSC Appliance 6.5 onto a newly created ESXi Server may fail with the following error in stage 2 section during PSC setup:

Note: Refer the attached images in this article to view the UI examples of these error messages.

• You see this error if the setup fails during Component Manager's security configuration:
  
  

  An error occurred while performing security operation: 'Failed to add user: cm to group: cis' Could not configure the Component Manager security settings.

  Error 'Services might not be working as expected'
  
  OR
  
  A problem occurred while - Starting VMware Component Manager

• In the / var/log/messages of the Appliance, if you find these two messages showing the time change and the root password being expired, the clock running on the ESXi Server hosting the appliance VM is incorrect.
  
  localhost systemd[1]: systemd 228 running in system mode. (+PAM -AUDIT -SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL +XZ -LZ4 -SECCOMP +BLKID -ELFUTILS +KMOD -IDN)
  localhost systemd[1]: Detected virtualization vmware.
  localhost systemd[1]: Detected architecture x86-64.
  localhost systemd[1]: Set hostname to <photon-machine>.
  localhost sshd[4049]: Server listening on 0.0.0.0 port 22.
  localhost sshd[4049]: Server listening on :: port 22.
  localhost systemd[1]: Time has been changed
  localhost CROND[4084]: (root) CMD ( /usr/sbin/iiad.sh >/dev/null 2>&1)
  localhost systemd[1]: Starting Cleanup of Temporary Directories...
  localhost usermod[7224]: pam_unix(usermod:account): expired password for user root (password aged)
  localhost usermod[7224]: Authentication token is no longer valid; new one required

Cause

This issue occurs because the clock of PSC appliance VM is incorrect at the beginning of the installation and the time gets corrected by NTP in Stage 2. If the time difference between the incorrect and correct time is big enough, the root password might expire and may cause various problems because any root commands following the expiration will fail.

Depending on when the clock gets corrected by NTP server, the Platform Services Controller setup may fail at different places.

Environment

VMware vCenter Server Appliance 6.5.x

Resolution

To resolve this issue, ensure that the clock of ESXi Server hosting the PSC appliance VM is correctly set so the PSC appliance VM will also be running with the correct time when the installation starts.