Error: vmware-stsd fails to start due to duplicate sAMAccountName

Products

• VMware vCenter Server

Issue/Introduction

Introduction: 
After changing the Primary Network Identifier (PNID) or updating DNS settings on the vCenter Server Appliance (VCSA), the vmware-stsd and vmware-sps services fail to start. The VMware Appliance Management Interface (VAMI) shows a "503 - Service Unavailable" error, and the vSphere Client displays "no healthy upstream" errors.

Symptoms:

• • vmware-stsd and vmware-sps services fail to start.
  • VAMI reports 503 - Service Unavailable.
  • /var/log/vmware/sso/vmware-identity-sts.log contains: java.lang.IllegalStateException: Internal error : duplicate entries were found at com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider.getAttributes
  • /var/log/vmware/sps/sps.log contains: com.vmware.vim.storage.common.serviceclient.vpxd.VpxdException: Error occurred while retrieving service content

Environment

• VMware vCenter Server Appliance (VCSA) 7.0.x
  
  
• VMware vCenter Server Appliance (VCSA) 8.0.x

Cause

A previous machine account entry was not removed from the VMware Directory (VMDIR) database during a network configuration change. This results in multiple machine accounts sharing the same sAMAccountName attribute, leading to identity lookup failures.

Resolution

Before modifying the VMware Directory instance, perform the following steps to ensure data safety:

1. Take offline snapshots of all vCenter Servers within the SSO domain.
2. Identify duplicate machine account entries by running the command:
   
   
   

   SSO_DOMAIN_DN="dc=$(/usr/lib/vmware-vmafd/bin/vmafd-cli get-domain-name --server-name localhost | sed -e 's/\./,dc=/g')"; ldapsearch -LLL -h localhost -b "ou=Domain Controllers,$SSO_DOMAIN_DN" -D "cn=administrator,cn=users,$SSO_DOMAIN_DN" sAMAccountName -W

3. Review the output to find the Distinguished Name (DN) of the stale entry (typically the one using the IP address if the FQDN is current): Example: cn=####.####.####.####,ou=Domain Controllers,dc=vsphere,dc=local
4. Delete the stale machine account entry using the command:
   
   
   

   ldapdelete -h localhost -D "cn=administrator,cn=users,$SSO_DOMAIN_DN" -W "cn=####.####.####.####,ou=Domain Controllers,dc=vsphere,dc=local"

5. Restart vCenter services:
    

   service-control --stop --all && service-control --start --all

Additional Information

To troubleshoot using a GUI, refer to: Using JXplorer to connect to the vSphere Single Sign-on

For further assistance, refer to our Contact Support page.