Adding a host to vCenter Server fails with general system error or vim.fault.NoPermission

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• You cannot add a host to the VirtualCenter or vCenter Server inventory.
• Adding a host to vCenter Server fails with the error:
  
  A general system error occurred.
   
• In the hostd.log file, you see entries similar to:
  
  ------------------------------------------------------
  [TimeStamp 'Vmomi' 11160496 info] Throw vim.fault.NoPermission
  [TimeStamp 'Vmomi' 11160496 info] Result:
  (vim.fault.NoPermission) {
  object = 'vim.Folder:ha-folder-root',
  privilegeId = "System.View"
  msg = ""
  }
  ------------------------------------------------------
  ------------------------------------------------------
  [TimeStamp 'Vmomi' 23493552 info] Throw vim.fault.AuthMinimumAdminPermission
  [TimeStamp 'Vmomi' 23493552 info] Result:
  (vim.fault.AuthMinimumAdminPermission) {
  msg = ""
  }
  ------------------------------------------------------
  
  

• If you try to add a host to vCenter Server, the recent tasks of the VMware Infrastructure or vSphere Client connected directly to the host shows the message:
  
  The specified key, name, or identifier already exists
   
• If you try to add a host to vCenter Server, VMware Infrastructure or vSphere Client, you see the error:
  
  Permission to perform this operation was denied.
  You do not hold privilege "Permissions > Modify permissions" on folder "
   
• In the vpxa.log file, you see entries similar to:
  
  <YYYY-DD-MM><time> 0xf7e5d6c0 error 'App';VpxaHalCnxHostagent; Failed to refresh service system: vim.fault.NoPermission
  <YYYY-DD-MM><time> 0xf7ae3b90 error 'App';VpxaMoService::SetConfig; Unhandled exception:
  vim.fault.NoPermission
  <YYYY-DD-MM><time> 0xf7ae3b90 error 'App';
  Exception: vim.fault.NoPermission
  </time></time></time>
  
   
• If you are able to successfully add a host to vCenter Server, it disconnects.
• In the /var/log/vmkernel.log file, you see entries similar to:
  
  <Month DD Time> host watchdog-vpxa: [17481] Begin '/opt/vmware/vpxa/sbin/vpxa', min-uptime = 30, max-quick-failures = 5, max-total-failures = 1000000
  <Month DD Time> host watchdog-vpxa: Executing '/opt/vmware/vpxa/sbin/vpxa'
  <Month DD Time> host /usr/lib/vmware/bin/vmware-hostd[13896]: Accepted password for user vpxuser from 127.0.0.1
  <Month DD Time> host watchdog-vpxa: End '/opt/vmware/vpxa/sbin/vpxa', failure limit reached

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware vSphere ESXi 6.x
VMware vCenter Server 6.x
VMware vSphere ESXi 7.x
VMware vCenter Server 7.x
VMware vSphere ESXi 8.x
VMware vCenter Server 8.x

Resolution

This issue occurs when inconsistent authorization is configured on ESXi\ESX. This configuration is stored in /etc/vmware/hostd/authorization.xml.

 

To resolve this issue, rename authorization.xml:

1. Rename /etc/vmware/hostd/authorization.xml to /etc/vmware/hostd/authorization.xml.old.
2. Restart the host management services. For more information, see Restarting the Management agents on an ESX or ESXi Server (1003490).
3. Add permission for DCUI user: #esxcli system permission set -i dcui -r Admin

If you still cannot add the host to vCenter Server:

• Verify Locked Mode is disabled in the host. For more information, see Enabling or disabling Lockdown mode on an ESXi host (1008077) .