"Failed to Logon as vapiEndpoint user" upgrade fails while starting vapi-endpoint service | "This user isn't allowed to sign in to this computer"

Products

• VMware vCenter Server

Issue/Introduction

Starting with vSphere 6.5, some vCenter Server processes use separate local users that are automatically created and added to the local security policy Log on as a batch job. Such new local users are cm, content-library, eam, imagebuilder, mbcs, netdumper, perfcharts, rbd, vapiEndpoint, vmware-vpostgres, vsan-health, vsm, vsphere-client, and vsphere-ui.


Symptoms:

• vCenter Upgrade fails with ERROR starting vapi-endpoint
• You will see similar entries in /var/log/vmware/vmon/vmon.log file as shown below,

vMon.log
2020-02-27T02:40:25.510-06:00| vthread-5| I125: Constructed command : "D:\Program Files\VMware\vCenter Server\visl-integration\usr\sbin\cloudvm-ram-size.bat"
-J vmware-vapi-endpoint -O D:\ProgramData\VMware\vCenterServer\data/vmware-vmon/vapi-endpoint.start.cmd
2020-02-27T02:40:25.510-06:00| vthread-5| I125: Setting working dir of process to D:\Program Files\VMware\vCenter Server\vapi/wrapper/bin.
2020-02-27T02:40:25.517-06:00| vthread-5| E110: Failed to Logon as vapiEndpoint user. Error: This user isn't allowed to sign in to this computer
2020-02-27T02:40:25.517-06:00| vthread-5| E110: Service vapi-endpoint pre-start command could not started.

Environment

VMware vCenter Server 6.5.x

Cause

This usually happens when proper Windows permissions are not set on the computer.

Resolution

1. From Windows vCenter Server open 'Local Security Policy'. 
   •     Open RUN command and type secpol.msc or 
   •     Go to control panel click on 'Adminstrative Tools' and open 'Local Security Policy'
2. Select Local Policies > User Rights Assignment > Allow log on locally.
3. Right click on 'Allow log on locally' and then make sure that "Administrators" and "Users" are part of it. If any one of the user account is missing, please add them to this list.
4. Retry the VC upgrade.