Unable to start the vcenter webclient services in vCenter 6.5 windows

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Unable to access the web-client from Windows vCenter server.
• You see the error in the Webclient when he try to access the Webclient:
  
  503 Service Unavailable (Failed to connect to endpoint: [class Vmacore::Http::LocalServiceSpec:0x000000e7ddac0030] _serverNamespace = /vsphere-client action = Redirect _port = 9090)
   
• In the %ALLUSERSPROFILE%\VMware/vCenterServer/logs/vmon/vMon.log file, you see this entry indicating the service start failure:
  
  Logon failure: the user has not been granted the requested logon type at this computer.

 

• When you restart the web-client service, you see the entries similar to:
   

  D:\Program Files\VMware\vCenter Server\bin>service-control --start vspherewebclientsvc
Perform start operation. vmon_profile=None, svc_names=['vspherewebclientsvc'], include_coreossvcs=False, include_leafossvcs=False
2017-04-20T03:33:07.257Z Service vsphere-client state STOPPED
Error executing start on service vsphere-client. Details {
"resolution": null,
"detail": [
{
"args": [
"vsphere-client"
],
"id": "install.ciscommon.service.failstart",
"localized": "An error occurred while starting service 'vsphere-client'",
"translatable": "An error occurred while starting service '%(0)s'"
}
],
"componentKey": null,
"problemId": null
}
Service-control failed. Error {
"resolution": null,
"detail": [
{
"args": [
"vsphere-client"
],
"id": "install.ciscommon.service.failstart",
"localized": "An error occurred while starting service 'vsphere-client'",
"translatable": "An error occurred while starting service '%(0)s'"
}
],
"componentKey": null,
"problemId": null
}

  D:\Program Files\VMware\vCenter Server\bin>

Environment

VMware vCenter Server 6.5.x
VMware vCenter Server 6.7.x

Resolution

To resolve this issue:

1. Log on to Windows 6.5 vCenter server.
2. Open the Group Policy Management Editor.
3. In the Group Policy Management Editor dialog box, under Computer Configuration, expand Policies, Windows Settings, Security Settings, and Local Policies, and then click User Rights Assignment.
4. Double-click Log on as a batch job permissions and add below users or groups

Accounts:

• cm
• content-library
• eam
• imagebuilder
• mbcs
• netdumper
• perfcharts
• rbd
• vapiEndpoint
• vmware-vpostgres
• vsan-health
• vsm
• vsphere-client
• vsphere-ui

Note: if you cant make these changes on the vCenter itself, it might have to do this at top level AD domain.

 

3. Push the new policies to the vCenter Server.
   1. Open Command Prompt on vCenter Server.
   2. Run the command gpupdate/force to push the new policies. You see output similar to:
      
      #gpupdate/force
      Updating Policy...
      
      User Policy update has completed successfully.
      Compute Policy update has completed successfully.
       
   3. Reboot the vCenter Server.
       
   4. Verify that new active policies are pushed down and you are able to see them in the batch job policy.
       
4. Start the vCenter services by running this command:
   
   service-control --start --all