Splitting Enhanced Linked Mode (ELM)

Products

VMware vCenter Server 7.0 VMware vCenter Server 8.0

Issue/Introduction

The vCenter/vSphere domain and Enhanced Linked mode terms, refer to an environment in which multiple vCenters are linked together.

From a UI perspective the inventories of each vCenter are viewable from any of the nodes in the link mode set up, but additionally all vCenter are members of and participate in the same (SSO) single sign on domain.

In linked mode the contents of the vmdir database is replicated to all nodes in the SSO. This includes for example local users, tags, categories, global permissions ect.

vCenters in enhanced linked mode all use the same STS certificate & the trusted root store is replicated between nodes.

From time to time and for various reasons the need to break enhanced linked mode aka remove a node from the SSO comes up.

Environment

vCenter 6.7 update 1
vCenter 7.x
vCenter 8.x

Resolution

To remove a vCenter from linked mode this can be achieved by repointing a node from the current existing domain to its own domain (SSO).

Warning:

offline snapshots off all nodes in linked mode must be taken to allow for single point in time roll back. If vCenter HA is in use on any of the nodes it must be destroyed before attempting this process.

Shut down the node that is being repointed (for example, vCenter C)
With the node that is being moved shutdown, next step is to decommission it from the current SSO For example, to decommission Node C, log into either Node B or Node A and run the following command:
```
cmsso-util unregister --node-pnid Node_C_FQDN --username Node_B_sso_administrator@sso_domain.com --passwd Node_B_sso_adminuser_password
```
After unregistering vCenter C, services are restarted. References to vCenter C are deleted from the vCenter where you have run the command and the changes are replicated to any partners still in the SSO.
Power on vCenter C to begin the domain repointing process.
Using the following command on vCenter C will repoint the node to its own domain/sso the value “destination_PSC_domain” can be anything however vsphere.local is recommended.
```
cmsso-util domain-repoint -m execute --src-emb-admin Administrator  --dest-domain-name destination_PSC_domain
```

Note:

The following information/configuration is lost on the vCenter following a domain repoint and may need to be re-created:

Custom local SSO user accounts e.g a custom added service account.
Global Permissions
vCenter if domain joined will need to be rejoined
Re-register external plugins and solutions.