Unable to add ESXi host to Active Directory because 'the user or group does not exist'

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to join an ESXi host to an Active Directory domain, the operation fails. The error message states that a specific user or group does not exist. Additionally, attempts to leave the domain also fail with a similar error.

Environment

• VMware ESXi 7.x
• VMware ESXi 8.x
• Active Directory domain

Cause

This issue typically occurs when:

• The user or group name has been mis-typed
• When there's an invalid character in the group name specified for domain join operations.
  • Specifically, special characters like the caret symbol (^) are not allowed in Active Directory group names.

Resolution

To resolve this issue, follow these steps:

1. Log in to the vSphere Client.
2. Select the affected ESXi host in the inventory.
3. Go to the "Configure" tab.
4. Under "System", select "Authentication Services".
5. Click "Edit" in the "Active Directory" section.
6. Check the "User/Group" field:
   1. If it is mis-typed or contains invalid characters (e.g., 'DOMAIN\group^name'), change it to a valid group name (e.g., 'DOMAIN\group_name').
   2. Click "OK" to save the changes.
7. Leave the current domain:
   1. In the "Authentication Services" section, click "Leave Domain".
   2. Confirm the action when prompted.
8. Rejoin the domain:
   1. Click "Join Domain".
   2. Enter the domain name.
   3. Provide the username and password of an account with permissions to join computers to the domain.
   4. In the "User/Group" field, enter the correct group name.
   5. Click "OK" to join the domain.
9. Verify time synchronization:
   1. In the "Configure" tab, under "System", select "Time Configuration".
   2. Ensure that the host is using correct NTP servers.
   3. If changes are needed, click "Edit" and update the NTP servers.
10. Check DNS configuration:
    1. In the "Configure" tab, under "Networking", select "TCP/IP configuration".
    2. Verify that the DNS servers are correctly set.
    3. If changes are needed, click "Edit" and update the DNS server information.

Additional Information

• Ensure that the account used for domain join operations has the necessary permissions in Active Directory.
• Double-check that the ESXi host's hostname is correctly set in both vSphere and the host's /etc/hosts file.
• If issues persist, you may need to restart the Likewise service on the ESXi host using the following commands via SSH:
    /etc/init.d/lwsmd restart
  /usr/lib/vmware/likewise/bin/domainjoin-cli join DOMAIN username
    Replace "DOMAIN" and "username" with appropriate values.
• Verify DNS search domains (esxcli network ip dns search list), as DNS resolution failures often prevent the Likewise service from correctly updating the machine password.