Error: 'Error while getting Persistable Token for Session User from TES' when scheduling tasks from vCenter

Products

• VMware vCenter Server

Issue/Introduction

• Scheduled virtual machine tasks (such as snapshots) fail with the following error in the vSphere Client: A general system error occurred: Error while getting Persistable Token for Session User from TES.
• In the vCenter Server, /var/log/vmware/vpxd/vpxd.log file contains:
  
  

  YYYY-MM-DD HH:MM:SS error vpxd[####] [Originator@6876 sub=MoScheduledTask opID=####] Failed to get persistable Token: Unexpected SOAP fault: ns0:InvalidRequest; request failed.
  YYYY-MM-DD HH:MM:SS error vpxd[####] [Originator@6876 sub=Default opID=####] [VpxLRO] -- ERROR task-###### -- ScheduledTaskManager -- vim.scheduler.ScheduledTaskManager.create: :vmodl.fault.SystemError
  --> reason = "Error while getting Persistable Token for Session User from TES"

• Note: Manual snapshots work without issue. In environments that have undergone migrations or upgrades, multiple Machine IDs may be present in the SSO directory, leading to confusion over which identity is active.

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

The active vpxd Service Principal (Solution User) is missing from the ActAsUsers SSO group. The Token Exchange Service (TES) requires this membership to issue persistable tokens for scheduled operations. If a stale Machine ID from a previous deployment is present in the group while the active one is absent, the error persists despite appearing "configured".

Resolution

Important: Before proceeding, take an offline snapshot of the vCenter Server. If in Enhanced Linked Mode, snapshot all linked nodes. See VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice.

1. Identify the Active Machine ID: SSH into vCenter as root and run: /usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost e.g. ########-####-####-####-##########

2. Verify Group Membership: List the current members of the ActAsUsers group using command: ldapsearch -o ldif-wrap=no -LLL -h localhost -b "cn=ActAsUsers,dc=vsphere,dc=local" -s sub -D "cn=Administrator,cn=Users,dc=vsphere,dc=local" -w '<PASSWORD>' member

    Check if the active ID from Step 1 matches an entry formatted as: CN=vpxd-########-####-####-####-##########,CN=ServicePrincipals,DC=vsphere,DC=local

    Note: Replace vsphere.local with custom domain name if the environment does not use the default SSO domain.

3. Add the Active User to the Group: If the active ID is missing, add it using the following command: /usr/lib/vmware-vmafd/bin/dir-cli group modify --name ActAsUsers --add vpxd-[ACTIVE-MACHINE-ID]

4. Restart Service: The vpxd service must be restarted to enforce the LDAP group changes: service-control --restart vpxd

5. Verification: Log out and back into the vSphere Client. Delete the previously failed scheduled task and create a new one to test.

Additional Information

• For instructions on retrieving logs, see Collecting diagnostic information for VMware vCenter Server.
• If the issue persists, contact support. To speak with a customer representative or a Support Engineer see Contact Support.