User AD account getting locked out and authentication failure errors are seen in vCenter events

Products

• VMware vCenter Server

Issue/Introduction

• Multiple authentication failure error messages are reported in the vCenter logs.
• User(s) Active Directory (AD) accounts are being locked out due to too many failed login attempts.
• Despite of unlocking the account from the Active Directory, it gets locked out in a few minutes or seconds.
• The journalctl log may report the following error:
  MM DD HH:MM:SS vCenterIP/FQDN vpxd[#####] : Event [#####] [1-1] [YYYY-MM-DD HH:MM:SS] [vim. event. BadUsernameSessionEvent] [error] [USERNAME@Domain] [] [#####] [Cannot login UserName@Domain@ClientIP]

Environment

vCenter Server 7.x

vCenter Server 8.x

Cause

The credentials stored on one or more integrations with vCenter were not updated after the password change, causing those systems to authenticate with the wrong password.

Resolution

1. Identify the Client IP that is trying to use wrong credentials and trying to login to vCenter
   
   Review the journalctl logs of the vCenter to determine the source IP.

• 1. Login to the VCSA using SSH as root.
  2. Run the following command:
     # journalctl -b 0|grep BadUsernameSessionEvent|grep Locked_Out_User_Account

In the following example output, the user account is "UserName@Domain" and it shows each time the IP address that is failing to login to the vCenter.
Event [#####] [1-1] [YYYY-MM-DDTHH:MM:SS] [vim. event. BadUsernameSessionEvent] [error] [UserName@Domain] [] [#####] [Cannot login UserName@Domain@ClientIP]


      2.  Update the AD credentials for every application or solution that appears in the logs as reporting a BadUsernameSessionEvent 
           Note: In the case of backup software that may be causing this issue, make sure to update the credentials in any other modules (like LDAP or storage connections) if they use the same service account.

Additional Information

Note: This issue extends beyond Active Directory (AD) users and also affects local accounts integrated with external solutions. If journalctl logs confirm authentication failures for local users, apply the resolution steps provided in this article.