The purpose of this article is to assist in repointing multiple vCenter Servers to a new SSO domain due to major inconsistencies within vmdir. It uses an example of 3 vCenter Servers that are repointed from their current SSO domain to join a brand new single SSO domain. It recreates the entire vmdir structure, which means all data that is stored in vmdir will be lost and recreated. There are some things that will need to be documented and recreated manually afterwards. This includes Global permissions, custom local SSO users and groups, and any external identity source(s) configured. No UUIDs, certificates, roles, inventory permissions, VM parameters, performance data, are changed or lost. Because it recreates the SSO domain from scratch, it is the most guaranteed way to correct vmdir inconsistencies in an ELM environment. The example below can be adjust though for the number of vCenter Servers being moved. Add / Remove portions related to the "node" accordingly.
vCenter Server (VCSA) 6.7
vCenter Server (VCSA) 7.x
vCenter Server (VCSA) 8.x
/usr/lib/vmware-vmafd/bin/vmafd-cli get-ldu --server-name localhost
6. Repoint the first node to a new SSO domain (node_a.vmware.com):
cmsso-util domain-repoint -m execute --src-emb-admin Administrator --dest-domain-name vsphere.local
cmsso-util domain-repoint -m pre-check --src-emb-admin Administrator --replication-partner-fqdn node_a.vmware.com --replication-partner-admin administrator --dest-domain-name vsphere.local
cmsso-util domain-repoint -m execute --src-emb-admin Administrator --replication-partner-fqdn node_a.vmware.com --replication-partner-admin administrator --dest-domain-name vsphere.local
cmsso-util domain-repoint -m pre-check --src-emb-admin Administrator --replication-partner-fqdn node_b.vmware.com --replication-partner-admin administrator --dest-domain-name vsphere.local
cmsso-util domain-repoint -m execute --src-emb-admin Administrator --replication-partner-fqdn node_b.vmware.com --replication-partner-admin administrator --dest-domain-name vsphere.local
/usr/lib/vmware-vmdir/bin/vdcrepadmin -f createagreement -2 -h node_c.vmware.com -H node_a.vmware.com -u administrator
/opt/likewise/bin/ldapmodify -x -D cn=Administrator,cn=Users,dc=vsphere,dc=local -W <<EOF
dn: CN=SystemConfiguration.Administrators,dc=vsphere,dc=local
changetype: modify
add: member
member: cn=Administrators,cn=Builtin,dc=vsphere,dc=local
dn: CN=ComponentManager.Administrators,dc=vsphere,dc=local
changetype: modify
add: member
member: cn=Administrator,cn=Users,dc=vsphere,dc=local
dn: cn=node_a.vmware.com,ou=Domain Controllers,dc=vsphere,dc=local
changetype: modify
replace: vmwLDUGuid
vmwLDUGuid: LDU-GUID-from-step-4
dn: cn=node_b.vmware.com,ou=Domain Controllers,dc=vsphere,dc=local
changetype: modify
replace: vmwLDUGuid
vmwLDUGuid: LDU-GUID-from-step-4
dn: cn=node_c.vmware.com,ou=Domain Controllers,dc=vsphere,dc=local
changetype: modify
replace: vmwLDUGuid
vmwLDUGuid: LDU-GUID-from-step-4
EOF
Repoint a vCenter Server Node to a New Domain - https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vcenter.install.doc/GUID-9CB77874-D032-4C94-99AA-5340CB922F57.html
Repoint a vCenter Server Node to an Existing Domain with a Replication Partner - https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vcenter.install.doc/GUID-575C9B57-216B-4435-B410-D5AF1CECC026.html
Determining replication agreements and status with the Platform Services Controller (PSC) - (https://kb.vmware.com/s/article/2127057#createagreement_parameter)
ESXI bootup through Auto-Deploy stuck at /vmw/rbd/host/xxxxxxxxxx/waiter.tgz - https://knowledge.broadcom.com/external/article?legacyId=70635
VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice - https://knowledge.broadcom.com/external/article/313886/vmware-vcenter-in-enhanced-linked-mode-p.html