ESXi Host Domain Join Fails with LW_ERROR_DOMAIN_IS_OFFLINE Error

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to join an ESXi host to an Active Directory domain using domainjoin-cli, the operation fails with the error "LW_ERROR_DOMAIN_IS_OFFLINE [code 0x00009cb9]", even though basic network connectivity tests (ping, nslookup) to the domain controllers are successful.

Environment

- VMware ESXi
- Active Directory domain environment

Cause

This error typically occurs when there is a network connectivity issue specifically with port 88 (Kerberos) between the ESXi host and domain controllers, even when other required ports are accessible. The domain join process requires complete connectivity on all necessary ports, with port 88 being particularly crucial for Kerberos authentication.

Resolution

1. Verify network connectivity using the VDT (vSphere Diagnostic Tool):
   1. Follow Using the VCF Diagnostic Tool for vSphere (VDT)
   2. Review the output focusing on port 88 connectivity tests
   3. Document any failed connection attempts
      
      
2. Verify required ports are open between ESXi host and domain controllers:
   • TCP: 88, 139, 389, 445, 464, 3268
   • UDP: 88, 123, 137, 389, 464
     
     
3. Work with network team to:
   1. Check firewall rules for port 88 (both TCP and UDP)
   2. Verify no network devices are blocking Kerberos traffic
   3. Confirm domain controller configuration allows incoming connections on port 88
      
      
4. Once network connectivity is confirmed:
   1. Restart the Likewise service:

      • /etc/init.d/lwsmd restart

   2. Attempt domain join again:

      • /usr/lib/vmware/likewise/bin/domainjoin-cli join domain.name username

   ```

Additional Information

• Using checkADConfig to detect connectivity and DNS issues between vCenter Server and Active Directory
• Using the lw-measure tool to detect latency between vCenter Server and Active Directory domain controllers