When a user is deleted from Active Directory (AD), it cannot be removed from the vCenter local Administrators group

Products

• VMware vCenter Server

Issue/Introduction

The following error is observed in the ssoAdminServer.log file:

<YYYY-MM-DD> <Time> INFO ssoAdminServer[97:pool-2-thread-3] [OpId=########-######-auto-####-##:########] [com.vmware.identity.admin.vlsi.PrincipalManagementServiceImpl] [User {Name: <USER_NAME_2>, Domain: <DOMAIN_NAME>} with role 'Administrator'] Removing principals '[{Name: <USER_NAME_1>, Domain: <DOMAIN_NAME>}]' from local group 'Administrators'

<YYYY-MM-DD> <Time> ERROR ssoAdminServer[97:pool-2-thread-3] [OpId=########-######-auto-####-##:########] [com.vmware.identity.idm.server.IdentityManager] Failed to find person user [<USER_NAME_1>@<DOMAIN_NAME>] in tenant [<NAME>.local]

Environment

VMware vCenter 6.7.x
VMware vCenter 7.x
VMware vCenter 8.x

Resolution

Follow these steps to delete the user from vCenter local Administrators group: 

1. Navigate to the /root directory.

   cd /root/

2. In the vCenter command-line interface, use the vi command to create a new file named delete_ad_user.ldif with the following content. If there are other users to be deleted, modify the value after externalObjectId= accordingly (Replace <USER_NAME_1> and <DOMAIN_NAME> with your actual username and domain name.).

   dn: cn=Administrators,cn=Builtin,dc=vsphere,dc=local
     changetype: modify
     delete: member
     member: externalObjectId=<USER_NAME_1>@<DOMAIN_NAME>

3. In the vCenter command-line interface, execute the following command:

   ldapmodify -h localhost -D "cn=administrator,cn=users,dc=vsphere,dc=local" -W -f delete_ad_user.ldif