Failing to Login with [email protected] and Receiving error: "Cannot connect to vcenter single sign-on server /sts/stsservice/vsphere.local"

Products

• VMware vCenter Server

Issue/Introduction

Unable to access the GUI with any account, and the commands to create a testuser in Cannot connect to vCenter Single Sign-On server https://FQDN/sts/STSService/vsphere.local on logging in with local administrator account are failing with authorization errors. 

The vmdird.log reports a value other than 0:

2025-07-17T13:44:10.847134+00:00 info vmdird  t@140015212402432: User account control - (cn=administrator,cn=users,dc=vsphere,dc=local): (800010) flag unset, new value=(2)

Environment

vCenter 6.x

vCenter 7.x

vCenter 8.x

Cause

Administrator account is disabled and needs to be restored.

Resolution

 Use the domain controller account of the vCenter to access the directory with Admin permissions by running this command in an SSH to the vCenter:

 /opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\services\vmdir\]' | grep dcAccountDN | cut -d '"' -f4
get domain controller password:  /opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\services\vmdir\]' | grep dcAccountPassword | cut -d '"' -f4

You will be prompted for the domain controller password. Once entered, proceed to unlocking the administrator account by running:

/opt/likewise/bin/ldapmodify -x -D "<domain controller account here>" -W <<EOF
dn: cn=Administrator,cn=users,dc=vsphere,dc=local
changetype: modify
replace: userAccountControl
userAccountControl: 0
EOF

Change the permissions from read to part of the admin group:

/opt/likewise/bin/ldapmodify -x -D "<domain controller account here>" -W <<EOF
dn: cn=Administrators,cn=Builtin,dc=vsphere,dc=local
changetype: modify
add: member
member:cn=Administrator,cn=users,dc=vsphere,dc=local
EOF

Attempt to login to the GUI and ensure [email protected] has been enabled in Menu -> Administration -> Single Sign On -> Users and Groups.