"ERROR ACCESS DENIED" when attempting to join an ESXi host to an Active Directory domain

Products

• VMware vSphere ESXi

Issue/Introduction

• When trying to join an ESXi host to an active directory, either by using UI (vSphere Client or ESXi host client) or via the domainjoin-cli command, the attempt fails with:

  ERROR ACCESS DENIED

• After increasing the logging level for the Likewise agents on the host as per Enable logging for Likewise agents on ESXi/ESX the following message are found on the ESXi either in /var/run/log/syslog.log or in the dedicated likewise log, if the logging target was changed as per the above article:

  				YYYY-MM-DDTHH:MM:SS.XXXX VERBOSE lwio: GSS-API error calling gss_init_sec_context: 1 (The routine must be called again to complete its function)
  YYYY-MM-DDTHH:MM:SS.XXXX ERROR lsass: Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider' ) -> error = 5, symbol = ERROR ACCESS DENIED, client pid = 525659
  YYYY-MM-DDTHH:MM:SS.XXXX VERBOSE lsass-ipc: (assoc:0xe04768c020) Dropping: Connection closed by peer

• The connection between the ESXi host and the domain controller(s) have been confirmed to be open (DNS, Firewall, required TCP ports etc) and the user chosen to attempt the join has the required permissions.

Environment

• VMware vSphere ESXi 7.0.x
• VMware vSphere ESXi 8.0.x

Cause

This issue can occur when there is an existing computer object with the same FQDN already existing in the Active Directory domain before the host is joined.

Resolution

To resolve this issue, review the Active Directory Users and Computers and find the existing computer object matching the ESXi host's name.
Remove the object, then make another attempt to join the host to the domain.

If the join fails despite there not being an existing computer object in the domain, contact Broadcom support.

Additional Information

The same steps are also valid for vCenter Server Appliance domain join:

• Delete the existing computer account.
• Re-join the vCenter to domain and reboot the vCenter Server Appliance