Error: "[FAIL] VMdir DFL Check" when running VCF Diagnostic Tool for vSphere (VDT)

Products

• VMware vCenter Server

Issue/Introduction

• A failure is reported during the vmdir domain-functional-level (DFL) check when running the vSphere Diagnostic Tool (VDT) on a vCenter Server.
  
  
• The following error is displayed: [FAIL] VMdir DFL Check. VMDIR Domain Functional Level is incorrect! 
  
  
• The DFL value of the vCenter server is incorrectly set to 1. This value is retrieved with the following command:
  
  /usr/lib/vmware-vmafd/bin/dir-cli domain-functional-level get

Environment

• VMware vCenter Server 7.x
  
  
• VMware vCenter Server 8.x

Cause

The failure is rooted in a discrepancy between the DFL value stored in the vmdir and the value expected by the current version of the vCenter Server. Specifically, this issue impacts vCenter Servers that are upgraded from older versions, such as vCenter Server 6.5.

• After an upgrade from vCenter Server 6.5, which uses a DFL of 1, the vmdir incorrectly retains this value.
  
  
• For vCenter Server 7.0 and later, the expected DFL is 4, leading to the mismatch flagged by the VDT.

Resolution

Note: A snapshot of the vCenter Server Appliance must be taken before proceeding. If the vCenter Server is part of an Enhanced Linked Mode (ELM) topology, powered-off snapshots of all vCenter Server Virtual Machines within the ELM must be taken. For more information, see Snapshot Best practices for vCenter Server Virtual Machines.

1. The DFL of the affected node must be set to 4 with the following command:
   
   /usr/lib/vmware-vmafd/bin/dir-cli domain-functional-level set --level 4 --login [e-mail] --domain-name vsphere.local

Note: The vsphere.local string must be updated to match the current SSO domain name.
   
   
2. The vmdir service must be restarted on all linked vCenter nodes using the following command:
   
   service-control --restart vmdird


3. Validate the DFL is now set to 4 with the following command:
   
   /usr/lib/vmware-vmafd/bin/dir-cli domain-functional-level get
   
   Note: A service restart on all nodes must only be performed after updating the DFL of all the nodes in the ELM topology. Otherwise, a failure to start vmdir occurs on the nodes that have a higher DFL than their partners.

Additional Information

In scenarios where vmdir enters a failure state after an upgrade to vCenter Server 8.0 U1, refer to VMdir enters failure state after upgrading vCenter Server to 8.0 U1.