Machine ID mismatch between sca.hostid and Likewise registry in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

Running the VCF Diagnostic Tool for vSphere (VDT) returns a [FAIL] for "Machine ID Check" or "Solution User Cert Parity Checks". While vCenter Server functions like SSO and certificates appear normal, the VDT reports a "Current MID" that does not match the value in /etc/vmware/install-defaults/sca.hostid. This condition typically indicates the Likewise registry is out of sync with the authoritative VMAFD store.

Symptoms:

• VDT reports: [FAIL] Machine ID Check - Machine ID doesn't match vpxd.cfg

• VDT reports: [FAIL] Solution User Cert Parity Checks.NoSolutionUsersFound: No solution users found matching machine ID:
####
• Manual check of /opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\vmdir]' "MachineGuid" shows a different UUID than vmafd-cli get-machine-id.

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

The Likewise registry MachineGuid can become desynchronized from the authoritative VMAFD machine ID during lifecycle events such as node restorations from backup, repointing to a new SSO domain, or vCenter upgrades. While the core VMAFD database updates, the local Likewise SQLite database (registry.db) may retain a stale UUID.

Resolution

Note: Take an offline (powered off) snapshot of the vCenter Server. If the vCenter is part of an Enhanced Linked Mode (ELM) domain, take offline snapshots of all replication partners simultaneously. VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

1. Run the following command to identify the authoritative Machine ID: /usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost

2. Confirm the value in the hostid file: cat /etc/vmware/install-defaults/sca.hostid
   
   
3. Use lwregshell to set the MachineGuid to the UUID obtained in Step 2: /opt/likewise/bin/lwregshell set_value '[HKEY_THIS_MACHINE\Services\vmdir]' 'MachineGuid' '####-####-####-####'

4. Update the VMAFD machine ID if it does not already match: /usr/lib/vmware-vmafd/bin/vmafd-cli set-machine-id --server-name
localhost --id ####-####-####-####
   
   
5. Restart all vCenter services to apply changes: service-control --stop --all && service-control --start --all
   
   
6. Re-run VDT to confirm the checks pass.

Additional Information

After setting the new sca.hostid, run the VCF Diagnostic Tool for vSphere on the vCenter Server to get an overall health check of the system.  If any failure messages are listed in the VDT results, contact Broadcom Support for additional assistance.

The tool can be downloaded from the Attachments section of KB article 344917:

Using the VCF Diagnostic Tool for vSphere (VDT)

Instructions on running the tool are listed in the "Download and Installation" section of the KB article.